Hi -  I have some data that looks like this, which ingests into splunk with no issues at all       11/24/2021 08:47:21.321,"category":"transaction","tc"="93","amount_approved":"9.99","amount_requested":"493.95" etc etc etc 11/24/2021 08:45:14.121,"category":"transaction","tc"="93","amount_approved":"5.99","amount_requested":"5.99" etc etc etc 11/24/2021 08:45:14.121,"category":"transaction","tc"="01","amount_approved":"6.99","amount_requested":"6.99" etc etc etc       I want to do a a search to filter out the transactions to only see where the amounts differ       index=ABC sourcetype=XZX category=transaction tc=93 amount_approved!=amount_requested        That simple search doesn't work.     splunk is not filtering on the amount_approved!=amount_requested comparison.     In the example above I would get both "tc=93" transactions from the sample data , instead of just getting the first one. If I remove the amount_approved!=amount_requested  from the search and add it to a where clause like this     index=ABC sourcetype=XZX category=transaction tc=93 |where amount_approved!=amount_requested     it works fine as I only get 1 event back. What is wrong with my initial search line? I would like to not read in all of the transactions before I filter, hence the need to put the comparison on the search line. 

After upgrading our environment from 8.1.3 to 8.2.3, some searches return "StatsFileWriterLz4 file open failed". Our environment is one Search Head, one Indexer, one Cluster Master connected in an indexer cluster, with one Heavy forwarder and a few Universal Forwarders. All servers are running on Windows 2019.  A specific error message looks like this: "StatsFileWriterLz4 file open failed file=E:\Splunk\var\run\splunk\srtemp\374915603_1292_at_1637749050.1\statstmp_merged_5.sb.lz4" after running this tstats search: | tstats max(_time) as time max(_indextime) as indextime where index IN ("operations_script_log","telemetry*") sourcetype=* earliest=-30d@d latest=@d by sourcetype host source date_year date_month date_mday date_hour date_minute This search completed and returned the desired results prior to the upgrade, but won't complete after. It runs for about nine seconds before the "StatsFileWriterLz4 file open failed" error message appears and stops the search. Has anybody encountered this problem before and know a solution?

Hello,   Can you tell me please why the below does not work? | rest splunk_server=local servicesNS/-/-/data/ui/views/ | where update > relative_time(now(),"-10d@d")   I want to search the dashboards that were updated in the last 10 days but it does not seem to return anything. Is it because I need to fix the timestamp format?   Thanks!

Hello guys i'm new on splunk and I would like to know if it was possible to view the logs of a date on each page. Would it be possible to have 4 pages? Considering that it is not possible for me to choose the number of logs to show per page because I do not know how many logs per date I could have, it is a coincidence that there are 2 per date. Thanks to all.  

Hi, I can't understand why this query works in search while if I insert it in the dashboard it doesn't work. I assign the option chosen in the filter to the month variable, then I verify the choice and, based on what has been chosen, I have the sum of the X_MESE_PREVIOUS columns or the chosen month returned. The options are "Solar Year", "Fiscal Year" and the months. Where am I wrong? Why it does not work ? Tks Antonio --------------------------------------------------------- | loadjob savedsearch="antonio:enterprise:20211025_PASSAGGIO_AGGREGATO_DATE" |where (sourcetype="fs_ampliamenti_ip" AND OFFERTA="DIRETTA" AND STATO="OK") OR (sourcetype= "fs_diretta" AND TIPOLOGIA="SUBNETIP" AND OFFERTA="DIRETTA" AND STATO="OK") |eval MESEATTUALE=strftime(relative_time(now(), "-0d@d"), "%m") |eval MESEATTUALE= 11 |eval mese="Anno Fiscale" (manual setting of the chosen filter) |eval ANNOFISCALE=if(MESEATTUALE -3 <= 0,MESEATTUALE-3+12,MESEATTUALE-3) |rename PROGRESSIVO_MESE as "0_MESE_PRECEDENTE" |eval SOLARE = mvappend($0_MESE_PRECEDENTE$,$1_MESE_PRECEDENTE$,$2_MESE_PRECEDENTE$,$3_MESE_PRECEDENTE$,$4_MESE_PRECEDENTE$,$5_MESE_PRECEDENTE$,$6_MESE_PRECEDENTE$,$7_MESE_PRECEDENTE$, $8_MESE_PRECEDENTE$,$9_MESE_PRECEDENTE$,$10_MESE_PRECEDENTE$,$11_MESE_PRECEDENTE$,$12_MESE_PRECEDENTE$) | eval FISCALE=0 | foreach *_MESE_PRECEDENTE [|eval FISCALE = if (<<MATCHSTR>> < ANNOFISCALE, FISCALE + '<<FIELD>>', FISCALE)] | eval CHI=case( mese="0_MESE_PRECEDENTE", $0_MESE_PRECEDENTE$ , mese="1_MESE_PRECEDENTE", $1_MESE_PRECEDENTE$ , mese="2_MESE_PRECEDENTE",$2_MESE_PRECEDENTE$ , mese="3_MESE_PRECEDENTE",$3_MESE_PRECEDENTE$ , mese="4_MESE_PRECEDENTE",$4_MESE_PRECEDENTE$ , mese="5_MESE_PRECEDENTE",$5_MESE_PRECEDENTE$ , mese="6_MESE_PRECEDENTE",$6_MESE_PRECEDENTE$ , mese="7_MESE_PRECEDENTE",$7_MESE_PRECEDENTE$ , mese="8_MESE_PRECEDENTE",$8_MESE_PRECEDENTE$ , mese="9_MESE_PRECEDENTE",$9_MESE_PRECEDENTE$ , mese="10_MESE_PRECEDENTE",$10_MESE_PRECEDENTE$ , mese="11_MESE_PRECEDENTE",$11_MESE_PRECEDENTE$ , mese="12_MESE_PRECEDENTE",$12_MESE_PRECEDENTE$ , mese="Anno Solare",$SOLARE$ , mese="Anno Fiscale",$FISCALE$ , 1=1, "INV") |eval RIS = case( mese = "Anno Fiscale", FISCALE, mese = "Anno Solare", SOLARE, 1=1, CHI) | stats sum(RIS) as RISULTATO |table RISULTATO ------------------------------------------------ <query>| loadjob savedsearch="antonio:enterprise:20211025_PASSAGGIO_AGGREGATO_DATE" |where (sourcetype="fs_ampliamenti_ip" AND OFFERTA="DIRETTA" AND STATO="OK") OR (sourcetype= "fs_diretta" AND TIPOLOGIA="SUBNETIP" AND OFFERTA="DIRETTA" AND STATO="OK") |eval MESEATTUALE=strftime(relative_time(now(), "-0d@d"), "%m") |eval mese="$previousmonth$" (this is the token, chosen filter) |eval ANNOFISCALE=if(MESEATTUALE -3 &lt;= 0,MESEATTUALE-3+12,MESEATTUALE-3) |rename PROGRESSIVO_MESE as "0_MESE_PRECEDENTE" |eval SOLARE = mvappend($$0_MESE_PRECEDENTE$$,$$1_MESE_PRECEDENTE$$,$$2_MESE_PRECEDENTE$$,$$3_MESE_PRECEDENTE$$,$$4_MESE_PRECEDENTE$$,$$5_MESE_PRECEDENTE$$,$$6_MESE_PRECEDENTE$$,$$7_MESE_PRECEDENTE$$, $$8_MESE_PRECEDENTE$$,$$9_MESE_PRECEDENTE$$,$$10_MESE_PRECEDENTE$$,$$11_MESE_PRECEDENTE$$,$$12_MESE_PRECEDENTE$$) | eval FISCALE=0 | foreach *_MESE_PRECEDENTE [|eval FISCALE = if (&lt;&lt;MATCHSTR&gt;&gt; &lt; ANNOFISCALE, FISCALE + '&lt;&lt;FIELD&gt;&gt;', FISCALE)] | eval CHI=case( mese="0_MESE_PRECEDENTE", $$0_MESE_PRECEDENTE$$ , mese="1_MESE_PRECEDENTE", $$1_MESE_PRECEDENTE$$ , mese="2_MESE_PRECEDENTE",$$2_MESE_PRECEDENTE$$ , mese="3_MESE_PRECEDENTE",$$3_MESE_PRECEDENTE$$ , mese="4_MESE_PRECEDENTE",$$4_MESE_PRECEDENTE$$ , mese="5_MESE_PRECEDENTE",$$5_MESE_PRECEDENTE$$ , mese="6_MESE_PRECEDENTE",$$6_MESE_PRECEDENTE$$ , mese="7_MESE_PRECEDENTE",$$7_MESE_PRECEDENTE$$ , mese="8_MESE_PRECEDENTE",$$8_MESE_PRECEDENTE$$ , mese="9_MESE_PRECEDENTE",$$9_MESE_PRECEDENTE$$ , mese="10_MESE_PRECEDENTE",$$10_MESE_PRECEDENTE$$ , mese="11_MESE_PRECEDENTE",$$11_MESE_PRECEDENTE$$ , mese="12_MESE_PRECEDENTE",$$12_MESE_PRECEDENTE$$ , mese="Anno Solare",$$SOLARE$$ , mese="Anno Fiscale",$$FISCALE$$ , 1=1, "INV") |eval RIS = case( mese = "Anno Fiscale", FISCALE, mese = "Anno Solare", SOLARE, 1=1, CHI) | stats sum(RIS) as RISULTATO |table RISULTATO</query>

How to sum the values of a multivalue token in Simple XML? Let's say you have a mv token named test1 with values of: 1,2,3 How to achieve something like: <eval token="test2">sum($test1$)</eval> Thanks!

Hi All,  I have a log with 3 event inside of it, ( you can see it on the screenshot, I paste the sample logs here : https://regex101.com/r/EvmMeR/1 1st Event -  Short event  2nd Event - Short event and multi-line 3rd Event - VERY LONG and multi-line, need to be dropped as per the client. I manage to DROP the 3rd event by finding the LOGS that are greater than 2000 characters. The problem is , I dropped the event but Splunk still raise the issue: 11-24-2021 08:02:57.049 +0000 WARN LineBreakingProcessor [6453 parsing] - Truncating line because limit of 2000 bytes has been exceeded with a line length >= 55179 - data_source="SAMPLETOSHARE.txt", data_host="5bfd55dbdcdd", data_sourcetype="sample"   Is there a way to stop splunk from flagging issue for those logs that  was dropped ? 

Dear Professor, I have two alert search like this 1. Search 1: index="abc" sourcetype="abc" service.name=financing request.method="POST" request.uri="*/applications" response.status="200" |timechart span=2m count as applicaton_today |eval mytime=strftime(_time,"%Y-%m-%dT%H:%M") |eval yesterday_time=strftime(_time,"%H:%M") |fields _time,yesterday_time,applicaton_today And here is output 2. Search 2: index="xyz" sourcetype="xyz" "Application * sent to xyz success" |timechart span=2m count as omni_today |eval mytime=strftime(_time,"%Y-%m-%dT%H:%M") |eval yesterday_time=strftime(_time,"%H:%M") |fields _time,yesterday_time,omni_today And here is output  3. I try to combine two search like this then calculate spike. index="abc" sourcetype="abc" service.name=financing request.method="POST" request.uri="*/applications" response.status="200" |timechart span=2m count as app_today |eval mytime=strftime(_time,"%Y-%m-%dT%H:%M") |eval yesterday_time=strftime(_time,"%H:%M") | append [search index="xyz" sourcetype="xyz" "Application * sent to xyz" | timechart span=2m count as omni_today] |fields _time,yesterday_time,app_today,omni_today |eval spike=if(omni_today < app_today AND _time <= now() - 3*60 AND _time >= relative_time(now(),"@d") + 7.5*3600, 1, 0) Here is output  But it shows two time span (like image).  How can I combine two search with only time span like this.   Thank you for your help.