Hi Splunkers! I have a use case where in my dropdown selection (selected value that shows up in the dropdown) should update on the $click.value$ of a previously displayed pie chart on the same dashboard. Any pointers would be appreciated

How are you tuning ES to your environment?  Are you overwriting the correlation searches that ship with ES or are you making copies of them and modifying the copies? When there is an update for ES, are you having to go correlation search by correlation search, line by line to comparing them to see what changed? What about ES Content Updates?

Hi, Current table Expected fstatus count success 604 Userdefined 39   Need to sum the "password mismach","policy policy constraint violation","reset token expired","unexpected error setting password" and save it to as new value named "user defined"  and need to rename the empty value in fstatus field to success. Anyone please help on this. Regards, Madhusri R

Hello all, I need help with this :(( How to use derivatives of 1st function results into the 2nd function in splunk? Please see the example below: 1st function: for instance, from the first eval, i got the names of the top 100 sold fruits and their respective companies. 2nd function: From this top 100 fruits, I would like to then, search for the fruits import-export countries (ie the export country (origin) and imported (destination) country). Each of the fruits may have more than 1 set of export-import. How do I go about doing it? What's the syntax to get the top 100 fruits into the second function? Any guidance appreciated

I have installed the required apps to get Splunk App for Windows Infrastructure to work. I have the inputs.conf configured with the following:  ###### OS Logs ###### [WinEventLog://Application] disabled = 0 index = wineventlog start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=true [WinEventLog://Security] disabled = 0 index = wineventlog start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" renderXml=true [WinEventLog://System] disabled = 0 index = wineventlog start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=true   If i search for the index wineventlog i see items that have been indexed from all desktops, but for some reason i cant seem  to get the information to show up on the Splunk App for Windows Infrastructure under Windows > Event Monitoring all i get is No Results found....    Any ideas why this would be?  I have tried to run the Build lookups again etc and its the same.  Thanks

I'm going to stats through two lookups. srcip.csv field src_ip , subnetmaks dest.csv field dest_ip,subnetmaks src_ip , dest_ip , is intended to be used in stats. ex) index="myindex" | [ | inputlookup destip.csv] [ | inputlookup srcip.csv] stats values(src_ip) AS src_ip by dest_ip Or is there another way, and if it's different from my index field, ex) csv = src_ip myfield = srcip csv = dest_ip myfield = destip What should I do if it is?

I tried to find a solution in order to parse some URL to obtain the base but it seems that I cannot succeed. For the between GET/POST and HTTP I want to return the baseurl as in the examples below GET /gw/api/aaa/v1/ HTTP - to return /gw/api/aaa/v1 GET /gw/api/abc/v3 HTTP - to return /gw/api/abc/v3 POST /gw/api/cba/ HTTP - to return /gw/api/cba POST /gw/transactions/swaggers/v2 HTTP - to return /gw/transactions/swaggers/v2 POST /gw/api/swaggers/v1/asd?dssa HTTP - to return /gw/api/swaggers/v1/asd POST /api/swaggers/ HTTP - to return /api/swaggers GET /api/cashAccountOpenings/v3/sadsa-123312-1312 HTTP - to return /api/cashAccountOpenings/v3   I added this examples to regex101.com to be easier to find a solution. https://regex101.com/r/oLXtw8/1/  

Hi, One of our client interested to ingest the open telemetry data in to splunk and  we want to monitor Application performance and I could see Splunk APM module is used to perform this task.  When I was going through the Splunk Distribution open telemetry collector documents, I got the following doubts. 1) Do I need to buy any additional modules in-order to ingest the Open telemetry data in to splunk, as we have Splunk Enterprise Licensed version.   2)  Is it possible to ingest the open telemetry data without using the Splunk Observability Cloud module.  3) If it is possible to ingest open telemetry data into splunk than could you please provide the link to access the document. Thanks in advance. 

Hi Team, Current table column row1 row2 status failure success   My Requirement- 1------if the row 1 has value as failure and if row 2 itself itself does not exists then row1 has to be renamed to failure 2------if the row 1 has value as success and if row 2 itself itself does not exists then row1 has to be renamed to success 3------if the row 1 has value as success and if row 2 has the value as failure ,then row 1 wants to renamed to as success and row 2 as failure. 4------if the row 1 has value as failure and if row 2 has the value as success, then row 1 wants to renamed to as failure and row 2 as success.   All these cases need in single query. Can anyone help on this? Regards, Madhu R

from a SOC perspective what health checks are important for them to perform? i understand the basic checks from splunk monitoring console but are there better checks or more relevant checks a SOC should be focusing on? 

Hello Splunk Community, I've a query which lists accountNumber , targetAccountNumber, eventType, eventTime The query is working just fine..but it is displaying empty rows with eventTime being displayed accountNumber   targetAccountNumber    eventType      eventTime 123456                         789123                               apple               09/02/2020:12:00                                                                                         banana           09/02/2020:13:00   111111                        763333                                 mango               09/03/2020:15:00                                                                                        watermelon       09/03/2020:16:00   212121                         999999                              Texas                   09/04/2020 :18:00                                                                                                                        09/04/2020:19:00                                                                                                                       09/04/2020:20:00                                                                                                                       09/04/2020:21:00 I do not want the empty eventTime being displayed. It should display only there is an eventType for particular time. How should I exclude the empty eventTime My query is as follows index=newyork data | stats values(eventType) as eventTypes,values(eventTime) as "Event Time" by accountNumber, targetAccountNumber   Please help                                                                                                                        

Trying to install Tripwire app and getting the following errors : error:335 - Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 628, in respond self._do_respond(path_info) File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cprequest.py", line 687, in _do_respond response.body = self.handler() File "/opt/splunk/lib/python3.7/site-packages/cherrypy/lib/encoding.py", line 219, in __call__ self.body = self.oldhandler(*args, **kwargs) File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/htmlinjectiontoolfactory.py", line 75, in wrapper resp = handler(*args, **kwargs) File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpdispatch.py", line 54, in __call__ return self.callable(*self.args, **self.kwargs) File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/routes.py", line 383, in default return route.target(self, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-486>", line 2, in listEntities File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 40, in rundecs return fn(*a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-484>", line 2, in listEntities File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 118, in check return fn(self, *a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-483>", line 2, in listEntities File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 166, in validate_ip return fn(self, *a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-482>", line 2, in listEntities File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 245, in preform_sso_check return fn(self, *a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-481>", line 2, in listEntities File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 284, in check_login return fn(self, *a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-480>", line 2, in listEntities File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 304, in handle_exceptions return fn(self, *a, **kw) File "</opt/splunk/lib/python3.7/site-packages/decorator.py:decorator-gen-475>", line 2, in listEntities File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 359, in apply_cache_headers response = fn(self, *a, **kw) File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 1738, in listEntities app_name = eai_acl.get('app') AttributeError: 'NoneType' object has no attribute 'get'