Hello I have a table with 3 columns 1 is strings and 2 columns with numbers is there a way to sort the table from the highest number to lowest from all the values in the table ? for example: this is part of my table and i want to sort the numbers in "priority" and "silverpop" regardless if its one of them, just to see the raw with the highest value first

Hello I have to search events on many sourcetype with name begin by "ezop:web" So I use a wildcard after "ezop:web*"   index="tutu" sourcetype=ezop:web*     Is it the good practice or is it better to do somethin like this :   (sourcetype=ezop:web1 OR sourcetype=ezop:web2 OR sourcetype=ezop:web3)   Or pearhaps something else? Thanks

Hello,  We get this error and I'm not entirely sure on how we can resolve this? Looks like a timeout issue 2021-09-01 14:07:44,983 level=ERROR pid=12315 tid=Thread-20 logger=splunk_ta_o365.modinputs.management_activity pos=management_activity.py:do:159 | datainput=b'at_rbi_management_activity_sharepoint' start_time=1630505194 | message="Failed to retrieve content blob." content_id=b'20210901140215154005183$20210901140215154005183$audit_sharepoint$Audit_SharePoint$emea0023' Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py", line 383, in _make_request six.raise_from(e, None) File "<string>", line 2, in raise_from File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py", line 379, in _make_request httplib_response = conn.getresponse() File "/opt/splunk/lib/python3.7/http/client.py", line 1369, in getresponse response.begin() File "/opt/splunk/lib/python3.7/http/client.py", line 310, in begin version, status, reason = self._read_status() File "/opt/splunk/lib/python3.7/http/client.py", line 271, in _read_status line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1") File "/opt/splunk/lib/python3.7/socket.py", line 589, in readinto return self._sock.recv_into(b) File "/opt/splunk/lib/python3.7/ssl.py", line 1071, in recv_into return self.read(nbytes, buffer) File "/opt/splunk/lib/python3.7/ssl.py", line 929, in read return self._sslobj.read(len, buffer) socket.timeout: The read operation timed out During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/requests/adapters.py", line 449, in send timeout=timeout File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py", line 637, in urlopen _stacktrace=sys.exc_info()[2]) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/util/retry.py", line 368, in increment raise six.reraise(type(error), error, _stacktrace) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/packages/six.py", line 686, in reraise raise value File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py", line 599, in urlopen chunked=chunked) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py", line 385, in _make_request self._raise_timeout(err=e, url=url, timeout_value=read_timeout) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/urllib3/connectionpool.py", line 305, in _raise_timeout raise ReadTimeoutError(self, url, "Read timed out. (read timeout=%s)" % timeout_value) urllib3.exceptions.ReadTimeoutError: HTTPSConnectionPool(host='manage.office.com', port=443): Read timed out. (read timeout=60) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/modinputs/management_activity.py", line 153, in do response = self._subscription.retrieve_content_blob(session, content.uri) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 166, in retrieve_content_blob return self._request(session, 'GET', url) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365/common/portal.py", line 179, in _request response = session.request(method, url, params=params, timeout=self._request_timeout) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/requests/sessions.py", line 533, in request resp = self.send(prep, **send_kwargs) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/requests/sessions.py", line 646, in send r = adapter.send(request, **kwargs) File "/opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/requests/adapters.py", line 529, in send raise ReadTimeout(e, request=request) requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='manage.office.com', port=443): Read timed out. (read timeout=60)  

Hi, I'm having an odd issue. I made some field extractions and validated them through Regex101. However only some of the fields are being extracted, not all. Initially they all work and then some disappear. Its a single Regex string so if there were any issues I don't know why other fields would be extracting but not others. And the sourcetype has not changed. Does anyone have a solution for this or any inkling of what might be going on? For reference here's my regex: "log":\s"(?<log_source>[^\s]+)\s(?<ISO8601>[^\s+]+)\s+(?<log_level>[^\]]+)\s\[(?<exchangeId>[^\]]+)\]\s(?<RuleType>[^\.]+)\.\[(?<RuleName>[^\]]+)\]\s-\s(?<http_method>[^\|]+)\|(?<site>[^\|]+)\|(?<uri_path>[^\s\?"|]++)\|(?<status>[^\|]+)\|{\\"error_description\\":\\"(?<error_description>[^"]+)\\\",\\"error\\":\\"(?<error>[^\\]+)\\"}\\n Log: "log": "/opt/instance/log/access.log 2021-09-01T14:40:17,493 WARN [wUJHboi800nOHINLKnugbF1rBkcQ] Rule.[ErrorCapture] - POST|site.com|/oauth|400|{\"error_description\":\"Authorization code is invalid or expired.\",\"error\":\"invalid_grant\"}\n" And it seems to only be the site field not extracting for whatever reason

This is my splunk query   index=xxxxx "searchTerm")|rex "someterm(?<errortype>)" | timechart count by errortype span ="1w" | addcoltotals labelfield=total | fillnullvalue=TOTAL|fileds - abc,def,total   I am adding the total count of the errors over a week in another column named TOTAL as depicted in table below.Here A... B... are error names in alphabetical order, the values are total number of errors that occured on that day for that errortype _time                      A....     A....     C....     D....     E.... 2021-08-25       11         22      05      23      89 2021-08-26        15       45        45      13      39 2021-08-27        34       05        55       33     85 2021-08-28        56       08        65       53      09 2021-08-29         01       06        95      36       01 TOTAL                  117        86       265  158    223 I want these fields sorted by value in TOTAL row in descending order like 265   223 1 58  117  86 But i am always getting this in alphabetical order of the errortype like A... A... B... how can i improve this query to get the sorted result like i want?

I’m attempting to determine how to identify the distribution of the Java Agent deployed on a server. I know that for the agents that support Java1.7 or lower you can unpack the javaagent.jar and look at /META-INF/MANIFEST.MF If it’s the IBM specific agent: Then Implementation-Version will read “Server IBM Agent #” Elseif it’s the Sun+JRocket: Then Implementation-Version will read “Server Agent #” However, how do you tell if it’s the Sun+JRocket that supports Java1.7 and lower, or the Sun+JRocket that supports Java1.8 or higher? I have unpacked javaagent.jar for both agents, ran a diff on the entire file structure and it came back with no results.