I have fields for user and URL parsed into splunk from a proxy log and am trying to collate a table which displays me deduplicated users which have visited at least two of four or five URLs. E.G: user1 - URL1, URL2, URL3 user 2 - URL2, URL5 etc... What would be the best way of accomplishing this? I am not sure if I should be trying to transform or just format or something else entirely.

Noob question, can someone pls assist how to get alert when any of the inputs under any TA (Add-on) stops sending logs for last 24 h ?   Lets take Splunk Add-on for AWS as an example.  I have  around 60 inputs configured.  How do i write a search that can alert when either of these 60 inputs stop working ?  if i do a "index=aws" , it shows me various sources and sourcetypes but there isn't any field that has names of these Inputs . We have run into issues that we had to manually enable/disable inputs quite frequently when they stop logging.  

Hi, I need to subtract -30d from earliest, where earliest is counted by token. I tried to convert token result to unix time and subtract unix date counted from token- 2628000 but this doesn't work. The token will use day before today with hour 14:30 or 23:59 so I need to have this exact time for latest to be chosen but I need to look with earliest 30 days ago this exact date and time? index="*" sourcetype="*"  earliest=1669296600.000000-2628000.000000 latest=1669296600.000000 OR index="*" sourcetype="*"  earliest="11/24/2022 14:30:00"-30d latest="11/24/2022 14:30:00"   It is possible, could someone please help? Thank you in advance.  

Hi team, I registered for a free trial and received the corresponding emails containing portal access information and password set-up procedure. The environment was in the process of being set up, but it never got to the end. Neither have I received the connection details to the controller. Could you kindly assist/help? -Igor

I'm trying to create table with the top 5 results split into columns, so that I can have multiple results per line, grouped by date. Here's what I have: |union [search index=Firewall BlockFromBadActor| top src_ip by Date limit=5 | rename count as IPCount] [search index=Firewall BlockFromBadActor| top dest_port by Date limit=5 | rename count as PortCount] | stats values(*) as * by Date | fields Date,src_ip,IPCount,dest_port,PortCount Date src_ip IPCount dest_port PortCount 2022/11/25 1.1.1.1 2.2.2.2 3.3.3.3 4.4.4.4 5.5.5.5 5000 4000 3000 2000 1000 1 2 3 4 5 5000 4000 3000 2000 1000 2022/11/24 1.1.1.1 2.2.2.2 3.3.3.3 4.4.4.4 5.5.5.5 5000 4000 3000 2000 1000 1 2 3 4 5 5000 4000 3000 2000 1000   What I'm trying to get Date IP 1 IP1 Count IP 2 IP 2 Count Port 1 Port 1 Count Port 2 Port 2 Count 2022/11/25 1.1.1.1 5000 2.2.2.2 4000 1 5000 2 4000 2022/11/24 1.1.1.1 5000 2.2.2.2 4000 1 5000 2 4000 I cannot seem to find any way to make the individual query results into new columns.

Happy Friday Splunkers,   We are attempting to on board data from the Salesforce but after reviewing the _internal index we are receiving multiple errors for deprecated functions that come default within the add-on. Has any one else experience anything similar to this or is it possible there is a misconfiguration somewhere?   From the looks of it a python script will need to be modified.       11-25-2022 12:12:48.735 -0500 ERROR PersistentScript - From {/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/Splunk_TA_salesforce_rh_account.py persistent}: return func(*args, **kwargs) 11-25-2022 12:12:48.735 -0500 ERROR PersistentScript - From {/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/Splunk_TA_salesforce_rh_account.py persistent}: /opt/splunk/etc/apps/Splunk_TA_salesforce/lib/solnlib/utils.py:153: UserWarning: _get_all_passwords is deprecated, please use get_all_passwords_in_realm instead.      

When navigating to google_drive_setup dashboard in SplunkCloud, I get the following HTML Error: common.js:1851 TypeError: Cannot set properties of null (setting 'ondragover') at i.setupDragDropHandlerOnElement (eval at _runScript (dashboard_1.1.js:347:86275), <anonymous>:55:32) at i.setupDragDropHandlers (eval at _runScript (dashboard_1.1.js:347:86275), <anonymous>:46:16) at i.initialize (eval at _runScript (dashboard_1.1.js:347:86275), <anonymous>:36:16) at t.View (common.js:1506:229444) at i.constructor (common.js:1851:1033344) at i [as constructor] (common.js:1506:236387) at new i (common.js:1506:236387) at eval (eval at _runScript (dashboard_1.1.js:347:86275), <anonymous>:349:23) at Object.execCb (eval at e.exports (common.js:629:64344), <anonymous>:1658:33) at Module.check (eval at e.exports (common.js:629:64344), <anonymous>:869:55) Since I am on SplunkCloud, I dont have access to create a passwords.conf manually. I am running 9.0.2 SplunkCloud. I don't get any errorlogs in Splunk _internal related to the page. Does anyone have a solution for resolving this? @LukeMurphey?

Hi All, getting following error in splunk: "Events may not be returned in sub-second order due to search memory limits . See search.log for more information. settings: [search]:max_rawsize_perchunk" when i am searching for paticular time range like : 4 to 8 i am getting this error. but if i search for last 15 mins or 24 hours or last 7 days i am not getting the error. I understood : that between 4 to 8 timerange there where lot events coming for one second. 1. below are my  props configured and sample logs: 20221012453012 20220812453012 20220912453012 20220612453012 H1S98765~~PR~;R ESC~AB~Thu Oct 12 12:34:56 IST 2022~B~1.22~2.22~3456.98~GF~4356BV H1S98765~~PR~;Z ESC~AB~Thu Oct 12 12:34:56 IST 2022~B~1.22~2.22~3456.98~GF~4356BV H1S98765~~PR~;M ESC~AB~Thu Oct 12 12:34:56 IST 2022~B~1.22~2.22~3456.98~GF~4356BV H1S98765~~PR~;T ESC~AB~Thu Oct 12 12:34:56 IST 2022~B~1.22~2.22~3456.98~GF~4356BV [logs:health:app] truncate=10000 time_prefix=(?:[^~]+~)~(?:[^~]+~){3} time_format=%a %b %d %H: %M: %S  %Z disable=false max_timestamp_lookahead=75 charset=UFT_8 no_binary_check=true datetime_config=CURRENT should_linenerge=false line_breaker=([\r\n]+)\w{8}~~ annotate_punct=false   2. below are my  props configured and sample logs: [10/07/22 12:55:40"7451 IST] 89786545 medapplog  9[10/07/22 12:55:40"7451 IST-897654] [app=med, sucees=0, failed=10, validpoints=100]  the events are assocuiated with the med application user=app client=med [08/07/22 12:55:40"7451 IST] 89786545 medapplog  9[10/07/22 12:55:40"7451 IST-897654] [app=med, sucees=0, failed=10, validpoints=100]  the events are assocuiated with the med application user=app client=med [10/12/22 12:55:40"7451 IST] 89786545 medapplog  9[10/07/22 12:55:40"7451 IST-897654] [app=med, sucees=0, failed=10, validpoints=100]  the events are assocuiated with the med application user=app client=med [logs:med:app] time_prefix=^\[ time_format=%m %d %y  %H: %M: %S: %3Q  %Z max_timestamp_lookahead=30 should_linenerge=false line_breaker=([\r\n]+)\[\d{1,2}\/\d{1,2}\/\d{2}\s\d{1,2}:\d{2}:\d{2}:\d{3}\s\D{3}\] truncate=99999 please let me know how to avoid this error coming when i search.