Code is easier to explain: I wanted a bunch of new categories and i found eval especially useful - here is an obfuscated example | index=my_index CONNECTED source="/var/log/vmware/my_log.log" | eval vdi_pool=case( match(name,"1A-VDI\d{3}"), "pool1", match(name,"1B-VDI\d{3}"), "pool2", match(name,"2A-VDI\d{3}"), "pool3", match(name,"2B-VDI\d{3}"), "pool4", match(name,"3A-VDI\d{3}"), "pool5", match(name,"3B-VDI\d{3}"), "pool6", 1=1, "unclassified" ) | timechart span=1h count by vdi_pool  This made the subsequent querys super easy.   Irritatingly within the dashboard, if I add a new value I need to update all of the queries - this vexes me greatly  I have noticed the entire definition can be downloaded as a json doc - so Im tempted to start templating this in python - this does not seem sane - ideally I'd like to create blocks of repeatable logic I can assemble together to show different scenarios. Anyone done anything similar to achieve this kind of capability - but more "splunkonic"? 

Hi, I know this is a hot topic and there is answers everywhere, but i couldn't figure out by my self what to do.   Suddenly the join stops work and my search is not performing as spect anymore, nobody from infa gave me a reasonable explanation for that, so i have to figure out a different way .   Original Search   index=aws-prd-01 application.name=domestic-batch context=BATCH action=SEND_EMAIL (status=STARTED OR status="NOT RUN") | rename status as initialStatus | fields jobId initialStatus | join type=left jobId [search index=aws-prd-01 application.name=domestic-batch context=BATCH action=SEND_EMAIL (status=COMPLETED OR status=FAILED) | rename status as finalStatus | fields jobId finalStatus] | table jobId initialStatus finalStatus | sort -timestamp     Original result jobId initialStatus finalStatus 01 STARTED COMPLETED 02 STARTED FAILED   First search with no changes   index=aws-prd-01 application.name=domestic-batch context=BATCH action=SEND_EMAIL (status=STARTED OR status="NOT RUN") | table jobId, status     Result jobId status 01 STARTED 02 STARTED   Second search with no changes   index=aws-prd-01 application.name=domestic-batch context=BATCH action=SEND_EMAIL (status=COMPLETED OR status=FAILED) | table jobId, status     Result jobId status 01 COMPLETED 02 FAILED   thanks a lot

I need to get the list of the IPs that have generated the most outgoing traffic. When the query is generated I find that there are multiple records for the same IP. Is there any way to get a total of GB for each IP? Thank you  

I don't have a ton of experience with Splunk yet but I've been asked to find API endpoints (which appear to be in our raw data) and see how often their being used.    Example Events: | 2022-07-08 05:59:06 21.30.2.80 POST /api/transact/credit/sale 5051 - 571.232.505.62 okhttp/3.18.9 | 2022-07-08 05:02:01 22.35.3.79 POST /api/transact/device 6062 - 641.141.323.82 okhttp/2.15.3   What I want to end up with is the api and a count: /api/transact/credit/sale        3,475 /api/transact/device                    275   Is this possible? Thank you!!

I have read a lot of different threads and docs but still having trouble pulling what I need out of the below JSON. Essentially want a condensed list of the vulnerabilities data but this JSON nests the vulnerabilities based on the "Package". I would like a table that lists all the applicable vulns and for each image. Table I am trying to get Image Name (CVE) NVD_Score Description etc... Image_name CVE-2022-0530 4.3 A flaw was found....     Image of JSON example I can include raw data if that would help.  

Good day friends... I expose the following issue: A little over a month ago we upgraded the splunk version from 7.0 to 8.1.7.2, I do not know if because of the upgrade splunk no longer let me create users marking the following error: "In handler 'users': Could not get info for role that does not exist: windows-admin". I also removed the apps that splunk had and that are compatible, among them "Splunk App for Windows Infrastructure". I don't know if this or the above generated this problem. Can you help me if anyone has had this happen and how did you solve it? thanks