I have asset list associated with ES. Now I want to remove the assets from the list if they are not reporing more than 60 days.
I have inital query in my mind as below:"
| inputlookup asset_...
I have a lookup file that contains two columns, ip and mac. I want to update this file daily by running a query that catches when either a new device is added or an existing device is moved. My q...
...anaged to push the update to 8.0 to 2 of these servers: the deployment server and the search head. This means that our cluster master and our indexers are still on 7.3.2.
What's the best way to get e...
I have a table in my dashboard and the values are updated in JS. For example, if row 1 has the value "DOWN", then row 5 might be affected and it should be updated to "PARTIALLY DOWN".
After the v...
Hi,
I am new to Splunk and working on some basic queries and in need of some help. I am working on a dashboard for Windows updates. As part of this dashboard I am looking to show the patches t...
How to change this search to show Unsuccessful/Failed Windows Updates?
sourcetype=WinEventLog:System EventCode=19 | eval Date=strftime(_time, "%Y/%m/%d") | rex "\WKB(? .\d+)\W" | eval s...
Hey Splunkers,
I have a few dashboards I'm running that we want to update ever 2-5 minutes, but we don't want to utilize a real-time search.
These dashboards are being displayed on a m...
Hi Experts,
I'm trying to build a lookup table that will update based on the latest time a user logged into a particular application. Ideally, it has a few tracking columns at the end to track l...