Hey guys. I have been trying to make a compliance/noncompliance list: I have a big search that will table all the data i need. I tried using eval case to assign compliance/noncompliance to the hosts however it is not working. There could be multiple problems. The search is this:     | rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)" | rex field=_raw "(.Net Version is)\s+(?<DotNetVersion>.+)" | rex field=_raw "(Powershell Version is)\s+(?<PowershellVersion>.+)" | rex field=_raw "(Was able to resolved google.dk)\s+(?<DNS>.+)" | rex field=_raw "(Firewall's)\s+(?<AllFirewalls>.+)" | rex field=_raw "(Commvault)\s+(?<Commvault>.+)" | rex field=_raw "(Snow)\s+(?<Snow>.+)" | rex field=_raw "(Symantec)\s+(?<Symantec>.+)" | rex field=_raw "(Splunk Forwarder)\s+(?<Splunk>.+)" | rex field=_raw "(SNMP Service)\s+(?<SNMP>.+)" | rex field=_raw "(Zabbix Agent Version)\s+(?<Zabbix4>.+)" | rex field=_raw "(Zabbix Agent2)\s+(?<Zabbix2>.+)" | rex field=_raw "(VMware)\s+(?<VMware>.+)" | rex field=_raw "(Backup route)\s+(?<BackupRoute>.+)" | rex field=_raw "(Metric)\s+(?<Metric>.+)" | rex field=_raw "(IPconfig)\s+(?<IPconfig>.+)" | rex field=_raw "(DeviceID VolumeName)\s+(?<Storage>.+)" | rex field=_raw "(Memory)\s+(?<Memory>.+)" | rex field=_raw "(Amount of Cores)\s+(?<CPU>.+)" | rex field=_raw "(is Licensed with)\s+(?<WindowsLicense>.+)" | rex field=_raw "(Running Microsoft)\s+(?<OS>.+)" | rex field=_raw "(OS Uptime is)\s+(?<Uptime>.+)" | join type=outer host[|inputlookup Peer_Dashboard_Comments.csv] | stats latest(AvailableUpdates) as AvailableUpdates, latest(DotNetVersion) as DotNetVersion, latest(PowershellVersion) as PowershellVersion, latest(DNS) as DNS, latest(AllFirewalls) as AllFirewalls, latest(Commvault) as Commvault, latest(Snow) as Snow, latest(Symantec) as Symantec, latest(Splunk) as Splunk, latest(SNMP) as SNMP, latest(Zabbix4) as Zabbix4, latest(Zabbix2) as Zabbix2, latest(VMware) as VMware, latest(BackupRoute) as BackupRoute, latest(Metric) as Metric, latest(IPconfig) as IPconfig, latest(Storage) as Storage, latest(Memory) as Memory, latest(CPU) as CPU, latest(WindowsLicense) as WindowsLicense, latest(OS) as OS, latest(Uptime) as Uptime, latest(Comments) as Comments by host | fillnull value="-" | eval status=case(AvailableUpdates="= 0" AND NOT match(DotNetVersion,"Not!") AND match(PowershellVersion,"5.1") AND DNS="142.250.179.195" AND AllFirewalls="are disabled" AND match(Commvault,"is Installed") AND match(Snow,"is Installed") AND match(Symantec,"is Installed") AND match(Splunk,"is Installed") AND match(SNMP,"is installed") AND match(Zabbix4,"is installed") AND match(Zabbix2,"is installed") AND match(VMware,"is Installed") AND match(BackupRoute,"was found") AND match(Metric,"is - Ethernet") AND match(WindowsLicense,"Windows") AND (match(OS,"2016") OR match(OS,"2019")),"Compliant",1=1,"noncompliant") | stats distinct_count(Compliant) as Compliant       It doesnt fail but reports back with a result of 0 compliant hosts. If i try to list noncompliant hosts it is also 0. I have a AND (match(OS,"2016") OR match(OS,"2019")) in there. Is that a OK way of matching a single field to 2 values? There is also a "AND NOT match(DotNetVersion" in the beginning. Is it okay to use both match and NOT match in the same case? Anything im missing here?

Hello All, I was extracting some volume data for PE testing from prod systems, using following query  I am expecting to get stats from 9AM to 6PM event counts with respect to proxy names. but following code creating stats for entire day please help me to remove these extra data.  Query  index= index_Name environmentName= Env_name clientAppName="App_Name" | eval eventHour=strftime(_time,"%H") | where eventHour<18 AND eventHour>=9 | timechart count span=60m by proxyName result : TIme Proxy1 proxy2  2022-02-16 06:00 0 0 2022-02-16 07:00 0 0 2022-02-16 08:00 0 0 2022-02-16 09:00 27 34

Could you please tell me about the following? If I want to limit memory usage for a search, is it correct to think that I should set the following? ＝＝＝＝＝ [search] enable_memory_tracker=true search_process_memory_usage_threshold=10000 search_process_memory_usage_percentage_threshold=60 ＝＝＝＝＝ ※ If either value of "10000 (MB)" or "60 (%)" is reached, the operation is forcibly terminated. Is it correct to understand that the above setting is for all searches including ad hoc searches? If I want to enable the settings for all app searches, is it safe to add them to limits.conf below? $SPLUNK_HOME/etc/system/local/limits.conf ※Set to $SPLUNK _ HOME/etc/apps/App name/local/limits.conf to search for individual apps. Am I correct in thinking that the above limits.conf settings should be set for both SearchHead and Indexer?

    index="***********" sourcetype="**********" (host="*") | rex field=_raw "(Available Updates)\s+(?<AvailableUpdates>.+)" | table _time _raw host AvailableUpdates | stats latest(AvailableUpdates) as AvailableUpdates by host   Hey guys. So I have a search that gives a table as such: Host __________________ AvailableUpdates Host1_________________ = 21 Host2__________________= 0 Host3__________________= 5 Host4__________________= 0 Host5__________________ null I am looking to make a piechart with 2 different "values" 1 "value" is all the "= 0" in green, and the rest in red. Can't quite figure out how to sort this.  Tyvm