I couldn't find any documentation except that values(), when used in transforming commands, performs dedup. But there's no official documentation saying that the result is returned or sorted alphabetically. Thanks in advance. ... View more

We got a working solution using saved searches (summary indexer and alert sending email) that does something like this: # Name: our_good_saved_search # Schedule: runs every 30 minutes # Type: Summary Indexing Saved Search # Description: Basically, what below does is it'll get logs from a raw index, put them in a summary index if the same logs aren't in the summary index yet index=our_raw_index sourcetype=our_logs earliest=-5d@w1 | dedup Some, Unique, Fields, | table Some, Unique, Fields, Just, Another, Column | join type=left Some, Unique, Fields [ search index=our_summary_index source=our_good_saved_search earliest=-5d@w1 | eval Excluder = 1 ] | where isnull(Excluder) | eval _time = now() | table _time, Some, Unique, Fields, Just, Another, Column # Name: our_good_email_sender # Schedule: 1,31 * * * * # Type: Alert With Send Email Action # Description: Basically, what below does is when it detects new items, it'll send emails for each of them index=our_summary_index source=our_good_saved_search earliest=-29min@min-1s@s | table _time, Some, Unique, Fields, Just, Another, Column We find it redundant since both are types of saved searches. We're wondering if it's possible that the whole thing can be done by just one alert basically like this: index=our_raw_index sourcetype=our_logs earliest=-5d@w1 | dedup Some, Unique, Fields, | table Some, Unique, Fields, Just, Another, Column | join type=left Some, Unique, Fields [ search index=our_summary_index source=our_good_email_sender earliest=-5d@w1 | eval Excluder = 1 ] | where isnull(Excluder) | eval _time = now() | table _time, Some, Unique, Fields, Just, Another, Column | summaryindex ... Theoretically, the above code is an alert that would Summary index its result Send an email for each result. I've already tried adding the action_summary.index=1 and action.summary_index._name = our_summary_index configs but they're not working. If this is possible, please advise on what I am missing. Thanks in advance. ... View more

I'm working with a date and time field that's causing a headache. I need to parse it to epoch but using strptime(MyInconsistentDateTimeField, "%d/%m/%Y %l:%M:%S") would only work with some of the values in this field. Say I have a date of "January 2, 2019 9:10:10 a.m." below are the possible formats of my field. MyInconsistentDateTimeField 02/01/2019 09:10:10 2/01/2019 09:10:10 02/1/2019 09:10:10 2/1/2019 09:10:10 02/01/2019 09:10 2/01/2019 09:10 02/1/2019 09:10 2/1/2019 09:10 02/01/2019 9:10:10 2/01/2019 9:10:10 02/1/2019 9:10:10 2/1/2019 9:10:10 02/01/2019 9:10 2/01/2019 9:10 02/1/2019 9:10 2/1/2019 9:10 As you can see, only the first item can be parsed using | eval parsedDate = strptime(MyInconsistentDateTimeField, "%d/%m/%y %l:%M:%S") How do I brute force parsing this one? I'm thinking of separating every element of the date using regex, treat them, and then concatenate later on before parsing (e.g. day, month, year, hour, minute would be separate fields). But I don't know how to do it. Thanks in advance! p.s. It's okay to ignore the 10 seconds in this date. ... View more

We have a job which routinely creates an outputlookup containing the time (timestamp) it has completed a successful summary index. We'd like to use this information in a dashboard such that the earliest is max(timestamp) idea: index=some_index_summary earliest=the max(timestamp) from my inputlookup ... View more

This code: | makeresults | eval StartTime = strptime("2018-01-01 00:00:00", "%Y-%m-%d %H:%M:%S") | eval EndTime = strptime("2018-01-01 00:10:00", "%Y-%m-%d %H:%M:%S") | eval Elapsed = EndTime - StartTime | fieldformat Elapsed = strftime(Elapsed, "%H:%M:%S") results to Elapsed=08:10:00 or eight hours and ten minutes, instead of just ten minutes. Would like to get some assistance on why this happens and how to fix. Thanks a lot! ... View more

We're working on an HTML table with <td> that displays value of token (such that <td>$token1$</td> ). We don't know how to remove the token name $token1$ when we deselect from the inputfield. Here's a clearer picture: But when we deselect, the token name appears! How do we solve this? Thanks in advance! ... View more

Newbie here. So, I have learned that there are two types of field extractions: those that happen during the input phase and those that are created on search heads, such as Calculated Fields, Field Aliases, and other field extractions. I'd like to know better if these field extractions happen only during search-time and are RAM-dependent or are permanently disk-written changes made to the index. Like, if I made a calculated field called "Status" today and it works as it expected, then I turn it of (disable or delete) 5 days from now, will the the events today up to 5 days permanently going to consider the "Status" calculated field even if that's already deleted? Thanks in advance. ... View more

Given that we have index=foo sourcetype=bar | table Aaa Bbb Ccc Ddd in a <search> , is it possible to get the (say for example) the 4th row of $result.Ccc$ ? According to Splunk, $result.Ccc$ only retrieves the first row. ... View more

I have a static table on a dashboard-panel. I was hoping someone could help me pass the result from a search into a <td> tag. I have a sample code below (sample only, my working search is much more complicated) | makeresults | eval SomeField = "Hello World" | table SomeField Which results to SomeField Hello World My intention is to pass the result (Hello World) into a cell in my static table, like <td>Hello World</td> . I understand that Splunk's default input fields have this Dynamic Options where you write the search string, choose the field for label and then field for value where you can use its $token$ to pass / append the result into a search string. Can I do the same programmatically on the source code of the dashboard and have the result appear on a <td> or a particular cell of my static HTML table? Is this possible? If so, can I ask for like a working HTML code? Thanks in advance. ... View more

Would like to get some enlightenment on what's the difference between the two. TIA ... View more