You can fetch results of lookup using search: | inputlookup your_lookup.csv Replacing lookup data would be: ```your search here``` | outputlookup your_lookup.csv And then you can add(append) rows using: ```your search here``` | outlookup append=true your_lookup.csv ... View more

Hi it seems that when you are using output_mode=json those f=xyz didn't work. Instead of those you must use jq as @deepakc already propose. curl -ksu $UP 'https://localhost:8089/servicesNS/-/-/admin/macros?count=4&output_mode=json' | jq '.entry[].name' "3cx_supply_chain_attack_network_indicators_filter" "7zip_commandline_to_smb_share_path_filter" "abnormally_high_aws_instances_launched_by_user___mltk_filter" "abnormally_high_aws_instances_launched_by_user_filter" You could/should leave comment on doc page where output_mode has defined and add information that if you are using json mode then f=xyz doesn't work. Doc team is really helpful to update that kind of notes into real documentation. r. Ismo  ... View more

CIM-compliance is different and has nothing to do with whether a field can be used in the tstats command.  CIM-compliance means a field has a name and value described in the CIM manual (https://docs.splunk.com/Documentation/CIM/5.3.2/User/Howtousethesereferencetables). The only fields the can be used in tstats are those created at index-time or those in an accelerated datamodel. ... View more

I just stumbled upon this post while looking for something semi-unrelated. FWIW: There are some instances where it must be set to "true" in the .conf files. I had an issue back in Feb where queries were not displaying length of execution in Splunk 9.0.8.  Found a KB article in Splunk support that suggested it might be caused by a setting** in limits.conf that was set to "1" instead of "true". We changed it to "true" and that fixed it. We did a little digging with the rest API and found that it would return 1/0 for the configs, but when looking at the .confs, they were written as true/false. **I won't reference the setting so as to not upset the Splunk Gods who may hold support contracts sacred. ... View more

@danielbb  Warm and cold buckets can be copied safely while Splunk is running. You don’t necessarily need to stop Splunk to perform the cold data migration.  Refer the below link:  https://community.splunk.com/t5/Deployment-Architecture/How-to-migrate-data-of-cold-and-thawed-path-to-different/m-p/580124  ... View more

Please change the sourcetype and try ... View more

The rex command defaults to the _raw field.  Other fields must be explicitly referenced.  The following works in my sandbox. | makeresults | eval message="<UL> <LI> The first vulnerability occurs because Internet Explorer does not correctly determine an obr in a pop-up window.</LI> <LI> The t type that is returned from a Web server during XML data binding.</LI> </UL> <P> &quot;Location: URL:ms-its:C:WINDOWSHelpiexplore.::/itsrt.htm&quot; <P> :<P><A HREF='http://blogs.msdn.com/embres/archive/20/81.aspx' TARGET='_blank'>October Security Updates are (finally) available!</A><BR>" | rex field=message mode=sed "s/\<[^\>]+>//g"   ... View more

To get a count, replace the dedup command with stats.  Since the stats command sorts it results, you don't need the separate sort command. index=cisco sourctype=cisco:asa message_id=XXXXXX | stats count by host, src_ip, dest_ip, dest_port, action | table host, src_ip, dest_ip, dest_port, action count   ... View more

Hi @marco_massari11 , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

There are no legitimate practice exams.  Use the blueprint (https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-user.pdf) to prepare.  It will tell you what subjects are on the exam and then you can use other Splunk resources, including free training, to learn those subjects. ... View more

Here's a query that will find most KOs owned by inactive users.  You may want to enhance it to also look for lookups.  Of course, change the '90' to whatever value you deem to be 'inactive'. | rest splunk_server=local /servicesNS/-/-/admin/directory | fields title eai:acl.app eai:acl.owner eai:type eai:acl.sharing | rename eai:acl.* as * | where (owner!="nobody" AND owner!="admin") | search [| rest splunk_server = local /servicesNS/-/-/admin/users | fields title last_successful_login | eval lastLogin = if(isnull(last_successful_login) OR last_successful_login=0,"never", strftime(last_successful_login, "%c")) | eval idleDays = round((now()-last_successful_login)/86400,0) | where (idleDays > 90 OR lastLogin = "never") | fields title | rename title as owner | format] ... View more

Tell Splunk which field to extract from by using the in option. EXTRACT-service = [^:]+:[^:]+:(?<service>.+)$ in source   ... View more

It looks like the app was not re-packaged properly on the Linux box.  Perhaps an extra directory level was added. ... View more

The LINE_BREAKER attribute requires at least one capture group and the text that matches the first capture group will be discarded and replaced with a event break.  Knowing this and that an empty capture group is allowed, try these settings:   [<sourcetype_name>] CHARSET=AUTO LINE_BREAKER = "platform":"ArcodaSAT"\}() SHOULD_LINEMERGE = false     ... View more

Ubuntu on Windows is still Windows.  I had the same problem.  You have to use a real Linux box. ... View more

URLs with spaces in them must be encoded.  Use the urlencode command available with the Webtools Add-on (https://splunkbase.splunk.com/app/4146). ... View more

Hi, thanks for answering it's work perfectly with that  | eval latest_time=strftime(strptime(latest_time, "%FT%T.%Q%Z"), "%F %T")   Thanks again for your answer. Laurent ... View more

How would I incorporate an average of genSecondsDifference over a 24 hour period? for 7 days? ... View more

Personal project ... View more

1. You can look for the source using metadata command | metadata type=sources or even | metadata type=sources index=your_index Alternatively you can use tstats | tstats count where index IN (some, subset, of, your, indexes) source="your_source" by index 2. The data may not be findable due to a host of possible issues: a) The data is indexed outside of your search timerange due to either data itself or wrong timestamp recognition b) The configuration can be filtering/redirecting events to another index c) The data may be being sent to a non-existent index and you don't have last-resort index defined d) The source might be overwritten on ingestion. ... View more

The makeresults command is exactly what I needed. Thank you! ... View more

You are correct. ... View more