I want to list all the 'Authentication' related content we have created in the ES App. Is there any SPL query to get this. Need to list all the dashboards, Notable Events etc... of Authentication type. I would really appreciate any help.

Hi, Im trying to create a single value with trendline visualisation, where I want to compare the difference between todays result with yesterday results. The trendline should be the results difference of  yesterday and today.  I have applied several solutions, but the total number does not tally with the today's result. My base query is: index=emailgateway action=* from!="" to!="" | stats count which result shown as (today result) : Base Here are several solutions that I have tried:- Solution 1 Im using the trendline wma2  index=emailgateway action=* from!="" to!="" | timechart span=1d count as Total | trendline wma2("x") as Trend | sort - _time the result shown as below: Solution 1 - the result shows the trendline, but the total number (90,702) did not tally with today's result (227,019).    Solution 2 Im using the delta command :-  index=emailgateway action=* from!="" to!="" | timechart span=1d count as Total | delta Total p=1 as diference the result shown as below:  - the total number is different (including the trendline number)   Solution 3 I tried to use the |tstats command (from Enterprise Security) | tstats summariesonly=true allow_old_summaries=true count from datamodel=Email where (All_Email.action=* AND All_Email.orig_dest!="" OR All_Email.orig_src!="") earliest=-48h latest=-24h | append [| tstats summariesonly=true allow_old_summaries=true count from datamodel=Email where (All_Email.action=* AND All_Email.orig_dest!="" OR All_Email.orig_src!="") earliest=-24h latest=now] | appendcols [| makeresults | eval time=now() ] | rename time AS _time Solution 3 - which also did not work Can anyone help? Did i missed anything? Please.

I'm using mstats earliest_time(metric) to find the earliest time for metric. If I use    |mstats prestats=false earliest_time("http_req_duration_value") as "Start Time" where index=au_cpe_common_metrics    it returns a "Start Time" like 1633986822.000000 I want to be able to display this time in human readable format on a dashboard however when I try  ~~~ |mstats prestats=false earliest_time("http_req_duration_value") as "Start Time" where index=au_cpe_common_metrics | eval STime2=strftime("Start Time", "%d/%m/%Y %H:%M:%S")|table STime2 ~~~ I get no results.  I'd also like to be able to subtract earliest_time from latest_time to get the duration of the event based on other dimensions.   I also tried prestats = true but it  returned no Time values in the events. What format is earliest time in and why can't  I format it or do calculations with the value? What is happening here? I'm new to operating with metric indexes

Hi I'm searching on an internet usage index for events that contain a particular word somewhere in the domain. For example the word could be "edublogs". From the result, I need to sum the total of bytes downloaded for all events returned. The problem I'm having is needing to calculate a distinct count of centers and a distinct count of userids where the domain name only begins with "edublogs", e.g. "edublogs.com" and not when it doesn't, e.g.  "accountsedublogs.com". I know this example is wrong but can someone please help me with how I would change it to achieve the outcome below? index=searchdata domain="*edublogs*" | stats count dc(centre) AS distinctCenters | stats count dc(userid) AS distinctUserids | stats sum(bytes) AS totalBytes by domain | table domain totalBytes, distinctCenters, distinctUserids My desired results would look something like... domain totalBytes distinctCenters distinctUserids Senior 50000 15 321 Many thanks

The answer to this probably stupid simple. Banging my head on this. Help and patience please.   I am writing a query which audits user role activations. A user can have many roles, i.e. Network Admin, Security Reader, User Admin, Storage Operator, etc. Specifically, I want to view how many days has passed since a user activated a specific role.   Today - Last Activation = Days Since Last Activation   Questions: How can I most efficiently subtract the time of the most recent role activation event from the current time? How can I then only show the most recent results? How to then audit all users who have not activated a role in the past 30 days?   Base query for a single user search over 30 days and sample results are below.    index=audit user=bob@example.com | eval days = round((now() - _time)/86400) | table Role, user, _time, days | sort - days Sample Data Below Role UserName _time days Global Reader bob@example.com 2021-09-19T08:35:06.998 29 Global Reader bob@example.com 2021-09-19T08:35:05.514 29 Systems Administrator bob@example.com 2021-09-23T05:55:51.177 25 Systems Administrator bob@example.com 2021-09-23T05:55:49.036 25 Global Reader bob@example.com 2021-09-24T00:48:20.254 24 Storage Operator bob@example.com 2021-09-24T00:48:18.942 24 Systems Administrator bob@example.com 2021-09-27T07:22:23.971 21 Systems Administrator bob@example.com 2021-09-27T07:22:22.971 21 Global Reader bob@example.com 2021-09-27T07:19:40.569 21 Global Reader bob@example.com 2021-09-27T07:19:39.460 21   Desired results only show the most recent events  Role UserName _time days Global Reader bob@example.com 2021-09-24T00:48:20.254 24 Storage Operator bob@example.com 2021-09-24T00:48:18.942 24 Systems Administrator bob@example.com 2021-09-27T07:22:22.971 21 Global Reader bob@example.com 2021-09-27T07:19:39.460 21

Hello Splunk Community,  Can anyone help me build a query based on the below; I have a batch job that usually starts at 5.30pm everyday and finishes in the early morning of the following day. The batch job has multiple steps logged as separate events and has no unique id to link the step to the batch job. I want to create a timechart which shows the total duration (step 1 to 5) for each batch job occurring daily. Example of 1 batch job start & end time (Dummy Data Used): Step Start_Time End_Time 1 2021-09-11 17:30:00 2021-09-11 23:45:01 2 2021-09-11 23:45:01 2021-09-12 01:45:20 3 2021-09-12 01:45:20 2021-09-12 02:35:20 4 2021-09-12 02:35:20 2021-09-12 03:04:25 5 2021-09-12 03:04:25 2021-09-12 05:23:06   I hope someone can figure this one out as i have been stuck on it for a few days.  Many Thanks,  Zoe