Hello Splunkers,   I have the following raw data 2023-02-15T12:43:06.774603-08:00 abc OpenSM[727419]: osm_spst_rcv_process: Switch 0x900a84030060ae40 MF0;www:MQM9700/U1 port 29 changed state from DOWN to INIT #012 2023-02-15T12:42:02.861268-08:00 abc OpenSM[727419]: osm_spst_rcv_process: Switch 0x900a84030060ae40 MF0;www:MQM9700/U1 port 29 changed state from ACTIVE to DOWN #012 I am using the below regex   index=abc "ACTIVE to DOWN #012" host=ufmc-ndr* Switch IN(*) port IN(*) | stats count by Switch port | rename count as "ACTIVE to DOWN Count" | appendcols [search index=abc "DOWN to INIT #012" host=ufmc-ndr* Switch IN(*) port IN(*) | stats count by Switch port | rename count as "DOWN to INIT Count"] | sort - "ACTIVE to DOWN Count"     I am trying to count the total events with "ACTIVE TO DOWN" by switch and port and also for "DOWN TO INIT"...If i run the search separately I am getting the correct count but when I join both its not showing correct values . I want to have A table panel with fields Switch port  "ACTIVE to DOWN Count" " DOWN to INIT Count" Thanks in Advance 

I'm logged into my system as an admin, so I have access to all the indexes. I've also verified this by looking at the admin role. It indeed has access to all the indexes. However, when I run the below two searches  I get different counts. I would think I should get the same count. The first one gives me a lower count. It's a pretty low volume dev system so the counts are low. They are different by about 20,000 events. I ran it with a time range of yesterday so that the counts wouldn't change. Does anyone have any thoughts on what could be causing this?   | tstats count ```the count was 95835```   vs   | tstats count where index IN (*) ```the counts was 115339```  

Hi all, I'm working on a dashboard in which I populate a panel with summary data. The summary data runs once per hour over a very large dataset, looking back over the past 60 minutes, generating an | xyseries of response codes across another split by field (field1).  What I'd like to accomplish is to fill the gap in summary data with live data with a subsearch, if possible. Essentially, the panel will be half filled during the gap between summary data. E.G. it ran at 10 AM, and you're looking at 10:30AM. It also functions poorly for small time increments - say 15 minutes. For now, I'm limited by resources and cannot refine the summary index load to run more frequently. I expect this would fix the problem (say, if it ran every 5 minutes). Is it possible to dynamically generate a timeframe for a live search based on when the summary data sees a gap?  Within the panel, I pull summary data like so:  index=summary source="summaryName" sourcetype=stash search_name="summaryName field1=* | stats sum(resp*) AS resp* BY _time | untable _time responseCode Volume ``` this part is just processing to apply the description I need to the response code ``` | eval trimmedCode=substr(responseCode, -2) | lookup responseLookup.csv ResponseCode AS trimmedCode OUTPUT ResponseDescription | eval ResponseDescription=if(isnull(ResponseDescription), " Description Not Available", ResponseDescription) | eval Response=trimmedCode+" "+ResponseDescription ``` since volume is established by the summary index, sum(Volume) here ``` | timechart partial=f limit=0 span=15m sum(Volume) AS Volume BY Response I then append a subsearch here to pull the same info from live data, using another timechart after the processing:  | timechart span=15m limit=0 count AS Volume by Response  ``` presumably here, I would need to sum(Volume) AS Volume to add up the totals``` I looked into some other searches that pull a single event from a summary index, and tried to generate timestamps based on that, but I haven't had much luck. Like so: index=summary source=summaryName sourcetype=stash | head 1 | eval SourceData="SI" | append [| makeresults | eval SourceData="gentimes"] | head 1 | addinfo | eval earliest=if(SourceData="SI",if(_time>info_min_time,_time,info_min_time),info_min_time) | eval latest=info_max_time | table earliest,latest Any ideas? Is this a possibility or am I limited by the summary data?

Hello All, I'm a Splunk newbie and i have 3 questions. In our newly Splunk Deployment we have a Search Head, 1 Deployment Server, 2 Indexers, and 2 forwarders and we are set up in a Distributed environment. Question #1 - Is there a streamlined way or quicker way to setup each server using CLI on both linux and windows.  Question #2 - Do you never need to install apps or add-ons on every server to get all splunk deployment to work? Question #3 - How would i know what add-ons and apps i would need that are important to our deployment? This is a project of mine and time is a factor. Please assist.  Thanks, RPM

Hi, I have the bellow event:   {"log":"2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359               1 connection.go:153] connecting to UNIX:///csi/csi.sock" I need to remove 2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359 and have tried rex but unable to do so, just wondered if someone could help me?   Thanks, Joe

Hello Splunkers, I am trying to create an alert when the log with "UP" state is not received within 15 minutes from the time of "DOWN" state log received. So can anyone help me out... Scenario: When the device is Down the splunk will receive the log from solar-winds that the device is "DOWN" along with the host name in the log. So if the splunk doesn't receive the log that containing the "UP" state from the solar-winds in the next 15 minutes then an alert must be raised. So can anyone help me to create an Query for the alert for the above scenario. Thanks in Advance....

Hi Splunk Gurus,  I am new to lookups and this community has been a great help. I have a few cases where I can't seem to remove rows from a lookup correctly and I can't find a solution for it. I have a lookup table that is used to list maintenance windows on servers. My CSV lookup has 3 columns CI,  chgreq, mStart, and mstop. Example: serverA     CHG0001     2023-02-16 00:00     2023-02-17 13:00 I am pulling in emails from an O365 mailbox that allows the adding and clearing of these maintenance windows. Adding new rows to my lookup is working fine but when I try to remove rows I get a blank lookup. Here is the search I am using: index="maintenance_emails" Clear Maintenance | rex field="subject" "Clear Maintenance for (?<server_name>.+)" | inputlookup append=t maintenance_windows.csv | where CI!=server_name | eval CI=server_name, chgreq=chgreq, mStart=mStart, mStop=mStop | outputlookup maintenance_windows.csv   The server_name field has the correct server name in it and it matches with a CI entry in my lookup. When I run the search I get a blank lookup table. I have done some testing and it looks like my where statement is not working. I appear to also be having the same issue when trying to remove old maintenance window entries from the same table but using values in the mStop column and comparing them to the current date and time. But this may be a separate issue (i.e. with the date/time format or operation). | eval cur_time=strftime(now(), "%Y-%m-%d %H:%M") | inputlookup append=t maintenance_windows.csv | where mStop<=cur_time | eval CI=server_name, chgreq=chgreq, mStart=mStart, mStop=mStop | outputlookup maintenance_windows.csv   Any help would be very appreciated  

Hello Splunk Community,  So I have a table that has results like below   Name                Tom01 Tom02 Tom03 Tom04 Quin01 Yonah01 Yonah02   I want a query that if the text matches before the numeric' s it will only select the 01 and ignore the other ones. For example: IF Yonah01 and Yonah02 exist this is a pair so it will exclude Yonah02 and just have Yonah01  or another one, if there is Tom01, Tom02, Tom03, Tom04 it will exclude everything except for the Tom01. Thank you.