I have some data with a field called "priority", which has a value from P1 -> P5. this search query: ... | stats count as Quantity by priority   produces a table that looks something like this: priority Quantity P2 1 P3 1 P4 6 P5 3   As you can see,  there are no data entries with a priority of "P1". However, I would like to actually include that as a row in the table and show that there is a quantity of "0". Ideally I would want to include all 5 priority levels for any dataset, even when they are empty Can anyone help and let me know how I can do this? Is there a way to specify which values to count?

Hello Splunk Community! My team and I have been stuck trying to get the Splunk add-on for JMX working for us. We've installed the add-on to a heavy forwarder and are trying to connect to the local JMX server URL. After doing so, we get the following in our jmx.log: 2021-12-22 17:03:19,883 - com.splunk.modinput.ModularInput -5318 [Thread-2] INFO [] - Failed connection with service:jmx:rmi://hostname/jndi/rmi://hostname:8578/hostname/8577/jmxrmi, connecting with service:jmx:rmi://hostname/jndi/JMXConnector . 2021-12-22 17:03:19,884 - com.splunk.modinput.ModularInput -5319 [Thread-2] ERROR [] - Exception@checkConnector, e= java.io.IOException: Failed to retrieve RMIServer stub: javax.naming.NoInitialContextException: Need to specify class name in environment or system property, or as an applet parameter, or in an application resource file: java.naming.factory.initial at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:369) ~[?:1.8.0_275] at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270) ~[?:1.8.0_275] at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:229) ~[?:1.8.0_275] at com.splunk.jmx.ServerTask.connect(Unknown Source) ~[jmxmodinput.jar:?] at com.splunk.jmx.ServerTask.checkConnector(Unknown Source) [jmxmodinput.jar:?] at com.splunk.jmx.Scheduler.run(Unknown Source) [jmxmodinput.jar:?] Caused by: javax.naming.NoInitialContextException: Need to specify class name in environment or system property, or as an applet parameter, or in an application resource file: java.naming.factory.initial at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:662) ~[?:1.8.0_275] at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:313) ~[?:1.8.0_275] at javax.naming.InitialContext.getURLOrDefaultInitCtx(InitialContext.java:350) ~[?:1.8.0_275] at javax.naming.InitialContext.lookup(InitialContext.java:417) ~[?:1.8.0_275] at javax.management.remote.rmi.RMIConnector.findRMIServerJNDI(RMIConnector.java:1955) ~[?:1.8.0_275] at javax.management.remote.rmi.RMIConnector.findRMIServer(RMIConnector.java:1922) ~[?:1.8.0_275] at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:287) ~[?:1.8.0_275] ... 5 more Our jmx_servers.conf file is configured as follows: [default] [jms4] account_name = username destinationapp = Splunk_TA_jmx jmx_url = service:jmx:rmi://hostname/jndi/rmi://hostname:8578/hostname/8577/jmxrmi protocol = url account_password = password We confirmed that the URL works, because we were able to reach it with the following code: class Scratch { public static void main(String[] args) throws Exception { final JMXServiceURL jmxUrl = new JMXServiceURL("service:jmx:rmi://hostname/jndi/rmi://hostname:9878/hostname/9877/jmxrmi"); final Map<String, String[]> props = new HashMap<>(); props.put("jmx.remote.credentials", new String[]{"username", "password"}); final JMXConnector jmxConnector = JMXConnectorFactory.connect(jmxUrl, props); final MBeanServerConnection mbsc = jmxConnector.getMBeanServerConnection(); Arrays.asList(mbsc.getDomains()).forEach(System.out::println); } Any assistance is appreciated.

Hi Guys,  Hope you can help me out.  Consider the following data in Splunk:      { attrs: { account: 85859303 version: 1.3848 } line: { application_version: 1.94949303 message: Event with key 84js9393: {"entity": {"customer_id": "K123456", "order_id": "Sjd49493-93nd-9494-jdjd-mskaldjfhfhh", "collection_id": "djdis939-9398-9488-j939-md839md93000", "issuer_id": null}} thread: springfield timestamp: 2021-12-21 19:30:52,123 } }       I would like to extract the order_id and use it in my search:  order_id=Sjd49493-93nd-9494-jdjd-mskaldjfhfhh Hope someone can help or point me in the right direction. Cheers!  Matthew 

In Java, I am trying to call a curl command that has a Splunk search to get contents of a lookup file. I've used https://docs.splunk.com/Documentation/Splunk/8.0.3/RESTTUT/RESTsearches as my starting point.  Too bad they don't show how to use Java like they do for curl and python. >>>>> The curl command works fine outside of Java. curl -u admin:password -k https://1.2.3.4:8089/services/search/jobs/export -d output_mode=csv -d search=" | inputlookup hosts-info" >>>>> Here is the Java program : import java.io.IOException; import java.io.BufferedReader; import java.io.InputStreamReader; import java.util.stream.Collectors; public class tstcurl { public static void main(String[] args) { String command = "curl -u admin:password -k https://1.2.3.4:8089/services/search/jobs/export -d output_mode=csv -d search=\" | inputlookup hosts-info\""; try { System.out.println("Creating curl command: [" + command + "]"); Process process = Runtime.getRuntime().exec(command); String result = new BufferedReader(new InputStreamReader(process.getInputStream())).lines().collect(Collectors.joining("\n")); System.out.println(result); } catch (IOException e) { e.printStackTrace(); } } >>>>> Output of 'java -jar tst-curl.jar': Creating curl command: [curl -u admin:password -k https://1.2.3.4:8089/services/search/jobs/export -d output_mode=csv -d search=" | inputlookup hosts-info"] <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Error in 'SearchParser': Missing a search command before '"'. Error at position '0' of search query '"'.</msg> </messages> </response> >>>>> Help please I've done the following: Looked into /opt/splunk/var/log/splunkd.log for any other messages related to this. I've turned on debug and no other messages related to this issue are in the splunkd.log I've search google for anybody else having this issue I've looked into getting the Splunk SDK but seems like extra effort to just read the lookup file. If anybody has made this work, please put share your solution.

I have two tables EmailX Doc DateChecked Name a@a.com Doc 1 1/1/2021 a a@a.com Doc 2 1/15/2021 a a@a.com Doc 3 1/30/2021 b   EmailY DateLogin a@a.com 12/10/2022 a@a.com 11/10/2022 a@a.com 1/15/2021 a@a.com 1/25/2021   I want to join them on Emailx & EmailY and then in result  for each Email  i need to get most recent DateLogin that is before DateChecked.  I am hoping to no have to use joins as my second table has more than 50k records.  So the results should be like this EmailX Doc DateChecked Name RecentDateLogin a@a.com Doc 1 1/1/2021 a - a@a.com Doc 2 1/15/2021 a 1/15/2021 a@a.com Doc 3 1/30/2021 b 1/25/2021   So if I have to write a sql, it would be something like below. I haven't tested below , but you get the idea. SELECT t1.EmailX, t1.Doc, t1.DateChecked, t1.Name, max(t2.DateLogin) as RecentDateLogin FROM table1 AS t1 LEFT JOIN table 2 AS t2 ON t1.EmailX = t2.EmailY AND t1.DateChecked>t2.DateLogin Group By t1.EmailX, t1.Doc, t1.DateChecked, t1.Name   Thanks.