I have a table that looks like this: Time Host User Activity 2021-01-01 01:02:01 ABC Test CommandLine: C:/Users/Cool/cool.exe File: cool.exe Hash: yr3f7r98jkfd7y38ykry73 2021-01-01 01:02:02 ABC Test CommandLine: C:/Users/Lame/lame.exe File: lame.exe Hash: kf39utkuk0ulftu39uk30utk 2021-01-01 01:02:03 ABC Test CommandLine: C:/Users/Idk/idk.exe File: idx.exe Hash: 9l09uk8dtyjy4j4098tk48   The query I used to made the table looks something like this: host=ABC User=Test | rename host AS Host | eval Time=strftime(_time,"%Y-%m-%d %H:%M:%S"),Activity=mvappend("CommandLine: ".CommandLine," ","File: ".File," ","Hash: ".Hash) | table Time Host User Activity | dedup consecutive=true Activity sortby Time I am trying to use a drilldown to make it so when I click the hash in my Dashboard, it redirects me to a website. The issue I'm have is when I add the link and I click the Hash, instead of just giving me the hash: "9l09uk8dtyjy4j4098tk48", it will give me entire cell "Hash: 9l09uk8dtyjy4j4098tk48" which bugs out my URL.   Expected Output: https://website.com/9l09uk8dtyjy4j4098tk48   Actual Output: https://website.com/Hash: 9l09uk8dtyjy4j4098tk48   Another issue is no matter what cell I click they will all try to redirect me to the website:   Example: https://website.com/CommandLine: C:/Users/Lame/lame.exe   How can I make it so I can only click the hash value to get my expected output?

Hello, I need to find a way to use another field for _Time on a single query (I don't want to change props just for 1 query) Sample Time:    2021-06-19T04:15:59.845Z     I've tried several strptime I've seen in other questions but to no avail. I did get one to format previously for a table format using the following     | eval SeenTimeStringConverted=strftime(strptime(Time,"%Y-%m-%dT%H:%M:%S.%6N"),"%m/%d/%Y %H:%M:%S %p")     Here's my query I've been working on.     sourcetype="aws:cloudwatchlogs:securityhub" "CIS" "detail.findings{}.Compliance.Status"!=NULL | rename "detail.findings{}.FirstObservedAt" as Time | eval _time=strptime(Time,"%Y-%m-%dT%H:%M:%S.%6N") | timechart count by "detail.findings{}.Compliance.Status"        

Howdy fellow Splunkers! I have tried to find a previous article but I must be missing it if there is one. I need help as I am doing some app/add-on updates for the first time and hit a roadblock. I have an app installed currently and the app folder in deployment-apps is titled: forescout-app-for-splunk_291 and the new one is called forescout-app-for-splunk. They took off the version number.  I was not the one who installed the first one so I'm not sure what their thinking was. I am using a Deployment Server and can't figure out how to get it to replace the version one with the non version one. If I just install it like a new app, then both are on the SH and I am afraid of losing any config from the first app. Oh man, I really hope that made sense. Any help is greatly appreciated!

Hi all, I'm working to correlate a series of events. These events are all part of a logging process of a separate application. What seems to be common is a UUID. The following searches produce what I'd like individually: for the first timestamp associated with the start of the process (there are multiple processes running for each UUID, but the ask is to extract the first / last timestamp) index=###### sourcetype=### "process() - start" | rex "^(?:[^ \n]* ){2}(?P<UUID>[^,]+)" | eval startTime = strftime(_time, "%Y-%d-%m %H:%M:%S") | stats earliest(startTime) as startingTimeStamp by UUID index=###### sourcetype=### "process() - end" | rex "^(?:[^ \n]* ){2}(?P<UUID>[^,]+)" | eval endTime = strftime(_time, "%Y-%d-%m %H:%M:%S") | stats latest(endTime) as endingTimeStamp by UUID I'm trying to learn how to use join to connect these events by UUID. This SPL returns a table that has the earliest and latest of startTime, rather than the earliest(startTime) and latest(endTime).  index=###### sourcetype=### "process() - start" | rex "^(?:[^ \n]* ){2}(?P<UUID>[^,]+)" | eval startTime = strftime(_time, "%Y-%d-%m %H:%M:%S") | stats earliest(startTime) as startingTimeStamp by UUID | join UUID type=left [ search index=###### sourcetype=### "process() - end" | rex "^(?:[^ \n]* ){2}(?P<UUID>[^,]+)" | eval endTime = strftime(_time, "%Y-%d-%m %H:%M:%S") | stats latest(endTime) as endingTimeStamp by UUID ] Is join the appropriate function to use here? I'm reading in coalesce and append as well, but from my understanding append does not fit. Another piece is that the UUID is not a field extraction, but rather a regex, so I'm unsure how the join would be able to function if the subsearch has no knowledge of UUID until it runs and performs the rex. 

I need help breaking the following data into segments. The data is currently lumped together. I have been working with the Splunk Add Data feature to attempt to parse the data correctly 07400 16:31:30.320 Processing 51 log entries in <servername.615494dd0000.dblog> from servername 07784 16:31:30.492 Processing 51 log entries in <servername.615494e00000.dblog> from servername 07400 16:31:30.633 DBLog Summary: time=313ms (total=51, mean time=6.137/rec), Message:(c=32, t=297) Content:(c=5, t=0) NodeStats:(c=1, t=0) VirusScannerStats:(c=13, t=0) 07784 16:31:30.987 DBLog Summary: time=484ms (total=51, mean time=9.490/rec), Message:(c=35, t=469) Content:(c=4, t=0) NodeStats:(c=1, t=0) VirusScannerStats:(c=11, t=0) 07784 16:31:31.213 Processing 51 log entries in <servername.615494e00000.dblog> from servername 07784 16:31:31.278 DBLog Summary: time=62ms (total=51, mean time=1.216/rec), Message:(c=31, t=31) Content:(c=9, t=16) NodeStats:(c=1, t=0) VirusScannerStats:(c=10, t=0) 07784 16:31:31.691 Processing 51 log entries in <servername.615494e20000.dblog> from servername 07400 16:31:31.739 Rule Profiler: writing queued records to the database. 07400 16:31:31.745 Rule Profiler: finished writing queued records to the database. Record count: 53 07784 16:31:31.776 DBLog Summary: time=93ms (total=51, mean time=1.824/rec), Message:(c=31, t=78) Content:(c=6, t=0) NodeStats:(c=2, t=0) VirusScannerStats:(c=12, t=0) In Regex tester I have used the regex (\d{5}\s+\d{2}:\d{2}:\d{2}.\d{3}\s+Processing 51) to correctly capture where the data needs to be on a new line. I need the event data parsed to look as follows: 07400 16:31:30.320 Processing 51 log entries in <servername.615494dd0000.dblog> from servername 07784 16:31:30.492 Processing 51 log entries in <servername.615494e00000.dblog> from servername 07400 16:31:30.633 DBLog Summary: time=313ms (total=51, mean time=6.137/rec), Message:(c=32, t=297) Content:(c=5, t=0) NodeStats:(c=1, t=0) VirusScannerStats:(c=13, t=0) 07784 16:31:30.987 DBLog Summary: time=484ms (total=51, mean time=9.490/rec), Message:(c=35, t=469) Content:(c=4, t=0) NodeStats:(c=1, t=0) VirusScannerStats:(c=11, t=0) 07784 16:31:31.213 Processing 51 log entries in <servername.615494e00000.dblog> from servername 07784 16:31:31.278 DBLog Summary: time=62ms (total=51, mean time=1.216/rec), Message:(c=31, t=31) Content:(c=9, t=16) NodeStats:(c=1, t=0) VirusScannerStats:(c=10, t=0) 07784 16:31:31.691 Processing 51 log entries in <servername.615494e20000.dblog> from servername 07400 16:31:31.739 Rule Profiler: writing queued records to the database. 07400 16:31:31.745 Rule Profiler: finished writing queued records to the database. Record count: 53 07784 16:31:31.776 DBLog Summary: time=93ms (total=51, mean time=1.824/rec), Message:(c=31, t=78) Content:(c=6, t=0) NodeStats:(c=2, t=0) VirusScannerStats:(c=12, t=0) I have tried LINE_BREAKER=([\r\n]+), BREAK_ONLY_BEFORE, MUST_BREAK_AFTER, MUST_NOT_BREAK_BEFORE along with using the regex shown above in the Splunk Wizard will not break the data as needed. Thanks

Hello! I'm hoping some Splunk masters can help me with what I thought would have been an easy task but I'm very much stuck on it.  How can I group similar starting results into one result within the same field? I have a field that spits out results formatted like this: index=prod_side sourcetype=prod_one  fail_code=* | table fail_code Results: fail_code c-tr [213] c-tr [893] c-tr [309] e-hw [gold] e-hw [silver] e-hw [bronze] e-pr [vbix] e-pr [zbix] g-tr [345] g-tr [123] d-st [(intel.arm64) T 123 123] d-st [(intel.arm64) T 456 456] I want to group results and count the total for each by the 4 characters before the brackets [ ] begin. The content in the brackets is not relevant to me and can be done away with in the results table: fail_code_name     value_count c-tr                                  3 e-hw                               3 e-pr                                 2 g-tr                                  2 d-st                                 2

I'm new to Splunk and I'm trying to do something that is probably basic but I haven't been able to figure out how to do it.   I have a log in Splunk which contains an http_query along the lines of: ``` my_object[prop1]=someVal&my_object[prop2]=someOtherVal ``` I'm trying to use a timechart to inspect these values. I've tried: `timechart count by my_object[prop1]` which tells me prop1 is undefined. Then also tried `timechart count by my_object.prop1`  which gives me a time series with NULL everywhere. How can I do this?

Hello dears, How can i sort these field values ? Field = "port" 0/1/0/2/ 0/8/0/7/ 0/2/0/3/ 0/5/0/2/ 0/6/0/3/ 0/16/0/2 0/18/0/6 0/16/0/5 0/4/0/2/ 0/6/0/2/ 0/18/0/2 0/12/0/4 0/3/0/7/   Regards.