Hello Splunkers - Can't figure out for the life of me how to use eval or if statement to call a custom search command if an eval returns true. What I am doing is running an eval and testing some values, I would like to run custom command 1 if the statement tests to 1 and another custom command if it tests to 0. Any thoughts? | eval valueToTest=if(isnotnull(statementHere),0,1) | if (1 do customCommand1) | if (0 do customCommand2) ... View more

Hi fellow Splunkers, I'm wondering is someone can tell me how to share a custom command stored within a custom App globally? We have a custom script that takes input, processes it and returns data. I've tried a few things in order to make the command shared globally since we need to run this command within various apps. I get the following error regardless of what we add to the commands or meta files: "Search Factory: Unknown search command scriptNameHere" (restarted the service after every change). The App permissions are set to global which I thought would make the command work within any other app, but that doesn't seem to be the case. Here is what I tried adding to my default.meta. Within my commands.conf file I have 4 custom scripts, I'd like to either make them all global or define the specific command we need to work in all other apps. [commands] access = read : [ * ], write : [ admin ] export = system Any help would be greatly appreciated. ... View more

Hello all, At a loss trying to accomplish the following: I would like to compare three fields in the same index (test index with 1 sourcetype) going back 2 hours and find any/all values that were added/removed or updated from 3 fields between the current hour and the previous. I ingest data in once an hour, so in reality it's just checking for changes between current events and the previous hour. For the most part events coming in should be relative the same with maybe a handful of updates in a 24hr period - meaning it's a static list which gets update when transactions occur. Here is the command I was trying to use to accomplish this. |set diff [search index=tempTest earliest=-1h@h latest=now|fields location, record, status] [ index=search index=tempTest earliest=-2h@h latest=-1h@h fields location, record, status] I however don't get any results although there's definitely a handful of differences. Is there a better way to get a list of differences similar to diff's output. This is another search I tried which got me somewhat closer but it would not detect events where there was a slight update to the event in a given field - for example a digit going from 999883 to 999884 on the record field would not display as a change. I'm also not quite clear on how to show which were added/removed - meaning which were found in the last hour and not in the current hour and vice versa. Any help would be greatly appreciated. | index index=tempTest earliest=-1h@h latest=now | fields location, record, status | eval input="1" | append [search index=tempTest earliest=-2h@h latest=-1h@h| eval input="2" | fields location, record, status |eval input="2"] | stats count by location, record, status, input Example of changes would be as follows: current hour location record status chicago,us S 500 --> changed from A to S chicago.us T 200 sanFan,us A 200 dc,us T 500 uk X 200 ---> changed from A to X and value from 100 to 200 madrid X 900 ---> change added, didn't exist previous run previous hour chicago,us A 500 chicago.us T 200 sanFan,us A 200 dc,us T 500 uk A 100 So what I'd like to see is this in the results previous current change_type chicago-1-500 chicago-S-500 modified uk-A-100 uk-X-200 modified madrid-X-90 added ... View more

Hello experts, I've been banging me head trying to figure out how to best approach this, keep in mind that I'm relatively new to Splunk. Monthly I go through and put together some sales metrics which shows the trends from the previous months. What I've been doing is manually changing the date in my searches and would like to have a more streamlined search that I don't have to update every month. I'm kinda stuck coming up with a way to set each month into their respective monthly group. I have 4 main fields that I pull summary from: acquired sold shipped department What I do is a stats count by the first three fields then group by department First, I run some evals to set which month each event in those fields falls under, then I run stats count to count each one by month - sample search below. initialSearch |eval 1monthaq=if(like(acquired,"2016-11-%"), "Y", null()) |eval 2monthaq=if(like(acquired,"2016-10-%"), "Y", null()) |eval 1monthsold=if(like(sold,"2016-11-%"), "Y", null()) |eval 2monthsold=if(like(sold,"2016-10-%"), "Y", null()) |eval 1monthship=if(like(shipped,"2016-11-%"), "Y", null()) |eval 2monthship=if(like(shipped,"2016-10-%"), "Y", null()) |stats count each of the above by department Since I always run this at the start or middle of the next month, is there an easy way for me to replace each of the 2016-11-% and 2016-10-% wildcards with something like strftime(now(),"%Y-%m") and then just subtract 1 for last month and 2 for 2 months ago from the %m in the date? Or this a better way to do this altogether? Ultimately, what I'd like to do is get a count of each of the fields listed above (acquired, sold, shipped) by department and only include and group events that fall within each of their respective months. sample data: acquired=2016-09-01T01:22:56.000+0000 sold=2016-09-02T14:32:32.000+0000 shipped=2016-09-02T17:21:56.000+0000 department=mobile acquired=2016-09-01T01:22:56.000+0000 sold=2016-09-03T14:32:32.000+0000 shipped=2016-09-03T17:21:56.000+0000 department=parts acquired=2016-10-01T01:22:56.000+0000 sold=2016-10-02T14:32:32.000+0000 shipped=2016-10-02T17:21:56.000+0000 department=mobile acquired=2016-10-03T01:22:56.000+0000 sold=2016-10-04T14:32:32.000+0000 shipped=2016-10-07T17:21:56.000+0000 department=mobile Results I'm hoping for Department 2016-10-shipped 2016-11-shipped 2016-10-sold 2016-11-sold mobile 1 0 0 1 parts 1 0 1 1 Greatly appreciate the help. ... View more

Hello all, Anyone know how to group multiple panels and have them all placed horizontally within one panel? It looks like with the upgrade I did row grouping no longer works. I have a bunch of horseshoe meters that I would like to put in one panel next to each other. When I add the code below it shows each value below one another. I would like to have them next instead of below. <row> <panel> <viz type="horseshoe_meter_app.horseshoe_meter"> <search> <query></query> </viz> <viz type="horseshoe_meter_app.horseshoe_meter"> <search> <query></query> </viz> </panel> </row> ... View more

Hello All, I was wondering how to go about extracting additional objects within my extracted JSON. For example here is a sample of one of my events I'm working with. Each of these key/value pairs are being extracted into their own fields. I would like to pull out additional fields by grabbing specific elements from the extracted fields. { "oderNumber": 23994, "orderDelay": 120, "orderedDate": "2016/03/01 18:47:22", "processedDate": "", "orderDetails": "Account:11111, AccountName:1111-xxx, OrderIpAddress:1.1.1.1", "orderProcessor": "user", "orderErrors": "", "acknowledgedErrors": "", "orderId": { "value": 97655 } } For example; from the orderDetails field I would like to extract Account, AccountName and OrderIpAddress into its own fields. How can I accomplish this? Thanks for the help. ... View more