Ran into an issue whereas an index is not viewable by a particular user. So I tried to see what permission the user has, and find that even though the user (steveng) can log in via the AD credentials, the user is not actually listed in the users page. Also, did a search with various search strings like |rest /services/authentication/users | search realname=* roles!=app* roles!=index* | dedup title type realname email tz roles | table title type realname email tz roles | rename title as Username realname as "Full name" tz AS "Time zone" email AS "Email address" type AS "Authentication system"   No result still on the ghost account for steveng. Any thoughts?  

I have an alert configured in Splunk which should send the email when the alert is triggered. The alert is being added to the list of triggered alerts, but the email is not being sent. In logs I see the following errors:   08-09-2022 13:30:14.510 +0200 ERROR ScriptRunner [26046 AlertNotifierWorker-0] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/mycommunity/bin/se ndemail.py "results_link=https://mysplunk.example.com/app/mycommunity/@go?sid=sc heduler__d051859__mycommunity__RMD540c2da3bac08625c_at_1660044600_69194" "ssnam e=MYBLOG PROD Broken Requests" "graceful=True" "trigger_time=1660044614" result s_file="/opt/splunk/var/run/splunk/dispatch/scheduler__d051859__mycommunity__RM D540c2da3bac08625c_at_1660044600_69194/results.csv.gz" "is_stream_malert=False"' : File "/opt/splunk/etc/apps/mycommunity/bin/sendemail.py", line 111 08-09-2022 13:30:14.510 +0200 ERROR ScriptRunner [26046 AlertNotifierWorker-0] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/mycommunity/bin/se ndemail.py "results_link=https://mysplunk.example.com/app/mycommunity/@go?sid=sc heduler__d051859__mycommunity__RMD540c2da3bac08625c_at_1660044600_69194" "ssnam e=MYBLOG PROD Broken Requests" "graceful=True" "trigger_time=1660044614" result s_file="/opt/splunk/var/run/splunk/dispatch/scheduler__d051859__mycommunity__RM D540c2da3bac08625c_at_1660044600_69194/results.csv.gz" "is_stream_malert=False"' : except Exception, e: 08-09-2022 13:30:14.510 +0200 ERROR ScriptRunner [26046 AlertNotifierWorker-0] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/mycommunity/bin/sendemail.py "results_link=https://mysplunk.example.com/app/mycommunity/@go?sid=scheduler__d051859__mycommunity__RMD540c2da3bac08625c_at_1660044600_69194" "ssname=MYBLOG PROD Broken Requests" "graceful=True" "trigger_time=1660044614" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__d051859__mycommunity__RMD540c2da3bac08625c_at_1660044600_69194/results.csv.gz" "is_stream_malert=False"': ^ 08-09-2022 13:30:14.510 +0200 ERROR ScriptRunner [26046 AlertNotifierWorker-0] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/mycommunity/bin/sendemail.py "results_link=https://mysplunk.example.com/app/mycommunity/@go?sid=scheduler__d051859__mycommunity__RMD540c2da3bac08625c_at_1660044600_69194" "ssname=MYBLOG PROD Broken Requests" "graceful=True" "trigger_time=1660044614" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__d051859__mycommunity__RMD540c2da3bac08625c_at_1660044600_69194/results.csv.gz" "is_stream_malert=False"': SyntaxError: invalid syntax 08-09-2022 13:30:14.512 +0200 ERROR script [26046 AlertNotifierWorker-0] - sid:scheduler__d051859__mycommunity__RMD540c2da3bac08625c_at_1660044600_69194 External search command 'sendemail' returned error code 1. .   The error message is very ambiguous, so I don't know what causes this error. It seems like a bug to me. Any ideas?   Environment: Splunk 8.2.7 OS: SLES 15 SP3

Hi, I have a table of data which I need to display the count of "Migration Stratus" in a bar chart. Here is the raw data: Location Number of Devices Migration Status When Planned Bangalore, India 10 Not Started Not Known Cork, IRE 4 Not Started Not Known Eldorado Du Sol, Brazil 3 Not Started Not Known Hopkinton, USA 4 Not Started Not Known Otemachi, Japan 3 Not Started Not Known Cyberjaya, Malaysia 4 Not Started Not Known Limerick, IRE 4 Not Started Not Known Austin, USA 6 Not Started Not Known Penang, Malaysia 5 Not Started Not Known Durham, USA 6 Not Started Not Known Singapore, Singapore 4 Not Started Not Known Santa Clara, USA 2 Not Started Not Known Sydney, Australia 2 In Progress FY23 Q2 Xiamen, China 6 Not Started Not Known  Here is my current output, where when I hoover over "In Progress" it shows 1 and over "Not Started", shows 13: At the moment, my query is just counting the number of rows for a particular value in "Migration Status" and this value is what is seen when hoovering over each bar on bar chart: | inputlookup Migration-Status-Symantec3.csv | fillnull value=null | eval dummy = 'Migration Status' | chart count over "Migration Status" by dummy What I need is the SUMMATION of "Number of Devices" for a particular value in "Migration Status". How can this be achieved???? Many thanks as always

index="indnewwrapper" | search rfq_id: | join [ search index="indnewwrapper" | search rfq_id: | eval validateEmailMessagecomplete=if(like(_raw,"%validateEmailMessage()%"), sent_date,"1900-01-01 12:00:00.000") ] | eval validateEmailMessagecomplete1=strftime(strftime(validateEmailMessagecomplete,"%A %B %d %Y %I:%M:%S %p %Z"),"%Y-%m-%d %H:%M:%S") | table pRFQ_Id,validateEmailMessagecomplete,validateEmailMessagecomplete1 I am finding a string in a search and extracting a validateEmailMessagecomplete date. using like function. i am getting desired output but i am not able to change to datetime format validateEmailMessagecomplete1 it shows blank value i searched various post on the forum. but did not found desired solution.          

Hi, I'm trying to make my query show all the different values from one field (Product) that it is showing in the Event. I have data from Event that has Product=ABC, Product=????? and Product=??.  The Products will have random / different values. When I run the query it will only show me the Product=ABC not any of the others with different values but same field.         index=X Name=* currency=* channel=* country=* state=* Product=* | stats list(Name) as Name, list(currency) as currency, list(amount) as amount, list(channel) as device, list(country) as From, list(state) as Status, list(Product) as Products |         I would like to have it show all the Products from the one event.  So in case there are 3 Products  Products ABC ????? ?? --- In case I have another event with four fields with Products it has to show all 4.  Products ABC ????? ?? 4th Product Is this possible ?   Thank you,

The scenario is,  A lookup csv has become unreadable. A lookup definition exists for it. The lookup was deleted and recreated. The existing definition was not changed.   My question is: Can a lookup be recreated and use the existing lookup definition?