Hi Splunkers, I need help on how to sort this multi-value fields based on the latest timestamp and status. Here's my dummy query for this. | makeresults | eval hostname = "server101" | eval id = "123|124" | eval database_timestamp = "Mar 03, 2022 12:59:46 PM|Feb 23, 2022 1:19:24 PM" | eval database_status = "Online|Offline (30 days ago)" | eval server_timestamp = "Feb 22, 2022 1:19:24 PM|Mar 01, 2022 12:59:46 PM" | eval server_status = "Offline (31 days ago)|Online" | fields hostname id database_timestamp database_status server_timestamp server_status | makemv delim="|" database_timestamp | makemv delim="|" database_status | makemv delim="|" server_timestamp | makemv delim="|" server_status | makemv delim="|" id Below is the sample output and expected output. Current Output:                   hostname database_timestamp database_status server_timestamp server_timestamp server101 Mar 03, 2022 12:59:46 PM Feb 23, 2022 1:19:24 PM Online Offline (30 days ago) Feb 22, 2022 1:19:24 PM Mar 01, 2022 12:59:46 PM Offline (31 days ago) Online           Expected Output:                   hostname database_timestamp database_status server_timestamp server_status server101 Mar 03, 2022 12:59:46 PM Feb 23, 2022 1:19:24 PM Online Offline (30 days ago) Mar 01, 2022 12:59:46 PM Feb 22, 2022 1:19:24 PM Online Offline (31 days ago)  

Hi there, so I have a line of log like this: http://some.url/path/?param=x,y,z  So I want to extract a field "extractedParam" with the value "x,y,z". Then I want to extract the three values into a multivalue field "mvExtractedParam". Within Splunk Cloud I will use a field extraction with the following regex which is wrapped up by a field transformation (here I can check "Create multivalued fields"). So I try to do everything within one regex, but here I am struggling. \?param=(?<extractedParam>.*) This extracts "x,y,z". Right now I dont know how to chain the next step...   All the best, Marco

I have a field(eventCode)  which has a code values, and few of them ends with certain alphabets , I want to extract only the eventCode which ends with E, F, V and display it separately under different fields/names(minor, major, medium). I tried with | where eventCode=*E, but this doesnot work.. Is there any other way to extract other than rex/regex. If not, can you please provide some input.  Exmaple : eventCode=xyxbxsndsndg-5-3000-E eventCode=aksjdjfdfvbrhgnvfmbfbc-54-3601-E eventCode=plgkdfdcmasjenfmdklv-61-2501-F eventCode= pojdksdjhmmmaskxjs-91-4501-V Result : Minor                                                              Major                                                                         xyxbxsndsndg-5-3000-E                                       plgkdfdcmasjenfmdklv-61-2501-F             aksjdjfdfvbrhgnvfmbfbc-54-3601-E

I have 2 Splunk SPLs ===================== index=computer_admin source=admin_priv sourcetype=prive:db account_name=admin earliest=-1d | fields comp_name,comp_role,account_name,local_gp,gp_name | table comp_name,comp_role,account_name,local_gp,gp_name ===================== The comp_name fields has values such as ,  AAAAA, BBBBB,  CCCCC, AFSGSH, GFDFDF, IUYTE, HGFDJ, ZZZZZ, YYYYYY, IIIIII, EEEEEE Basically I am looking for all the comp_names that the admin is on and copying the list to use in another SPL  to get the comp owners. Second SPL : =================== index=computer_admin  source=emp_card_details  sourcetype="something:db" C_NAME IN (AAAAA, BBBBB,  CCCCC, AFSGSH, GFDFDF, IUYTE, HGFDJ, ZZZZZ, YYYYYY, IIIIII, EEEEEE) | eval arl=lower(C_NAME) | stats values(asset_owner) by arl =================== Can we use subsearch or any thing similar to get it done in on SPL ? Any assistance ?

I am trying to index a small CSV file with only 1 column (both with monitoring and manually ) is it impossible  ?   was able to index only after I added additional column  for monitoring I have defined the below   inputs.conf    [monitor:///opt/mailboxes_not_created_empid/*.csv] disabled = 0 sourcetype = csv_current_time index = mailboxes_not_created_empid crcSalt = <SOURCE> initCrcLength = 512   the csv (comma separated ) file is    Employee_Number 141941 180536 189377  

Hi at all, this is a different question than usual: I received an eMail from Splunk Accreditations Team <admin@mindtickle.com> with the following subject: "Accreditation assessment module has moved!". I didn't required any Accreditation assessment and I don't know this eMail address. Does anyone know this email? Ciao and thanks. Giuseppe

Hi Splunk team, I have a question when I search in Splunk console. I got an issue as below:  Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK. And I used an enterprise license. Does anyone have an idea about this case? appreciate it.