I have logs like of this form: [2021-08-19T13:59:05.607] [INFO] collect - [4a2b9170-0130-11ec-95b3-17c017e0ec5d] {"uid":967,"ec":"login","em":"Successful authentication with username: [test123] other data here..." [2021-08-19T13:59:05.607] [INFO] collect - [4a2b9170-0130-11ec-95b3-17c017e0ec5d] {"uid":967,"ec":"login","em":"Successful authentication with username: [test123] other data here..." I would like to run a query that will show all the cases where "username: [specific user]" shows up within 1 second. So the two lines above would be a hit because the test123 appeared in two similar events 1ms apart. I have gotten this far: source="my.log" | rex field=_raw "Successful authentication with username: \[(?<username>.*)] " | streamstats count time_window=1s by username | where count > 1 But this doesn't take the value of username into account and returns all cases of "Successful authentication.." that happen to be within the same second. (Again I want that *only* if the username field is the same.)   Thanks!  - Henrik

Hello, Please let me know how I would break the events, write TIME_PREFIX and TIME_FORMAT for my PROPS Conf.  file  for this sample source data events: TIME_PREFIX= TIME_FORMAT= LINE_BREAKER= BREAK_ONLY_BEFORE= Sample data has 5 events.  I marked the text  as RED to indicate beginning of each events and time as GREEN Thank you so much, greatly appreciated! ---------------------------Sample Data Starts------------------- TCC     A TCU00002I 22.59.00 MFE REPORT LAST 5.0 MINUTES                                                     2021-06-14 00:00:09.420 TCC     A Server            TSID  I PKTS  O PKTS |Server            TSID  I PKTS  O PKTS                     2021-06-14 00:00:09.421 TCC     A VP2SMTBAPPICE10   VQME     607     623 |VP2SMTBAPPICE11   VQMF   629   661 _                       2021-06-14 00:00:09.422 TCC     A VP2SMTBAPPICE12   VQMG     603     605 |LAPKSC            UZ77     6     6                         2021-06-14 00:00:09.423 TCC     A VP2SMTBAPPICCE2   VPQJ     586     595 |VP2SMTBAPPICCE4   VPQK   600   618                         2021-06-14 00:00:09.424 TCC     A VP2SMTBAPPICCE5   VPQM       7       7 |VP2SMTBAPPICCE6   VPQN    11    11                         2021-06-14 00:00:09.425 TCC     A VP2SMTBAPPICCE7   VPQO      15      15 |VP2SMTBAPPCLS02   VXBK    13    13 _                       2021-06-14 00:00:09.426 TCC     A VP2SMTBAPPCLS03   VXBL      20      20 |VP2SMTBAPPCLS04   VXBM    11    11                         2021-06-14 00:00:09.427 TCC     A VP2SMEMAPPICCE1   VXBA     520     528 |VP2SMEMAPPICCE2   VXBB   548   560                         2021-06-14 00:00:09.428 TCC     A VP2SMEMAPPICCE3   VXBC     523     530 |VP2SMEMAPPICCE5   VXBE    28    28                         2021-06-14 00:00:09.429 TCC     A VP2SMEMAPPICCE6   VXBF      40      40 |VP2SMEMAPPICCE8   VXBH    25    28 _                       2021-06-14 00:00:09.430 TCC     A VD2SMEMAPPCLS02   VXBO      35      35 |VD2SMEMAPPCLS03   VXBP    49    49                         2021-06-14 00:00:09.431 TCC     A VD2SMEMAPPCLS04   VXBQ      40      40 |VP2SMEMAPPICE10   VQMB   526   537                         2021-06-14 00:00:09.432 TCC     A VP2SMEMAPPICE11   VQMC     602     609 |VP2SMEMAPPICE12   VQMD   486   486                         2021-06-14 00:00:09.433 TCC     A VP2SMTBAPPICE13   VQMH     565     572 |VP2SMEMAPPICCE4   VXBD   591   597 _                       2021-06-14 00:00:09.434 TCC     A VP2SMTBAPPCLS01   VXBJ      12      12 |VP2SMTBAPPICCE1   VPQI   565   580                         2021-06-14 00:00:09.435 TCC     A VP2SMTBAPPICCE4   VPQL     551     561 |VP2SMEMAPPICCE7   VXBG    40    40                         2021-06-14 00:00:09.436 TCC     A VD2SMEMAPPCLS01   VXBN      42      42 |VP2SMEMAPPICCE9   VQMA   528   535                         2021-06-14 00:00:09.437 TCC     A VP2SMTBAPPICCE8   VPQP       2       2 |                                                           2021-06-14 00:00:09.438 TCC     A                                                                                                    2021-06-14 00:00:09.439 TCC     A PID POOL PIDS IN USE: 1312 OUT OF 3001                                                             2021-06-14 00:00:09.440 TCC     A END OF MFE REPORT+ TCC     A CVZB0001I 22.59.00 LAST FALLBACK COPY OF CP KEYPOINTS ON SYMBOLIC                                  2021-06-14 00:00:09.442 TCC     A MODULE: 010A DEVICE: 710A+                                                                         2021-06-14 00:00:09.443 TCC     A TCPF0001I 22.59.00 TCP KEYPOINTED+                                                                 2021-06-14 00:00:09.444 TCC     A OCC10000I 22.59.02 RMT HOST-A CCMOD DSBL ERSS AT+                                                  2021-06-14 00:00:11.445 TCC     A OCC10013I 22.59.02 *MEH1PRD* COMMAND CODE(S) DISABLED BY RMT HOST+                                 2021-06-14 00:00:11.446 TCC     A COMMAND CODE DISPLAY                                                                               2021-06-14 00:00:11.447  ------------------------Sample Data Ends---------------------------

Hi  I have a input token in my dashboard for register number called $tok_reg_num$. The customers can put in a specific number or leave it as the default of "*".    Here's the issue,  in one of the dashboard searches I can use the default of "*"   (e..g  index=blah sourcetype=blahblah register_number=*),  in a secondary panel  I have to use a where  with a LIKE clause due to the different log type to filter the register number so * won't work and I need to change it to a  %.    Non-working: | Where customer="foo" AND like(Register,"*")  <--the  dashboard default for  $tok_reg_num$ I want it to be this: | Where customer="foo" AND like(Register,"%")  <- change the $tok_reg_num$ to % I have exhausted my meager splunk token experience in trying to get this to work.  I can't figure out if I can examine and change it in the search  or do I need to do that  on the dashboard.   Someone give me a nudge in the right direction, please 

Hi Experts, I have a a job log file, that gets ingested to Splunk with naming convention "trace_08_19_2021_06_36_03_*********.txt". After trace, the format of the log file is _MM_DD_YYYY_HH_Min_Sec.****. Requirement is to extract the date and time from the file name and show the no. of the logs that get generated in an hour. I read a blog which mentioned that Splunk extracts the timestamp from filename, but that's not happening with this case. Kindly help with this case. Thanks in advance for any assistance. Regards, Karthikeyan.SV

Hello Everyone! I am struggling to find out how to keep the format visualization options for a chart in a Splunk dashboard when opening the search with the "Open in Search" option. I do have a dashboard where all panels have a 2-axis visualization (column & line) with many customization (type of scale, min and max values, etc.), however when opening the search using the "Open in Search" option that customization is lost. Do you  know if there's any way to preserve that customization? Many thanks in advance! Best

Hi I am using java script to change teh column value color in splunk … var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function (cell) { return _('source').contains(cell.field); }, i want this with wildcard like this column to have any value before var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function (cell) { return _('*source').contains(cell.field); },