Hi @zacksoft, how about this: sourcetype="super:access" host=xa20hlf** earliest=-7d@d latest=now (date_hour=10 OR date_hour=11 OR date_hour=12 OR date_hour=13) | eval headers=split(_raw," ") | eval resp_time=mvindex(headers,10) | eval resptime_time_seconds=resp_time*0.001| timechart span=1d eval(round(avg(resptime_time_seconds),2)) as avgTime ... View more

Hi @shayhibah, so what you are doing with your first search will split the timechart count by your Source IP. So you basically count e.g. every hour how many Source IPs have been seen and split this value by each unique Source IP. When using AS or as instead of by you are renaming the count field as "src" You are now creating a count of all the Source IPs that where seen in e.g. an hour over time. ... View more

If you look what @harsmarvania57 and I wrote then you can see the difference. ... View more

Also you need to put the regex into the REGEX= field like written above. I See from your config file export that you didn't do that correctly. REGEX=\[(?<action>.*)\] ... View more

@Hi Robbie1194, have you found this presentation from .conf2016 already? There are some architectural ideas and best practices. https://conf.splunk.com/files/2016/slides/deploying-splunk-enterprise-on-microsoft-azure-cloud.pdf ... View more

Hi @mloon, please give us some more information about the state changes you are talking about. Do the state changes happen in the eventdata? We need some sample data before we can help you. ... View more

If you find that developer, kick him in the nuts. ... View more

Hi @codebased, I'm not really sure what the problem is, as you are not going to achieve a count with your regex command. Let me suggest a possible solution: yoursearch | rex mode=sed field=url "s/^([^\/]+\/\/[^\/]+\/[^\/]+\/[^\/]+\/[^\/]+\/)\d+(\/.+)/\1*\2/g"| stats count by url https://regex101.com/r/Ts3HpN/1 It might look a bit cryptic, but it should work for your sample data. Tell me if it helps! ... View more

Hi @shrikant0013, this might not be a problem of splunk, but the problem of your webbrowser. What you describe is actually a problem that already happened with browsers before. Just google "How do I stop name of your browser from refreshing pages constantly? " ... View more

@umdterps02, try out yoursearch | table * You chose the event view, you need the table command to display fields ... View more

Hi @mlevsh, it's weird that there isn't any result. I also don't have a clue why... maybe permissions. I'll provide you a link though how you can resolve orphaned knowledge objects. 🙂 http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Resolveorphanedsearches ... View more

Hi @acsanders, in order to help you further it would be great if you could provide us with the inputs.conf from your Universal Forwarders that are installed on your DCs. ... View more

Did you just steal my link? :horse: ... View more

Hi @gaikarmayur, there is a great talk about that from .conf2016. I've attached the link to the presentation. 🙂 https://conf.splunk.com/files/2016/slides/deploying-splunk-enterprise-on-microsoft-azure-cloud.pdf ... View more

Hi @EricLloyd79, I think there are some problems with proper Event-Line-Breaking, that causes the events to group. http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Resolvedataqualityissues#Event_breaking.2C_or_aggregation.2C_issues ... View more

Hi @prathapkcsc, this might help you. https://answers.splunk.com/answers/91717/timechart-x-axis.html so for your search that should look like this ...| timechart span=15m fixedrange=true ... you need to edit the SimpleXML options of the chart on the dashboard, adding the following: <option name="charting.scaleX">1</option> <option name="charting.axisLabelsX.majorUnit">P0Y0M0DT0H15M0S</option> ... View more

@everynameIwantistaken, Try something like this with your timerange settings. for the Subsearch do earliest=-169h@h latest=-168h@h ... View more

Hi @ronbuzon, sorry for the late reply. Let me fix that solution: | rex field=Message "Attributes:\s*(?<Attributes>.+)" ... View more

Hi @johnward4, how about using a subsearch and an append command for that? index=test sourcetype="test*" User=* Group="HelpDesk" | dedup Tickets | eval State=if(Closed!="0" OR Status="Closed" OR Status="*Reject*" OR Status="Abort*","Resolved","Open") | eval Time=strftime(_time, "%m/%d/%Y %I:%M:%S %p") | rex field=Time "(?<date_month>\d+)/" | rex field=Time "(?<date_year>\d{4})" | append [| lookup datemonth.csv date_month OUTPUT datemonth | search datemonth="August" date_year=2018"] | chart count by User State ... View more

Hi @peiyee422, please provide us with additional data (like actual raw events). I'm not willing to create test data like this on my own. ... View more

I don't think anyone gets what you need help with. Try telling us more about what you want to do or where you need help with. ... View more