Hi All, I have enquired about this problem earlier as well in Splunk community, thus, apologies for duplicate query. However, I am unable to get a solution that helps to get my results 100% correct. Moreover, the previous threads are old, thus, not sure if my comments will get visibility in those threads.  Resources in hand:-  I have a lookup table which has many fields. I am concerned with two fields: index and host. I have a custom index, which has many fields, but I need to use orig_index, orig_host. Requirement: - I need to fetch list of those hosts for each index which are present in lookup table but not in custom index. I tried with following with time range of last 24 hours:- |inputlookup table.csv |fields index, host |search NOT [search index="xxx" |rename orig_* AS *| table index, host | format] But, when I try to cross check the last reported date time of host value against the index, I get results of last hour. I tried with below SPL for cross check:- |tstats max(indextime) AS lastTime where index="dummy" AND host="10.10.10.10" BY host |convert ctime(lastTime) Thus, I need your help to resolve the issue. Thank you.

Based on what I've studied, I should be able to show a new field named item with a search such as the one below: index=existing_index | eval item = "apple" | stats count by source | table source, item, count I would expect output similar to the table below. source item count a/b/123.log apple 5 a/c/915.log apple 6 a/b/574.log apple 1   Instead, this happens: source item count a/b/123.log   5 a/c/915.log   6 a/b/574.log   1   Why did I not get what I expected?

Im trying to make a punchcard to visualize incoming issues per hour in the prvious week. This is the result i get with the following code:        | eval issues="Issue Priority" | stats count(issues) by date_hour date_wday       I really want to get more bins like on the right side so that i can assign values with color. E.g. 0<10 = green, 11<70 = yellow, 71<150=red.  Something i need to include?

Hello, I have two searches with same index but different host names. Is it possible to have the results of both the searches in a dropdown in a dashboard so that the result appears in a table as per the selection of the host name? Both the searches have different field names. Can someone guide me on this please? Thanks in advance. Arshi.

In the "Configure The OpenTelemetry Collector" documentation I see "Attribute Description": service.name string shoppingcart Logical name of the service; equivalent to your AppDynamics tier name..... service.namespace string Shop A namespace for the service.name; equivalent to your AppDynamics application name.... Is this correct? "service.namespace" = "application name" and "service.name" = "tier name". Or should it be "service.namespace" = "tier name" and "service.name" = "application name" and this is just a mistake documenting it?

Hi All,  i am using 2 searches combined via an append to get me data in the following format. Each row is a distinct event in Raw data. _time Status owner rule_ID 2022-08-03 23:00:00 <null> unassigned 001 2022-08-03 23:35:00 Acknowledged John 001 2022-08-03 23:40:00 Resolved John 001   I need to calculate time_difference between each event  i.e. each row above.  How can i get another column called "difference" added that shows the delta between these 3 different events. Desired Output: _time Status owner rule_ID Difference  2022-08-03 23:00:00 <null> unassigned 001 0 2022-08-03 23:35:00 Acknowledged John 001 0:35:00 2022-08-03 23:40:00 Resolved John 001 0:05:00 Note:  Rule_ID is the only common field in all 3 events. I referred to other posts here where folks have recommended transaction command. Unfortunately i don't have any specific field to use in startswith or endswith  , so transaction won't work. Thank you in advance

I have this query in Splunk which gets me the src_ip  along with different fields  for the particular UserId. But i want to exclude the logs having src_ip starting with either 10 or 172 . Could someone please help     index=wineventlog $UserId sourcetype="WinEvt:ADFS" EventCode=120* | rex "IpAddress\W(?<src_ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})" | rex "Activity\sID\W(?<Activity_ID>\s.*)" | table src_ip, Activity_ID, _time, UserAgent | sort _time | reverse

1st Query :     StoreManagementAPI index=b2cforce sourcetype="sfdc:transaction_log__c" HasError__c=false Transaction_Log__c="*" | eval message = "200andNo matching records were found" | where like(_raw,"%".message."%") | append [search StoreManagementAPI index=b2cforce sourcetype="sfdc:transaction_log__c" Transaction_Log__c="*" | eval message = "400andDealer Code provided is invalid" | where like(_raw,"%".message."%")] | append [search StoreManagementAPI index=b2cforce sourcetype="sfdc:transaction_log__c" Transaction_Log__c="*" | eval message = "400andDealer Type provided is invalid" | where like(_raw,"%".message."%")] | append [search StoreManagementAPI index=b2cforce sourcetype="sfdc:transaction_log__c" Transaction_Log__c="*" | eval message = "400andNo Dealer Code was provided" | where like(_raw,"%".message."%")] | append [search StoreManagementAPI index=b2cforce sourcetype="sfdc:transaction_log__c" Transaction_Log__c="*" | eval message = "400andNo Dealer Type was provided" | where like(_raw,"%".message."%")] | append [search StoreManagementAPI index=b2cforce sourcetype="sfdc:transaction_log__c" Transaction_Log__c="*" | eval message = "400andInvalid input data" | where like(_raw,"%".message."%")] | append [search StoreManagementAPI index=b2cforce sourcetype="sfdc:transaction_log__c" Transaction_Log__c="*" | eval message = "500andCannot deserialize request body" | where like(_raw,"%".message."%")] | append [search StoreManagementAPI index=b2cforce sourcetype="sfdc:exception_log__c" ErrorCode__c=500 Interface_Name__c=StoreManagementAPI | eval message = "Unexpected character" | where like(_raw,"%".message."%")] | append [search StoreManagementAPI index=b2cforce sourcetype="sfdc:exception_log__c" ErrorCode__c=500 Interface_Name__c=StoreManagementAPI | where Error_Description__c != "Unexpected character (&#39;}&#39; (code 125)): was expecting double-quote to start field name at [line:4, column:6]" | table _time,Error_Description__c | rename Error_Description__c as message] | timechart span=30m count by message | eval eval threshold = 25     2nd query :     StoreManagementAPI index=b2cforce sourcetype="*" "attributes.type"="*" | stats count(sourcetype) as total_events | where total_events > 480     3rd query :   StoreManagementAPI index=b2cforce sourcetype="sfdc:transaction_log__c" Transaction_Log__c="*" | eval _raw= Transaction_Log__c | rex max_match=0 "timestamp[[:punct:]]+(?<timestamp>[^\\\"]+)" | eval first_timestamp=mvindex(timestamp,0), last_timestamp=mvindex(timestamp, -1) | eval first_ts = strptime(first_timestamp, "%Y-%m-%dT%H:%M:%S.%3N%Z"), last_ts = strptime(last_timestamp, "%Y-%m-%dT%H:%M:%S.%3N%Z") | eval diff = last_ts - first_ts | stats avg(diff) as average