Hi, I tried the below query to fit my model, sourcetype=files command="*cmd.exe*" earliest=-90d@d latest=-1d@d|stats count values(file_path) values(user_name) values(action) by device_name,command...
...ookup host_allIND.csv HOSTNAME as host output SITE DEPARTMENT CATEGORY
| stats max(BootTime) as "Boot time" last(SITE) as SITE last(CATEGORY) as CATEGORY last(DEPARTMENT) as DEPARTMENT by host &n...
...he impact.
So I wanted to use a custom generating command that gives me flexibility to generate the SeviceNow incident with additional fields as parameters. Here is my search (My alert condition i...
...ount bycategory | sort -count
I've tried searching around and trying a few other commands (like useother but can't seem to get it to work out how I want it.
Thanks in advance for any help.
...ourcetype' with the following configuration:
[mySourceType]
DATETIME_CONFIG = CURRENT
KV_MODE = json
AUTO_KV_JSON = true
category = Custom
pulldown_type = 1
The custom command builds a record with the J...
Hello The join comamnd below truncate events because I have results if I execute the ode before the join command but I havent results if I execute the second part Considering that my company dont w...
I have the following scheduled search that updates a lookup (simple_identity_lookup) by adding new entries that aren't already in it.
| datamodel Identity_Management "All_Identities" search
| `d...
...| timechart span=1h sum(value) as total bycategory | streamstats global=f sum(total) as accu_total
http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/streamstats
When I t...