I have a data sources that shows if an order was resolved as fraudulent (data="resolutions")  and in a different data source (data="headers") i have payment_method (Visa, Mastercard, etc)  I want to see a pie chart of only orders that have chargebacks on them by payment method.        data=headers | top payment_method         This works for the pie chart of payment method. I tried:       data=headers OR data=resolutions resolution_name="ACM Chargeback Received - Fraud" | top payment_method         and a few other variations, but I can't seem to get it to work.    Even if I can't do a pie chart and could figure out a table with  Payment Method | Count of Resolution Name (chargeback) that would work

I have a field called rules_tripped It returns the results like this      rules_tripped="5237260000001713515:Item Sku Fraud & Chargeback Percentage 0:0"     Rule ID : Rule Name : Rule Score I want to only search for rules that have a rule score of > 800  Is that possible to split the query and search for only rules with a rule score of > 800?

Hello, Sorry in advance if the question has already been asked, but I couldn't find anything. I'm currently working with Qualys logs on Splunk. The Qualys API to pull data into Splunk is already configured, but there are several informations that the API does not retrieve, for example software installed on scanned computers. So the question is, is it possible to add a custom API into Splunk without interfering with the existing official Qualys API ? And is there limitations for programming languages, or maybe it depends on the server on which my Splunk is running ? Thank you in advance

I can't wrap my head around how to do this search.  It's like I need an array or variable. Example Data: Hostname Storage BackupServer BackupStorage Database1 Storage1 Database2 Storage2 Database3 BackupStorage   How can I say, show me a list of all servers using BackupServer[Storage], I dont know the name of backup storage in advance. All I know is the hostname is like Backupserver.  

Hello I have several lookups and I would like to display the details on a date range but I can't really do it I have tried several combinations but either I display the last one or I display too many elements As a bonus if I could have the total it would be cool     | inputlookup file1.csv | append [| inputlookup file2.csv] | append [| inputlookup file3.csv] | append [| inputlookup file4.csv] | append [| inputlookup file5.csv] | append [| inputlookup file6.csv] | sort - _time | eval date = strftime(_time,"%Y-%m-%d") | search date>2022-07-01 AND date<2022-07-04 | transpose 6 | sort - column | search column=date OR column=count | fields - column | rename "row 1" as "name1", "row 2" as "name2", "row 3" as "name3", "row 4" as "name4", "row 5" as "name5", "row 6" as "name6"      

  Hello community,   I am trying to "reroute" specific logs (based on Regex match) to a different index. This is done on the heavy-forwarder. It is ingested via syslog. Both props and transform are in the correct folder where syslogs events are ingested. I have created a ruleset in props.conf:   [vmware] TRANSFORMS-include = reroute_to_indexA   And here is the config from transform.conf:   [reroute_to_indexA] SOURCE_KEY = _raw REGEX = ^.*2300-.*$ DEST_KEY = _MetaData:Index FORMAT = index-a   Last but not least here is a sample of the logs I am working with:   Jul 5 09:02:11 10.32.37.214 1 2022-07-05T09:02:11.339-04:00 2300-RDSH-1-2 View - 1009 [View@6876 Severity="INFO" Module="Agent" EventType="AGENT_DISCONNECTED" UserSID="omitted" UserDisplayName="omitted" PoolId="2300-rdsh-farm1" MachineId="omitted" MachineName="2300-RDSH-1-2" MachineDnsName="2300-rdsh-1-2" CurrentSessionLength="180" TotalLoginLength="180" SessionType="APPLICATION"] User omitted has disconnected from machine 2300-RDSH-1-2     At this point I would have expected to see the logs being written to index-a. What have I done so far as troubleshooting: Remove SOURCE_KEY Replace SOURCE_KEY = _raw with field:MachineDnsName Replace SOURCE_KEY = _raw with fields:MachineDnsName Substituted the REGEX for .*2300.* and .*2300-.* Nothing have helped so far; any help or pointers would be greatly appreciated.   Thank you,