Hi All, I am trying to create a table out of the log below: log: ServerA ServerB ServerC ADFILES41-6.2-4 not_available ADFILES41-6.2-4.2 ADM41-5.10.1-4 ADM41-5.10.1-4 ADM41-5.10.1-4 ADM41HF-5.10.1HF004-4 ADM41HF-5.10.1HF004-4 ADM41HF-5.10.1HF004-4 ADM42-5.11-4 ADM42-5.11-4 ADM42-5.11-4 ADM42HF-5.11HF03-4 ADM42HF-5.11HF03-4 not_available TRA42-5.11-4 TRA42-5.11-4 not_available not_available ADFILES42-6.2-4 not_available not_available not_available TRA42-5.13-4 Here you can see that the 1st line gives the server names. 2nd, 3rd,4th and so on lines are applications available in the server. For eg. From 2nd line you can see that the application ADFILES41-6.2-4 is available in A&C but not in B. Similarly from 9th line you can see that the application TRA42-5.13-4 is available in C but not in A&B. So the requirement is to create a table in the below way to show if any servers is missing any application. Server ServerA ServerB ServerC Application ADFILES41-6.2-4 not_available ADFILES41-6.2-4 Application ADM41-5.10.1-4 ADM41-5.10.1-4 ADM41-5.10.1-4 Application ADM41HF-5.10.1HF004-4 ADM41HF-5.10.1HF004-4 ADM41HF-5.10.1HF004-4 Application ADM42-5.11-4 ADM42-5.11-4 ADM42-5.11-4 Application ADM42HF-5.11HF03-4 ADM42HF-5.11HF03-4 not_available Application TRA42-5.11-4 TRA42-5.11-4 not_available Application not_available ADFILES42-6.2-4 not_available Application not_available not_available TRA42-5.13-4   Please help me to create a query to get the table in the desired manner. Any help on the problem would be highly appreciated. Thank you All..!!

  (Search head cluster/indexer cluster environment) I have written a custom search, using the template provided by Splunk for streaming commands. In an attempt to force the search to run on the search heads and not on the indexers, I added the @Configuration(local=True) bit to the code.       from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators @Configuration(local=True) class StreamingCSC(StreamingCommand):       I got that change from here: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/pythonclassescustom/ but the search still dies. If i modify my search to put the |sort something | mycustomcommand, the search is forced to run locally and it works fine. What am I doing wrong in trying to keep this search off the indexers and only on the search head cluster?

Hi, I'm using splunk web to check some searches/alerts: 1. | rest /servicesNS/-/-/saved/searches/ splunk_server=local | table title <-- displays a list of saved searches then I pick one from the list and launch: 2. rest /servicesNS/-/-/saved/searches/alert_without_white_spaces splunk_server=local. <-- and it works But when querying for a differently named alert I get an error: 3. rest /servicesNS/-/-/saved/searches/alert with white spaces splunk_server=local. <-- does not work - error message: Error in 'rest' command: Invalid argument: '-' 3a) rest /servicesNS/-/-/saved/searches/'alert with white spaces' splunk_server=local.   <-- does not work - error message: Error in 'rest' command: Invalid argument: '-' 3b) rest /servicesNS/-/-/saved/searches/"alert with white spaces" splunk_server=local.   <-- does not work - error message: Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/-/-/saved/searches/alert with white spaces?count=0 from server=https://127.0.0.1:8089 - Not Found 3d) rest /servicesNS/-/-/saved/searches/alert\ with\ white\ spaces splunk_server=local.  - error message: Error in 'rest' command: Invalid argument: '-\' 3e) | eval alert1="alert with white spaces"          | rest /servicesNS/-/-/saved/searches/alert1 - error message (splunk didn't use the variable value but the variable name) Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/-/-/saved/searches/alert1?count=0 from server=https://127.0.0.1:8089 - Not Found Is there a way to use variables or to query for a search name containing white spaces without getting an error ?

Hey Community Need guidance with below scenario. A user will provide an IP address as input. I want that last two octets of the input IP should be compared with the last two octets of the Source IP field and the matched results should be returned. For example  input_ip="1.2.3.4" src_ip="4.5.3.4" This should returns the results as the last two octets are matching. I have tried replace first two octets with * using regex and strcat however, it doesn't works for me.

There is something wrong with the data output by using apendcols. The data of Total_Actual is blank from 02-2022. But actually there has data all of months. May I know what's the reason..? index=sourceA PRIORITY="High" OR PRIORITY="Medium" OR PRIORITY="Low" WAS_CRITICAL="yes" | eval _time=strptime(FIRST_SOLVED_DATE,"%Y-%m-%d %H:%M:%S.%N") | timechart span=1mon count as Total | appendcols [search index=sourceA PRIORITY="Critical" | eval _time=strptime(FIRST_SOLVED_DATE,"%Y-%m-%d %H:%M:%S.%N") | timechart span=1mon count as Total_Actual] | eval Rate_%=round((Total_Actual/Total)*100, 2) | table _time, Total, Total_Actual, Rate_% | tail 12 | sort _time OUTPUT _time Total Total_Actual Rate_% 2021-07-01T00:00:00.000+0200 76 64 84.21 2021-08-01T00:00:00.000+0200 74 51 68.92 2021-09-01T00:00:00.000+0200 81 45 55.56 2021-10-01T00:00:00.000+0200 75 71 94.67 2021-11-01T00:00:00.000+0200 118 58 49.15 2021-12-01T00:00:00.000+0200 101 105 103.96 2022-01-01T00:00:00.000+0200 81 86 106.17 2022-02-01T00:00:00.000+0200 95     2022-03-01T00:00:00.000+0200 85     2022-04-01T00:00:00.000+0200 96     2022-05-01T00:00:00.000+0200 106     2022-06-01T00:00:00.000+0200 141    

Hi, I have a mixed version splunk deployment which involves one indexer of 8.2.1 and another of 7.3.1. There are also 3 Heavy Forwarders linked to one another to reach indexers. Here are the versions: Indexer 01 - 8.2.1 Indexer 02 - 7.3.1.1 2HFs - 7.3.1.1 1HF - 8.21. 1UF - 7.3.1 This is how the data from UF is forwarded to indexers. UF -> 7.3.1.1 HF -> 7.3.1.1 HF -> Indexer 02, UF-> 7.3.1.1 HF -> 7.3.1.1 HF -> 8.2.1 HF -> Indexer01 Both indexers can receive _internal logs from all UF and HFs, but only Indexer 02 (7.3.1.1) can receive main and other custom indexes. This is the concern.  I should be able to receive events from 7.3.1 UF in 8.2.1 Indexer according to this . It mentions 7.3.1 and 8.2.1 are compatible but limited support. What does it mean by limited support?  What I have tested so far is that, fully 7.3.1 environment and fully 8.2.1 environment can receive custom logs from UF, but the mixed one hasn't worked yet. Is there anything I must have missed out? Thank you and much appreciated!    

6/29/22 4:58:14.526 PM   2022-06-29 17:58:14.526 [Task1] INFO Task1 - Published Task1 received  id 101   6/29/22 4:59:14.526 PM   2022-06-29 17:58:14.526 [Task1] INFO Task1 - Published Task1 done  id 101 I'm trying  to fetch time for both the events (when it is received and when the task is done)  and calculate the difference between them in form of table  I tried  index=source "Published Task 1" | rex "id" (?<ID>\d+)  | table  ID start_time End_time difference _time