I want to find out How many times string appeared in ONE SINGLE EVENT. and group all the events and find table like : Attempts        : Count : 1                            100 2                            342 3                            201 4                            04 5                            00 how to write query for this ?

Hello Team, I'm very new to splunk, I have below two logs "message": "api.main REQ user1 10.10.44.76 \"GET /api/v1/data?my_list=%25geo%25&our_list=%25school%25&query_string_list=%25college%25&page=1&per_page=100\" "message": "api.main REQ user2 10.10.14.16 \"GET /api/v1/data?my_list=%25geo%25&our_list=%25office%25&query_string_list=%25school%25&page=1&per_page=100\" I want to get data between  "%25school%25" -> school. So contains log1: school, collage                          log2: office, school We can count and show: school=2, office=1,collage=1, If possible we can plot in time chart Thanks in advance.

Hi, Under lookups we have lookups as below lookups abcd.csv xyz.csv I could see configs in props.conf to map to these lookups props.conf LOOKUP-field1-field2 = abcd_lookup field OUTPUTNEW field1,field2 LOOKUP-field3 = xyz_mapping field OUTPUTNEW field3 You can see  in props.conf, along with the first lookup name they have added _lookup (abcd_lookup) and along with the second lookup name they have added _mapping (xyz_mapping). is this correct?   

I have two indexes including command line arguments, one has field name arg, the other one has field name command, what is the best practice to search some strings on both fields under different indexes to create alert if matches.  index=A arg="*command_string_to_search*" OR  index=B command="*command_string_to_search*" How can we improve this search from performance standpoint?  Thanks,

Hi,   I am getting the bellow error:   editTracker failed, reason='Unable to connect to license master=https://192.168.0.21:8189 Error connecting: SSL not configured on client' after running: sudo ./splunk edit licenser-localslave -master_uri https://192.168.0.21:8189 I have tried removing the SSLpassword from  system/local/server.conf however this has not worked. Thanks   Joe

Hi All, I am looking for a little help with a search today. I am looking to create an alert based on this search that only triggers when the same hostname comes up twice in a row.  so far the search I have is I am unsure how to include/return two machines of the same name: index="login_pi" source="WinEventLog:LoginPI Events" SourceName="Application Threshold Exceeded" | rex field=_raw "Actual value\\\":\s+\\\"(?<actual_value>\d+)" | search actual_value>=10 | table Target,actual_value,ApplicationName,Title here is an example event: 07/14/2021 10:39:49 AM LogName=LoginPI Events EventCode=800 EventType=4 ComputerName=RNBSVSIMGT02.rightnetworks.com SourceName=Application Threshold Exceeded Type=Information RecordNumber=1786721 Keywords=Classic TaskCategory=None OpCode=Info Message={ "Description": "Measurement duration (7.561s) exceeded threshold of 5s (51.22%)", "Actual value": "7.561", "Threshold value": "5", "Measurement": "quickbooksopen_2021", "Locale": "English (United States)", "RemotingProtocol": "Rdp", "Resolution": "1920 × 1080", "ScaleFactor": "100%", "Target": "BPOQCP01S01", "TargetOS": "Microsoft Windows Server 2016 Standard 10.0.14393 (1607)", "AppExecutionId": "4ed43186-648c-4e8e-96ee-9e4b52e468cb", "AccountId": "a4a6655b-f7ac-4783-aec5-698a146eb2cf", "AccountName": "rightnetworks\\eloginpi082", "LauncherName": "RNBSVSI23", "EnvironmentName": "BPOQCP01S01", "EnvironmentId": "bc31c8f6-e8c0-4278-93c3-08d8040960f8", "ApplicationName": "QB_2021_Open", "ApplicationId": "ece9c6b9-6662-45be-970d-2708603ca13b", "Title": "Application threshold exceeded" }