Hi all, I  would like to know how to write a SPL code to solve the issue that is to pick the scenarios follow the 3 logic.  (1) pick the Scenario_IDx whose time tag is later than its previous Scenario_IDy. (x is bigger than y) Any Scenario_IDx whose time tag is ealier than its previous Scenario can be ignored. Ex. Scenario_ID1 time tag should bigger than Scenario_Start. (In Ex.1: Scenario_ID1: 103 > Scenario_Start: 101) Scenario_ID2 time tag should smaller than Scneario_ID1 and Scenario_Start. (In Ex.1: Scenario_ID2: 104 >Scenario_Start: 101 and Scenario_ID2: 104 > Scenario_ID1: 103) (2) If there are multiple same scenario later than previous Scenario time tag, pick the one with the earliest time tag. Ex. Take Ex. 2 as an example. For Scenario_ID3, pick Scenario_ID3: 204 only.  Scenario_Start: 201  Scenario_ID1: 202   Scenario_ID2: 203  Scenario_ID3: 204  Scenario_ID3: 205      (3) If for the Scenario_IDy, there is no Scenario_IDx later than Scenario_IDy time tag. Then no need to list anything for Scenario_IDx. (x>y) Ex. Take Ex. 3 as an example. All time tag of Scenario_ID5 is earlier than the one of Scenario_ID1.  So in "Expected sequence", no need to list Scenario_ID5. Here are the sample original scenario sequence, the corresponding information sequence and the expected scenario sequence and the corresponding information sequence as well. Both of them are multi-value fields. Does anyone have suggestion on SPL code to compose the "Expected sequence" and "Expected information sequence" output?   Example no.  Original sequence (in time tag) Original information sequence (in time tag) Expected sequence (in time tag) Expected information sequence (in time tag) 1 Scenario_Start: 101 Scenario_ID1: 103 Scenario_ID1: 105 Scenario_ID2: 102 Scenario_ID2: 104 Scenario_Start_info:AAA  Scenario_ID1_info:BBB Scenario_ID1_info:CCC Scenario_ID2_info:DDD Scenario_ID2_info:EEE Scenario_Start: 101 Scenario_ID1: 103 Scenario_ID2: 104 Scenario_Start_info:AAA  Scenario_ID1_info:BBB Scenario_ID2_info:EEE 2 Scenario_Start: 201  Scenario_ID1: 202   Scenario_ID2: 203   Scenario_ID3: 204   Scenario_ID3: 205  Scenario_Start_info:AAA  Scenario_ID1_info:BBB Scenario_ID2_info:CCC Scenario_ID3_info:DDD Scenario_ID3_info:EEE Scenario_Start: 201 Scenario_ID1: 202   Scenario_ID2: 203   Scenario_ID3: 204   Scenario_Start_info:AAA  Scenario_ID1_info:BBB Scenario_ID2_info:CCC Scenario_ID3_info:DDD 3 Scenario_Start: 301 Scenario_ID1: 305 Scenario_ID5: 302 Scenario_ID5: 303 Scenario_ID5: 304 Scenario_Start_info:AAA  Scenario_ID1_info:BBB Scenario_ID5_info:CCC Scenario_ID5_info:DDD Scenario_ID5_info:EEE Scenario_Start:301 Scenario_ID1:305 Scenario_Start_info:AAA  Scenario_ID1_info:BBB Thank you so much.

Hello Splunkers! Does anyone know about async_saved_search_fetch setting? Splunk Documentation says, do not change the setting but want to know what this is.  async_saved_search_fetch = <boolean> Enables a separate thread that will fetch scheduled or auto-summarized saved   searches asynchronously. Do not change this setting unless instructed to do so by Splunk support. Default: true   How should I fix this issue?   Thank you for your work will be provided. 

Hi, if I had logs as such wirn different type data in the same sourcetype: "<134>Nov 23 21:23:17 NSX-edge-7-0 loadbalancer[2196]: [default]: 154545"   "<4>Nov 23 21:06:47 NSX-edge-7-0 firewall[]: [default]: ACCEPT" How can I extract thew value after "[default]: " without extract null values???? For example, if in the first event I created a field called "FIELDA=154545", i dont want the value in the second event it to be "ACCEPT", I need to create second field called "FIELDB=ACCEPT" I hope to have made me understand  Regards,

Is there a way to achieve this?   I have  a lookup table with 2 columns alert_type and short_description.   alert_type | short_description cpu              | "The Host".host."cpu utilization is high".cpu_perc."%" mem            | "The memory in the host ".host."is high with a percentage of ".mem_perc."%"   When alert type matches it should return short_description and the fields in the short description should replace with field values( host,cpu_perc and mem_perc)   Example : The Host abcd.com cpu utilization is high 90 % instead of a string "The Host".host."cpu utilization is high".cpu_perc."%"  

Hello, I have questions about my fire brigade installation, but I noticed the last questions on fire brigade are from 2016, and it shows as not supported on splunkbase. Is firebrigade dead?  if so what replaced it? --jason  

below is the value of a field.   what i would like to do is do a regex where i would output node# + temperature.   example output:   Node0_temperature=26 degrees C / 78 degrees F Node1_temperature=29 degrees C / 84 degrees F   thanks, node0: -------------------------------------------------------------------------- Routing Engine status: Slot 0: Current state Master Election priority Master (default) Temperature 26 degrees C / 78 degrees F CPU temperature 41 degrees C / 105 degrees F DRAM 98254 MB (98304 MB installed) Memory utilization 4 percent 5 sec CPU utilization: User 0 percent Background 0 percent Kernel 4 percent Interrupt 1 percent Idle 95 percent node1: -------------------------------------------------------------------------- Routing Engine status: Slot 0: Current state Master Election priority Master (default) Temperature 29 degrees C / 84 degrees F CPU temperature 41 degrees C / 105 degrees F DRAM 98254 MB (98304 MB installed) Memory utilization 4 percent 5 sec CPU utilization: User 0 percent Background 0 percent Kernel 2 percent Interrupt 0 percent Idle 98 percent  

Hi, I am having a local minikube Kubernetes cluster set up. Furthermore, I want to setup the Splunk App for Data Science and Deep Learning, to be able to interact with my local Kubernetes Cluster. On the setup page, I provide the information in the input field as shown in the screenshot below. For the Cluster CA, Cluster Certificate and Client key, I am using the contents of the files in ~/.minikube/certs . When I click the "Test & Save" button, I receive the following error message:  Exception: Could not connect to Kubernetes. HTTPConnectionPool(host='10.96.143.124', port=80): Max retries exceeded with url: //version/ (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f391087acd0>: Failed to establish a new connection: [Errno 110] Connection timed out'))  I know that this means Splunk is having troubles connecting to my local cluster. But unfortunately I feel I reached a dead end, and I am not sure how I can fix this issue. Any help on this would be greatly appreciated!   PS: Here is a screenshot of the error message: