Hi All, Can someone pls assist me in extracting the different Recipients out this nested Json ?  This is from O365 logs.    I have followed https://community.splunk.com/t5/Getting-Data-In/Extract-nested-json/m-p/496227#M84641  but unable to get it work against my data. Raw events:     OperationProperties: [ [-] { [+] } { [-] Name: RuleId Value: 3623734839020093442 } { [-] Name: RuleName Value: ForwardingRule01 } { [+] } { [-] Name: RuleActions Value: [{"ActionType":"Forward","Recipients":["WADRIANL@domain.com","WENDYLIM@domain.com", Forward Flags":"None"}] } ]     Note, Splunk is able to extract the field OperationProperties{}.Value as shown below but how to further extract the list of Recipients within it ? I am trying below searches but no luck      | spath output=Recipients path=OperationProperties{}.Value.Recipients OR | spath output=Recipients path=OperationProperties{}.Value{}.Recipients{}     i am +ve i am making a mistake in the path variable above.  Thanks in advance  

Hi all, I am new at Splunk and trying to evaluate this query.  I have some accounts, dates(week starting) and number of browsers used  by the account for that date. I have grouped the dates and number_of_browsers. there is 1 account but multiple dates and multiple  or single values for browser_types. My query: index="a" source type="ab"| rename Week Starting AS Date | stats sum(browser_ types) AS New_BrowserTypes by AccountID TotalUsers Date | eval New_BrowserTypes= round(New_BrowserTypes/TotalUsers,2) | stats MAX(New_BrowserTypes) as logins by AccountID Date | stats values(Date) values(logins) by AccountID which gives an output something like this: AccountID values(date) values(logins) 502 2020-07-20 20.00 102 2020-07-20 15.00   2020-08-25 18.00 304 2020-07-20 24.00   2020-08-25 18.00   2021-07-20 25.00   2021-08-25 15.00   For the final result, I want to use AccountID's where values(logins) are >1. So I want to use only those accounts where, logins are 2 or more. how do I achieve this? thank you in advance.  Please not this is only an example, my actual AccountID's are more than 500.    

We are spending a tremendous amount of time tuning our search structures lately. One thing we have run across in our Enterprise Security environment is an unwanted key=value in litsearch when reviewing the job board. SPL index=any-index-value sourcetype=any-sourcetype-value litsearch (index=any-index-value (sourcetype=any-sourcetype-value OR sourcetype=never-mentioned-value)) This 'never-mentioned-value' is always the same regardless of index or sourcetype we place in the SPL.  Things I have checked for: - props-lookups: No 'sourcetype as x' on input side OR 'x as sourcetype' on output side - props-EVAL-sourcetype = case(x,never-mentioned-value), this exists in our prod but same config in lower environment did not trigger the same action (will be removing this shortly after next push cause I just don't like it) - TRANSFORMS - can not find any items of interest here   I have tried the following alternative searches index=any-index-value OR index=any-index-value sourcetype::any-sourcetype-value In both of the above SPL the 'extra' sourcetype key=value does not appear in the litsearch.  I do understand the differences in indexed fields and how the searches above are not triggering the addition key=value.   What I need help/direction/input is how do I track down the errant conf edit that is resulting in additional litsearch values when the SPL contains 'sourcetype='.

Hey guys, good night, how are you? I have a big problem I created an app with the integration of a checkbox with ModalView I need to send the data shown in the modal to a lookup, but the popup.js file is unable to see the selected_values_array variable from the checkbox.js file Have you ever been through this? Can you help me? Thanks   checkbox.js       require([ 'underscore', 'jquery', 'backbone', '../app/meuapp/popup', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc/simplexml/ready!' ], function (_, $, Backbone, ModalView, mvc, TableView, SearchManager) { // Access the "default" token model var tokens = mvc.Components.get("default"); var selected_values_array = []; var submittedTokens = mvc.Components.get('submitted'); var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function (cell) { return _(['teste']).contains(cell.field); }, render: function ($td, cell) { var a = $('<div>').attr({ "id": "chk-URL" + cell.value, "value": cell.value }).addClass('checkbox').click(function () { // console.log("checked",$(this).attr('class')); // console.log("checked",$(this).attr('value')); if ($(this).attr('class') === "checkbox") { selected_values_array.push($(this).attr('value')); $(this).removeClass(); $(this).addClass("checkbox checked"); } else { $(this).removeClass(); $(this).addClass("checkbox"); var i = selected_values_array.indexOf($(this).attr('value')); if (i != -1) { selected_values_array.splice(i, 1); } // Change the value of a token $mytoken$ } console.log(selected_values_array); }).appendTo($td); console.log(selected_values_array); } }); var detailSearch = new SearchManager({ id: "detailSearch", earliest_time: "$time$", latest_time: "$time$", preview: true, cache: false, search: "| makeresults | eval myvalue=\"$mytoken$\" | makemv delim=\",\" myvalue | stats count by myvalue | table myvalue" }, { tokens: true, tokenNamespace: "submitted" }); //List of table IDs var tableIDs = ["myTable"]; for (i = 0; i < tableIDs.length; i++) { var sh = mvc.Components.get(tableIDs[i]); if (typeof (sh) != "undefined") { sh.getVisualization(function (tableView) { // Add custom cell renderer and force re-render tableView.table.addCellRenderer(new CustomRangeRenderer()); tableView.table.render(); }); } }; $(document).ready(function () { $("#mybutton").on("click", function (e) { e.preventDefault(); tokens.set("mytoken", selected_values_array.join()); submittedTokens.set(tokens.toJSON()); var modal = new ModalView({ title: "ModalView Window", search: detailSearch }); modal.show(); console.log(tokens); console.log(selected_values_array + " selected_values_array"); console.log(modal + " modal"); //console.log(render); }); }); });             popup.js       define([ 'underscore', 'backbone', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc/simplexml/element/table', ], function(_, Backbone, $, mvc, SearchManager, TableElement) { var modalTemplate = "<div id=\"pivotModal\" class=\"modal\">" + "<div class=\"modal-header\"><h3><%- title %></h3><button class=\"close\">Close</button></div>" + "<div class=\"modal-body\"></div>" + "<div class=\"modal-footer\"><button type=\"button\" id=\"teste\" class=\"confirm\">Confirmar</button></div>" + "</div>" + "<div class=\"modal-backdrop\"></div>"; var ModalView = Backbone.View.extend({ defaults: { title: 'Not set' }, initialize: function(options) { this.options = options; this.options = _.extend({}, this.defaults, this.options); this.childViews = []; console.log('Hello from the modal window: ', this.options.title); this.template = _.template(modalTemplate); }, events: { 'click .close': 'close', 'click .modal-backdrop': 'close', 'click .confirm': 'confirm', }, render: function() { var data = { title : this.options.title }; this.$el.html(this.template(data)); return this; }, show: function() { $(document.body).append(this.render().el); $(this.el).find('.modal-body').append('<div id="modalVizualization"/>'); $(this.el).find('.modal').css({ width:'90%', height:'auto', left: '5%', 'margin-left': '0', 'max-height':'100%' }); var search = mvc.Components.get(this.options.search.id); var detailTable = new TableElement({ id: "detailTable", managerid: search.name, pageSize: "5", el: $('#modalVizualization') }).render(); this.childViews.push(detailTable); search.startSearch(); }, close: function() { this.unbind(); this.remove(); _.each(this.childViews, function(childView) { childView.unbind(); childView.remove(); }); }, confirm: function(selected_values_array) { tokens.set("mytoken", selected_values_array.join()); submittedTokens.set(tokens.toJSON()); new SearchManager({ id: "envSearch", earliest_time: "$time$", latest_time: "$time$", preview: true, cache: false, search: "| makeresults | eval myvalue=\"$mytoken$\" | makemv delim=\",\" myvalue | rename myvalue as URL | stats count by URL | table URL | outputlookup append=t dev-tk" }); } }); return ModalView; });         chexkbox.css       /* The standalone checkbox square*/ .checkbox { width:20px; height:20px; border: 1px solid #000; display: inline-block; } /* This is what simulates a checkmark icon */ .checkbox.checked:after { content: ''; display: block; width: 4px; height: 7px; /* "Center" the checkmark */ position:relative; top:4px; left:7px; border: solid #000; border-width: 0 2px 2px 0; transform: rotate(45deg);         dash.xml       <dashboard script="checkbox.js" stylesheet="checkbox.css"> <label>Teste </label> <row> <panel> <table id="myTable"> <title>My Table</title> <search> <query>index=_internal | stats count by sourcetype | eval teste=sourcetype</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <drilldown> <condition field="*"></condition> </drilldown> </table> </panel> </row> <row> <panel> <html> <div> <input type="button" id="mybutton" value="My Button"/> </div> </html> </panel> </row> </dashboard>            

I'm attempting to get an AWS EKS cluster instrumented with an AppD agent running against a SaaS instance. I have followed the instructions here: https://docs.appdynamics.com/appd/4.5.x/en/infrastructure-visibility/monitoring-kubernetes-with-the-cluster-agent/install-the-cluster-agent/deploy-the-cluster-agent-on-kubernetes as well as other guides. The containers are running, but I get this error in the cluster agent logs: [ERROR]: 2022-08-17 01:06:57 - agentregistrationmodule.go:131 - Failed to send agent registration request: Status: 404 Not Found, Body: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>Error report</title><style type="text/css"><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - Not Found</h1><hr/><p><b>type</b> Status report</p><p><b>message</b>Not Found</p><p><b>description</b>The requested resource is not available.</p><hr/></body></html> I have available Server Visibility licenses so that isn't the issue. What can I do to get this working? 

My search looks similar to the one below: index=mock_index source=mock_source.log param1 param2 param3 | rex field=_raw "Latency: (?<latency>[0-9]+)" | timechart span=5m avg(latency)   An example event: 2022-08-16 14:04:34,123 INFO [stuff] Latency: 55 [stuff] What have I got wrong in my search that it doesn't draw a graph?

I have the following queries      query 1 : index1 .... | table _time uniqueID query 2 : index2 .... | table _time uniqueID   And I am trying to find events where the uniqueID is found in both AND the the subtraction between the time is greater than N milliseconds    Ideally, the output should be something like :    uniqueID System 1 time System 2 time Difference in Millis 123 Time 1 Time 2 500 1234 Time 11 Time 22 60   Could you please help?

Hi folks, I'd like to know in which config file I can locate the flags from my universal forwarder. I mean the flags like these:  SERVICESTARTTYPE=auto and LAUNCHSPLUNK=1 Doc:  https://docs.splunk.com/Documentation/Forwarder/9.0.0/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller#:~:text=SET_ADMIN_USER%3D0%20/quiet-,Supported%20commandline%20flags,-Command%2Dline%20flags Thanks in advance,

I am Learning Splunk the hard way I think, but here are my questions: if I have been able to have logs forwarded and if I can generate information from my host which right now is just the instance that my Splunk is running on how can the error in the picture exist. Seems to me like if I'm getting any kind of data in I should be getting all the data in especially if its simple like running processes.