This is mostly just a curiosity, motivated by this post on how to compare a particular time interval across multiple larger time periods. Effectively the solution seems to be to generate a list of time intervals and run map subsearches on each entry. When I have multiple time periods that I'd like to run stats on, I typically use a multisearch command followed by a chart, as follows:     | multisearch [ index=potato et=<et1> lt=<lt2> | eval series=1 ] [ index=potato et=<et2> lt=<lt2> |eval series=2 ] . . . [ index=potato et=<etn> lt=<ltn> | eval series=n ] | timechart count by series     I suppose you could make it work by substituting the et's and lt's via subsearch, but it won't work if the number of time intervals, n, is also dynamically generated by some prior search.  I know you can use a number of different techniques, but they all have different drawbacks. You could use map, which offers pretty much all the flexibility/dynamic-ness you need (I've abused it plenty of times doing things like map search=`searchstring($searchstring$)` ), but there are performance issues with this as subsearches can time out as it doesn't offer the same optimization as multisearch does when you just need to string multiple streams together.  You can just search the entire timerange and use some eval logic to filter out the time intervals you need, but isn't this suboptimal since you're searching more events than you need? Multisearch seems to be great at streaming multiple different time intervals together and I'd love to have that optimization without  At this point, would you just have to resort to REST to schedule searches? How would we tie the data together? I'm not very familiar with what is possible with REST as all of my experience is with just plain SPL.  In a word, how do we stream events across multiple, dynamically generated time intervals without running into subsearch limitations?  

Hello, I have some issues writing a PROPS configuration file for the following  source data stored in text file. I  also used TIMESTAMP_FIELDS= timeStamp there, to have field values under field names.  But, it's not working. My PROPS configuration and a sample event are given below.  Any help will be highly appreciated. Thank you so much.    [ __auto__learned__ ] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) TIMESTAMP_FIELDS=timeStamp TIME_PREFIX =^\{\"timeStamp\"\:\" TIME_FORMAT=%Y-%m-%d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD=29   {"timeStamp":"2021-06-21 14:53:56 EDT","appName":"OSD","userType":"FILTER","StatCd":null,"Amt":null,"errorMsg":"","eventId":"APP_ENTRY","eventType":"VIEW","fileSourceCd":null,"ipAddr":"11.212.41.151","mftCd":null,"outputCd":null,"planNum":null,"reasonCd":null,"returnCd":"00","sessionId":"XWGMwkncVD0m60OQBOahu8s/qG1c=","Period":null,"cat":"234207501","Type":null,"userId":"cdabea740a-g9a0-408f-a6a7-5ae70c689e6d","vsardata":{"uri":"/osd/rest/accountSummary","host":"appsa.rup.afsiep.net","ipAddress":"11.212.41.151","Id":"AXSabea753c-d9a0-408f-a6a7-5ae70c689e6d","requestId":"as58510cd-0459-614b7bc4-1afdd700-0bf875285d76","referer":https://saada.ruer.egsiep.net/osd/,"responseStatus":0}}  

Hi all, I'm setting up an alerting process that monitors different servers on a single index and sends an alert out if no events are fired over a 24 hour period. It's set to run at midnight and look back over the last 24 hours. If no events are found on any of the hosts, it should send an email with the details of that host. I'd like to set up 1 alert, if possible, rather than setting up an alert for each host.  I should specify that host is internal, not the 'splunk_server', but each host is one of our servers. Here's what I tried so far: index=#### sourcetype=#### source=/usr/app/*/logs/#####.txt | rex field=source "\/[^\/]+\/[^\/]+\/(?<env>[^\/]+)\/.*"                // extract our the environment | stats count by host                                                                                            // count by host | lookup ######.csv serverLower AS host output IP   // add in the ip of the host to add to the table | table env, host, IP, count                                                         // inline table passed to alert This will give us a correct assessment of count by host, but will just return that count to the email alert. I'd like to only send out an email when a count is 0 for a specific host, and then send only the details of that host with count=0.  Thanks

Hi Splunkers, How to create Incidents on SNOW from Splunk SPL? We have "ServiceNow Event Integration" alert action in use which creates incidents when an alerts triggers an event but trying to use the same from Splunk search. Tried using sendalert command as below and got an error: | sendalert servicenow param.severity="4" param.assigned_to="Assignment group" param.short_description="Alert Name" param.description="This is a test" param.u_environment="Dev" param.node=hostname param.resource="Nothing" param.type="Name" Error: Error in 'sendalert' command: Alert action "Servicenow" not found.

Hi, Is there a way to determine if an index has stopped logging/has gone inactive? I have tried looking through the docs, but am new to splunk and trying to figure this out. I know we can use metadata for hosts and sourcetypes, but doesn't seem to work for indexes. Any recommendations? Timo

Hi Folks, I need to split  a multiline field     -2.9416067 53.0374031 0.0       the first line is latitude e the second line is longitude,   is possible extract these two fields from this multi-line field?

Hello, I have a problem with my distributed environment where some of my instances appear greyed out under CPU and memory utilization. If I open the specific instance panels I see the red icon with the errors below.  This is very strange because it affects the indexers only. The only difference with them is that the web service is disabled a per Splunk best practices. I tried with splunk support by opening a case but we couldn't find the solution yet.   Splunk Version: 8.0.3 (indexers), 8.0.5 (everything else)--- Is this a problem?  [subsearch][servername]Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/server/info?count=0&strict=false from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API. [subsearch][servername]Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/server/info?count=0&strict=false from server=https://127.0.0.1:8089 - Bad Request   --- MORE INFO --- If I run the command manually like: https://10.10.10.1:8089/services/server/status/resource-usage/hostwide I get the output in my browser.   I read this post: https://community.splunk.com/t5/Getting-Data-In/Splunk-Management-Console-Error-subsearch-Rest-Processor-https/m-p/326219#M60633  It talks about the indexer role, my Cluster Master is also "SHC Deployer" (Search Head Cluster Deployer), would this be the role I have to move? Its not an Indexer, I have 6 dedicated indexers and 5 dedicated search heads.

Hi, I have a search that contains millions of events and is extremely slow, is there a way to speed it up?   This is the query:   index=audit | table db_name | dedup db_name | outputlookup audit.csv