Hi @Symon , don't use join because it's a very slow search, use stats in this way: index=fortigate sourcetype IN (fgt_event, fgt_traffic ) | eval src=coalesce(src,assignip) | stats values(srcport) AS srcport values(dest) AS dest values(destport) AS destport BY user src If you want only the events present in both the sourcetypes, you have to add an additional condition: index=fortigate sourcetype IN (fgt_event, fgt_traffic ) | eval src=coalesce(src,assignip) | stats values(srcport) AS srcport values(dest) AS dest values(destport) AS destport dc(sourcetype) AS sourcetype_count BY user src | where sourcetype_count=2 | fields - sourcetype_count Ciao. Giuseppe

I did not get results..  I have to calculate average time for closing alerts by severity, so in this case I am calculting "medium" severity alerts, so the equation should be total medium alerts / total time of "closing" medium alerts  

Alright, For those having the same problem and monitoring evolutions in replies, here is the tip: 1. Remove the Add-on for ARM64 + assert from shell (no PSC add-on when ls -l of $SPLUNK_HOME/etc/apps) 2. Install the Add-on for x86_64 3. Restart the Splunk instance (UI or CLI) The problem was simply that for M2-running Splunk instance (using Rosetta 2) necessitates x86_64 libraries for Python. Installing the ARM64 ones don't help. BUT installing the x86_64 without removing first the ARM64 won't help. I hope this will help other M2-Splunk fellows. Good luck 

Hi @allidoiswinboom , where do you located these conf files? they must be located in the first full Splunk instance that data passing through. In other words, if you're using an Heavy forwarder to take these logs, you have to put them in the HFs, if instead you're using a Universal Forwarder, you have to locate them on Indexers or on an eventual intermediate HF. Ciao. Giuseppe

Hi @Harish2 , you have to exclude from results the days and the hours, something like this: | tstats count latest(_time) as _time WHERE index=app-idx host="*abfd*" sourcetype=app-source-logs BY host | eval day=strftime(_time, "%d"), hour=strftime(_time, "%H") | where NOT (day IN (10, 18, 25) OR hour<8 OR hour>11) | fields - _time day hour You can also check weekends and holydays, using using a lookup containing the holydays, e.g.: date type 2024-03-29 ferial 2024-03-30 weekend 2024-04-31 weekend 2024-04-01 holyday 2024-04-02 ferial 2024-04-03 ferial 2024-04-04 ferial 2024-04-05 weekend 2024-04-06 weekend 2024-04-07 ferial and running something like this: | tstats count latest(_time) as _time WHERE index=app-idx host="*abfd*" sourcetype=app-source-logs BY host | eval day=strftime(_time, "%d"), hour=strftime(_time, "%H"), date=strftime(_time, "%Y-%m-%d |lookup calendsr.csv date OUTPUT type | where NOT (day IN (10, 18, 25) OR hour<8 OR hour>11 OR type IN ("weekend", "holyday")) | fields - _time day hour Ciao. Giuseppe

Thanks for the tip.  I'm afraid I don't quite know what to ingest on Mac or how to do it right especially if it should be shipped to another instance.  The problematic one is a work computer that is connected to corporate VPN (but will disconnect from time to time) and runs a bunch of corporate "security stuff" like MS Defender.

@DaisyNguyen  Hey, Ensure that you have the necessary permissions. You need the "edit_modinput_identity_manager" capability to use the Asset and Identity Management interface. Verify your role assignments and permissions in Splunk.  Manage assets and identities in Splunk Enterprise Security - Splunk Documentation Configure users and roles - Splunk Documentation

Assuming you make a lookup called silence.csv with the following: exclude_days silence_start silence_end 10,18,25 8 11 you can do something liie | tstats count max(_time) as _time ``` you will need latest _time ``` where index=app-idx host="*abfd*" sourcetype=app-source-logs by host | eval dom = strftime(_time, "%m"), hod = strftime(_time, "%H") | append [inputlookup exclusions.csv | eval exclude_days = split(exclude_days, ",")] | eventstats values(exclude_days) as exclude_days values(silence_*) as silent_* | where NOT dom IN exclude_days AND (silence_start > hod OR hod > silence_end) ``` whether AND or OR depends on exact semantic ``` | fields - _time dom hod But note if you have lots of hosts with alert, this can get slow.  This is a method that is flexible to implement either of possible intentions in a similar fashion.  If performance becomes a problem, you will need optimize for the exact intent.

@bowesmana @yuanliu  I think I just figured it out using math (modulo)  Please let me know what you think..   Thank you for your help For Tuesday           | where (_time % 604800) = 450000 For Wednesday    | where (_time % 604800) = 536400 And so on.. See this table, there is a pattern for each day of the week Day time _time Student MathGrade mod 604800 Thursday 2/8/24 5:00 AM 1707368400 Student1 10 18000 Friday 2/9/24 5:00 AM 1707454800 Student1 9 104400 Saturday 2/10/24 5:00 AM 1707541200 Student1 8 190800 Sunday 2/11/24 5:00 AM 1707627600 Student1 7 277200 Monday 2/12/24 5:00 AM 1707714000 Student1 6 363600 Tuesday 2/13/24 5:00 AM 1707800400 Student1 5 450000 Wednesday 2/14/24 5:00 AM 1707886800 Student1 6 536400 Thursday 2/15/24 5:00 AM 1707973200 Student1 7 18000 Friday 2/16/24 5:00 AM 1708059600 Student1 8 104400 Saturday 2/17/24 5:00 AM 1708146000 Student1 9 190800 Sunday 2/18/24 5:00 AM 1708232400 Student1 10 277200 Monday 2/19/24 5:00 AM 1708318800 Student1 10 363600 Tuesday 2/20/24 5:00 AM 1708405200 Student1 9 450000 Wednesday 2/21/24 5:00 AM 1708491600 Student1 8 536400 Thursday 2/22/24 5:00 AM 1708578000 Student1 7 18000 Friday 2/23/24 5:00 AM 1708664400 Student1 6 104400 Saturday 2/24/24 5:00 AM 1708750800 Student1 5 190800 Sunday 2/25/24 5:00 AM 1708837200 Student1 6 277200 Monday 2/26/24 5:00 AM 1708923600 Student1 7 363600 Tuesday 2/27/24 5:00 AM 1709010000 Student1 8 450000 Wednesday 2/28/24 5:00 AM 1709096400 Student1 9 536400 Thursday 2/29/24 5:00 AM 1709182800 Student1 10 18000 Friday 3/1/24 5:00 AM 1709269200 Student1 10 104400 Saturday 3/2/24 5:00 AM 1709355600 Student1 9 190800 Sunday 3/3/24 5:00 AM 1709442000 Student1 8 277200