Hi @brdr ...the above 2 SPL are working fine as you can see on the screenshots below. the easiest one is the split command: | makeresults | eval field_id="/key1/value1/key2/value2/key3/value3/key4/value4" | eval temp=split(field_id,"/") | eval field_key1=mvindex(temp,2) | eval field_key2=mvindex(temp,4) | table field_id field_key1 field_key2      

Hi @iamsplunker ... pls suggest if you have HF or UF and indexer. also pls suggest us if you have had a chance to look at this doc... pls copy paste your current props/transforms https://docs.splunk.com/Documentation/Splunk/9.1.1/Data/Anonymizedata  

Your where clause is wrong - it does not support the IN construct, like search. You could do it with | where in(UserId,125,999,418,208) or using search IN. As @gcusello says, using join and subsearches is not a good habit, using stats can normall do the same and does not have limitations that join/subsearch has, e.g. this is an example of using stats. index=customer (name IN (gate-green, gate-blue) msg="*First time: *") OR (name IN (cust-blue, cust-green) msg="*COMPLETED *") | rex field=msg "First time: (?<UserId>\d+)" | eval FirstRequest = if(isnotnull(UserId),1,null()) | rex field=msg "Message\|[^\t\{]*(?<json>{[^\t]+})" | spath input=json path=infoId output=CompletedUserId | eval Completed = if(isnotnull(CompletedUserId), 1, null()) | eval UserId=coalesce(UserId, CompletedUserId) | stats values(Completed) as Completed by UserId | search UserId IN (125,999,418,208)

Your Earliest statement is wrong, if you just want yesterday, do this index=WinEventLog* EventID=4625 earliest=-d@d latest=@d | stats count by user, _time, action, subject, message which will give you a list of the failed logins - do you really want to group by _time as well or do you want to show the first or last time of the failed login?  

You can't do it with a single value viz, but I suggest using Chris Younger's excellent number display viz - https://splunkbase.splunk.com/app/4537   See this example that shows you how you can do it <dashboard> <label>single</label> <row> <panel> <viz type="number_display_viz.number_display_viz"> <search> <query>| makeresults | eval title="Score" | eval value=7 | eval subtitle="67%" | fields - _time</query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="number_display_viz.number_display_viz.bordercolor">#ffffff</option> <option name="number_display_viz.number_display_viz.bordersize">2</option> <option name="number_display_viz.number_display_viz.colorprimary">#000000</option> <option name="number_display_viz.number_display_viz.colorprimarymode">auto</option> <option name="number_display_viz.number_display_viz.colorsecondary">#000000</option> <option name="number_display_viz.number_display_viz.colorsecondarymode">darker1</option> <option name="number_display_viz.number_display_viz.max">100</option> <option name="number_display_viz.number_display_viz.min">0</option> <option name="number_display_viz.number_display_viz.nodatacolor">#0178c7</option> <option name="number_display_viz.number_display_viz.padding">10</option> <option name="number_display_viz.number_display_viz.pulserate">4</option> <option name="number_display_viz.number_display_viz.shadowcolor">#F2F4F5</option> <option name="number_display_viz.number_display_viz.shapebordercolor">#FFFFFF</option> <option name="number_display_viz.number_display_viz.shapebordercolormode">static</option> <option name="number_display_viz.number_display_viz.shapebordersize">1</option> <option name="number_display_viz.number_display_viz.shapedropcolor">#ffffff</option> <option name="number_display_viz.number_display_viz.shapeshadow">yes</option> <option name="number_display_viz.number_display_viz.shapetexture">solid</option> <option name="number_display_viz.number_display_viz.sparkHeight">30</option> <option name="number_display_viz.number_display_viz.sparkWidth">90</option> <option name="number_display_viz.number_display_viz.sparkalign">5</option> <option name="number_display_viz.number_display_viz.sparkalignv">70</option> <option name="number_display_viz.number_display_viz.sparkcolorfill">#009DD9</option> <option name="number_display_viz.number_display_viz.sparkcolorline">#0178c7</option> <option name="number_display_viz.number_display_viz.sparkcolormodefill">auto</option> <option name="number_display_viz.number_display_viz.sparkcolormodeline">auto</option> <option name="number_display_viz.number_display_viz.sparkmin">0</option> <option name="number_display_viz.number_display_viz.sparknulls">gaps</option> <option name="number_display_viz.number_display_viz.sparkorder">bg</option> <option name="number_display_viz.number_display_viz.sparkstyle">area</option> <option name="number_display_viz.number_display_viz.spinnerspeedmax">20</option> <option name="number_display_viz.number_display_viz.spinnerspeedmin">1</option> <option name="number_display_viz.number_display_viz.style">a7</option> <option name="number_display_viz.number_display_viz.subtitlealign">center</option> <option name="number_display_viz.number_display_viz.subtitlealignv">70</option> <option name="number_display_viz.number_display_viz.subtitlecolor">#5C6773</option> <option name="number_display_viz.number_display_viz.subtitlecolormode">static</option> <option name="number_display_viz.number_display_viz.subtitledrop">yes</option> <option name="number_display_viz.number_display_viz.subtitledropcolor">#ffffff</option> <option name="number_display_viz.number_display_viz.subtitlesize">40</option> <option name="number_display_viz.number_display_viz.textalign">center</option> <option name="number_display_viz.number_display_viz.textalignv">50</option> <option name="number_display_viz.number_display_viz.textcolor">#000000</option> <option name="number_display_viz.number_display_viz.textdrop">yes</option> <option name="number_display_viz.number_display_viz.textdropcolor">#ffffff</option> <option name="number_display_viz.number_display_viz.textduration">300</option> <option name="number_display_viz.number_display_viz.textmode">static</option> <option name="number_display_viz.number_display_viz.textprecision">1</option> <option name="number_display_viz.number_display_viz.textsize">100</option> <option name="number_display_viz.number_display_viz.textunitposition">after</option> <option name="number_display_viz.number_display_viz.textunitsize">50</option> <option name="number_display_viz.number_display_viz.thickness">50</option> <option name="number_display_viz.number_display_viz.thresholdcol1">#1a9035</option> <option name="number_display_viz.number_display_viz.thresholdcol2">#d16f18</option> <option name="number_display_viz.number_display_viz.thresholdcol3">#b22b32</option> <option name="number_display_viz.number_display_viz.thresholdcol4">#ffffff</option> <option name="number_display_viz.number_display_viz.thresholdcol5">#ffffff</option> <option name="number_display_viz.number_display_viz.thresholdcol6">#ffffff</option> <option name="number_display_viz.number_display_viz.thresholdsize">20</option> <option name="number_display_viz.number_display_viz.thresholdval2">70</option> <option name="number_display_viz.number_display_viz.thresholdval3">90</option> <option name="number_display_viz.number_display_viz.titlealign">center</option> <option name="number_display_viz.number_display_viz.titlealignv">30</option> <option name="number_display_viz.number_display_viz.titlecolor">#5C6773</option> <option name="number_display_viz.number_display_viz.titlecolormode">static</option> <option name="number_display_viz.number_display_viz.titledrop">yes</option> <option name="number_display_viz.number_display_viz.titledropcolor">#ffffff</option> <option name="number_display_viz.number_display_viz.titlesize">45</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> </row> </dashboard>  

Thank you. I need to collect and generate a syslog report that shows login failure events occurred on the previous day, grouped by source user This is all I have been able to come up with so far:    index=WinEventLog* EventID=4625 Earliest=-24 | stats count by user, _time, action, subject, message

Thank you. I need to collect and generate a syslog report that shows login failure events occurred on the previous day, grouped by source user This is all I have been able to come up with so far:    index=wineventlog* eventid=4625 earliest=-24 | stats count by user, _time, action, subject, message

@niketn wrote: @badoomi, optimizing lookup search may not be straight-forward without knowing your SPL and Splunk Infra ( as to how many Indexers you have got). However you can refer to following Splunk Documentation for one of tip to optimize lookup By default lookup command runs with argument local=true which means it is executed on Search Peer not on Search Head. If you have multiple indexers and your SPL till the lookup command have only streaming commands then there would be an advantage of this otherwise not. In essence you would need to test out stats first then lookup vs lookup first and stats next. Do share your current SPL for community members to assist you better with your use case.   I think there may have been a typo this this original answer as the lookup command has local=false set by default - source: https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Lookup   local Syntax: local=<bool> Description: If local=true, forces the lookup to run on the search head and not on any remote peers. Default: false

Hi Guiseppe, Yes to all you mention. The data gets into splunk but ONLY the log aggregator shows up as a host on the search window on the left. I need all the hosts showing up.  If I search using the other hostnames I can see the logfile from that host - just doesn't show as a host on the left. Make sense? 

Hello @gcusello I managed to not use the join command, the above feedback helped.  I decided to go with Union this seems to be working, what do you think? index=customer ((name IN (gate-green, gate-blue) msg="*First time: *") | rex field=msg "First time: (?<UserId>\d+)" | eval FirtRequest = 1 |union [ search index name IN (cust-blue, cust-green) msg="*COMPLETED *") | rex field=msg "Message\|[^\t\{]*(?<json>{[^\t]+})" | spath input=json path=infoId output=UserId | eval Completed = 1] | stats max(FirstRequest) AS FirstRequest max(Completed) BY UserId