Hello Splunkers! I have an issue in grouping multivalued field after extracting fields from nested xml. The sample is as follows,   <WorkstationMetrics xmlns=“xxxxxxxx”> <WorkstationMetricData TypeCode="None" WorkstationID="0"> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="First">15704</SequenceNumberValue> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="Last">15710</SequenceNumberValue> </WorkstationMetricData> <WorkstationMetricData TypeCode="Manual" WorkstationID="03"> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="First">9395</SequenceNumberValue> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="Last">9463</SequenceNumberValue> </WorkstationMetricData> <WorkstationMetricData TypeCode="Manual" WorkstationID="05"> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="First">62</SequenceNumberValue> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="Last">297</SequenceNumberValue> </WorkstationMetricData> </WorkstationMetrics>   I tried with following search query to  extract field. But the fields extracted are multivalued with varying cardinality and hence some of my mvzip commands are not working as expected. Please find below my search query for your reference.   index=... sourcetype=... | spath output=workstationNumber path=WorkstationMetrics.WorkstationMetricData{@WorkstationID} | spath output=sequenceType path=WorkstationMetrics.WorkstationMetricData.SequenceNumberValue{@TypeCode} | spath output=sequenceNumber path=WorkstationMetrics.WorkstationMetricData.SequenceNumberValue | eval consolidate=mvzip(sequenceType,sequenceNumber) | mvexpand consolidate | eval temp=split(consolidate,","), type=mvindex(temp,0), seqno=mvindex(temp,1) | table workstationNumber type seqno   I expect to present this data in following format, could some one  Sl.no WorkstationID TypeCode SequenceNumberValue 1 0 First 15704 2 0 Last 15710 Any help in mapping 2 multivalued fields with varying cardinality would resolve this issue. Or do we need think out of box?

Hi, I need to capture first two line following the word 'ERROR' from the log file. Example 1: 2022-05-20 11:36:22,393 ERROR [com.https.custom.integration.Integration](WFA:346899 - 5678976 triExecute:671116263 IE=671116263) com.https.platform.smartobject.dataaccess.SmartObjectNotFoundException: No Smart Object with id '-1' exists com.https.platform.smartobject.dataaccess.SmartObjectNotFoundException: No Smart Object with id '-1' exists at com.https.platform.smartobject.dataaccess.SmartObjectDaoImpl.read(SmartObjectDaoImpl.java:131) Example 2: 2022-05-20 11:36:36,804 ERROR [com.https.ws.https](Thread-789) com.https.ws.errors.AccessException: User does not have access to create records in this GUI. [User:- , GUI: triIntegrationInstance] com.https.ws.errors.AccessException: User does not have access to create records in this GUI. [User: ahmuy, wasim- kb4567, GUI: triIntegrationInstance] at com.https.ws.utils.Validator.validateCreateAccess(Validator.java:588) at com.https.ws.WSProcessThread.processRecord(WSProcessThread.java:258) at com.https.ws.WSProcessThread.run(WSProcessThread.java:147) Please help me with regex.

Hi! We are using a dashboard that displays all the indexes and information about those indexes. I would like to have an additional column. The current search uses this:     | inputlookup name_of_the_lookup | search index=* (index=***) | sort by index | table index, field_A, field_B, field_C, field_D, field_E, field_F, field_G, field_H, field_I, field_J, field_K     What I want to have is an additional column named 'Access',  that says whether it's true or false if the user currently watching that Dashboard has access to that Index. Is there a search that would do this?

Hi, I have the following case which I can't get around. My search returns something like this: In order to help security analysts with some useful information, from a lookup we are adding MITRE technique ID  and some useful information about how to detect this particular technique. What I wanted to do is to move the multivalue fields from mitre_technique_id column as the separate columns named exactly like the MITRE ID, and in that column I wanted to include the information about the detection tips for that technique. I was trying something with foreach, transpose, mvexpand but with no good results. Does anyone knows how to achieve it? The end result would look like this: Thanks in advance!

I am using imported CSV data to search throughout Splunk and the CSV file defines the column TIME and only includes the year and month in the format YYYY-MM. I am attempting to convert that field into a UTC UNIX timestamp using the strptime() function but have not had any success.  This is an image of the extracted fields with a basic search: These were the searches I used when attempting to use the strptime() function. All of the examples did not work.     index="financial_data" source="consumer_confidence_index.csv" LOCATION=USA | eval TIME=strptime(TIME, "%Y-%m") index="financial_data" source="consumer_confidence_index.csv" LOCATION=USA | eval TIME=TIME."-00:00:00:00", TIME=strptime(TIME, "%Y-%m-%d:%H:%M:%S") index="financial_data" source="consumer_confidence_index.csv" LOCATION=USA | eval my_time=strptime('TIME', "%Y-%m") index="financial_data" source="consumer_confidence_index.csv" LOCATION=USA | eval my_time=strptime(YEAR.MONTH, "%Y-%m")     Additionally, I also tried using the convert command and that didn't work either. Both of the examples below did not work.     index="financial_data" source="consumer_confidence_index.csv" LOCATION=USA | convert timeformat="%Y-%m" mktime(TIME) AS NEW_TIME index="financial_data" source="consumer_confidence_index.csv" LOCATION=USA | eval TIME=TIME."-00:00:00:00" | convert timeformat="%Y-%m-%d:%H:%M:%S" mktime(TIME) AS NEW_TIME       Any advice is appreciated, thank you.

Hi Team, After upgrading the SSL certificate we are not able to connect to Deployment server from UF. we are getting the below error logs.   DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected INFO DC:PhonehomeThread - Attempted handshake 1050 times. Will try to re-subscribe to handshake reply  INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected  WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group primary_indexers has been blocked for 12600 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.  INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected

Hi All, I have a SPL query that runs on an index , sourcetype which has milions of jobnames. I want to my SPL to read through a list of jobnames from a different query and use it as subsearch  OR I have created a lookup.csv for this 16,000 list of jonames and want to run my search on it.   How to do that ?   Main SPL that runs on millions of jobnames : earliest=-7d index=log-13120-nonprod-c laas_appId=qbmp.prediction* "jobPredictionAnalysis" prediction lastEndDelta | table jobname, prediction_status, predicted_end_time Below is an input lookup  freq_used_jobs_bmp_3months.csv which is a simple two columnar file  jobName, freq_count     I tried to join main query with this inputfile. I want to operate and write SPL queries on this list of jobNames only.     earliest=-7d index=log-13120-nonprod-c laas_appId=qbmp.prediction* "jobPredictionAnalysis" prediction lastEndDelta | table jobname, prediction_status, predicted_end_time | lookup freq_used_jobs_bmp_3months.csv jobName output freq_count |table jobname, freq_count The above query fails with error  na_prod_secure-ist-indexer-1_iapp724.randolph.ms.com-23000] Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'freq_used_jobs_bmp_3months.csv, jobName, output, freq_count'. See search.log for more details I removed any null rows in the file.  Still I get the same error. Other option is to somehow combine, join main query with a sub search instead of a lookup file. main query  earliest=-7d index=log-13120-nonprod-c laas_appId=qbmp.prediction* "jobPredictionAnalysis" prediction lastEndDelta | table jobname, prediction_status, predicted_end_time sub search that will list a smaller number of jobNames that are used in last 3 months : earliest=-90d index="log-13120-prod-c" sourcetype="autosys_service_secondary:app" OR "autosys_service_primary:app" "request:JobSearch" installation="P*" NOT"*%*" | stats count as freq_count by jobName   Now how to join the above two?