hi @khaizercruz, Line-breaking configurations should be done before indexing the logs. So, you need to putLINE_BREAKER in forwarder(s). ... View more

hi @spicy, You can escape special characters using back slash \. You can try this: | makeresults | eval raw_field_example = "$money$ question? help$.. random text" | makemv raw_field_example delim=" " | rex field=raw_field_example max_match=0 "(?<literal_items_I_want>\W?\w+\W?)"   If this reply helps you, a like would be appreciated. ... View more

hi @sureshwalmart, Official Splunk support for versions 7.0.0 and 7.1.2 is stopped now and for 7.3.0 it will end on 22 October 2021.  You should go for Splunk version >= 8.1. The only thing is python3 is mandatory in Splunk 8.1. So you need to plan to upgrade python scripts in your apps if exists. https://www.splunk.com/en_us/legal/splunk-software-support-policy.html#core But if you still want to upgrade, you can upgrade from 7.0.0 to 7.3.0. ... View more

hi @dtccsundar, This might give you what you asked. | makeresults | eval count_of_true=212, count_of_false=313 | eval count=mvzip(count_of_true, count_of_false), count=split(count, ","), Status=split("true,false", ","), zip=mvzip(Status, count) | mvexpand zip | eval zip=split(zip, ","), Status=mvindex(zip, 0), count=mvindex(zip, 1) | table Status, count   If this reply helps you, a like would be appreciated. ... View more

hi @cheriemilk, You need to provide an eval/search expression to the startswith and endwith arguments. index=*bizx_application AND sourcetype=perf_log_bizx AND PID="PM_REVIEW" AND PLV=EVENT AND ACT="AUTOSAVEFORM_*" AND C_ACTV="*commentEdit*" OR ACT="*SendRequest" | sort - _time, CMID, SID, UID | transaction CMID SID UID startswith="ACT=AUTOSAVEFORM_trigReq_AutoSaveForm" endswith="ACT=AUTOSAVEFORM_after_sendRequest" | table _time duration eventcount   More details on here: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction#Filter_string_options    If this reply helps you, a like would be appreciated. ... View more

Hi @PNG, Your query will not work if one of the columns contains blank values in csv file. Try this: index="cisco_ios_config" sourcetype="ApplianceConfigurations:Cisco:IOS" | dedup host | fields - tag, -_raw, - tag::eventtype | rex field=source "\/usr\/local\/rancid\/var\/(?<host_environment>\w+)\/configs\/" | rex field=source "\/usr\/local\/rancid\/var\/\w+\/configs\/\w+-\w+-(?<extra_host_environment_check>\w+)-" | append [ | inputlookup ITSP:Compliance_Settings] | stats latest(_time) as _time, max(*) as * by host_environment,title,setting,must,value | foreach * [ eval field=if("<<FIELD>>"==setting,<<MATCHSTR>>,field)] | fillnull value="Setting not found" field | mvexpand field | eval fail=if(trim(field)==trim(value),if(must=="equal",0,1),if(must=="equal",1,0)) | stats sum(fail) AS "Count" by title | rename title AS "Setting" | eval Status=if(Count > 0, "error", "ok")   If this reply helps you, a like would be appreciated. ... View more

Ho are you onboarding the data? Using universal forwarder or file upload? ... View more

Hi @tsabu, You need to upgrade indexer servers to 8.x. Check this link https://docs.splunk.com/Documentation/Splunk/8.2.2/DistSearch/Distsearchsystemrequirements#Compatibility_between_search_heads_and_search_peers  It clearly mentions A 8.2 search head is not compatible with a 7.3 search peer. If this reply helps you, a like would be appreciated. ... View more

hi @morgantay96, You need to unnest configRuleList, the mvexpand the field and again apply spath on expanded values to get desired results. Try this. | makeresults | eval _raw="{\"configuration\": {\"targetResourceType\": \"AWS::EC2::Volume\", \"targetResourceId\": \"resource123\", \"configRuleList\": [ {\"configRuleId\": \"config1\", \"configRuleArn\": \"removed\", \"configRuleName\": \"config1rule\", \"complianceType\": \"COMPLIANT\"}, {\"configRuleId\": \"config2\", \"configRuleArn\": \"removed\", \"configRuleName\": \"config2rule\", \"complianceType\": \"COMPLIANT\"}, {\"configRuleId\": \"config3\", \"configRuleArn\": \"removed\", \"configRuleName\": \"config3rule\", \"complianceType\": \"NON_COMPLIANT\"}], \"complianceType\": \"NON_COMPLIANT\"}, \"configurationItemStatus\": \"OK\", \"configurationStateId\": 11111111, \"configurationStateMd5Hash\": \"\", \"supplementaryConfiguration\": {}, \"resourceId\": \"AWS::EC2::Volume/resource123\", \"resourceType\": \"AWS::Config::ResourceCompliance\", \"relatedEvents\": [ ], \"tags\": {}, \"relationships\": [ {\"resourceType\": \"AWS::EC2::Volume\", \"name\": \"Is associated with \", \"resourceId\": \"resource123\"}], \"configurationItemVersion\": \"1.3\", \"configurationItemCaptureTime\": \"2021-01-23T06:28:07.415Z\", \"awsAccountId\": \"removed\", \"awsRegion\": \"removed\"}" | spath configuration.configRuleList{} output=configRuleList | spath | mvexpand configRuleList | spath input=configRuleList | table resourceId complianceType configRuleArn configRuleId configRuleName    If this reply helps you, a like would be appreciated. ... View more

TIME_FORMAT=%d-%b-%y %H.%M.%S.%3N %p For more info check: https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Commontimeformatvariables   ... View more

hi @thkwon, You can provide the Home path and Cold path in the UI also. If you don't provide paths, by default home path is set to $SPLUNK_DB/INDEX_NAME/db and cold path is set to $SPLUNK_DB/INDEX_NAME/colddb. In the system, $SPLUNK_DB is set to $SPLUNK_HOME/var/lib/splunk. You can override the new $SPLUNK_DB path/tmp/splunk in $SPLUNK_HOME/etc/splunk-launch.conf file. SPLUNK_DB = /tmp/splunk   If this reply helps you, a like would be appreciated. ... View more

Remove field=f in your query. For field, you need to specify the actual field name that exists in your index dev. Or don't specify if you are extracting values from _raw event. Try without specifying field: index="dev" | rex "\"status\"\s:\s\"(?<status>\w+)\"" | stats count by status  If you have backslashes in your data then, index="dev" | rex "\"status\\\\\"\s:\s\\\\\"(?<status>[^\\\]+)"   ... View more

hi @rkishoreqa, Use rex command. | makeresults | eval f="{\"log\":\" \"status\" : \"END\",\",\"payload\":\"stdout\",\"time\":\"2021-08-13T11:54:17.255787345Z\"}" | rex field=f "\"status\"\s:\s\"(?<status>\w+)\""   If this reply helps you, a like would be appreciated.   ... View more

Try this: index=<provide_index_name> EVDESCR="alarm" | append [ | inputlookup genericlookupname.csv | eval index="mycsvdata" ] | eval Date=coalesce(Date, strftime(_time, "%m/%d/%Y")) | fields index, Date | stats count(eval(index="<provide_index_name>")) as alarms, count(eval(index="mycsvdata")) as acknowledgements by Date   If this reply helps you, a like would be appreciated. ... View more

You're welcome! I'm glad it helped🙂 ... View more

Does genericlookupname.csv has Date field? ... View more

hi @rmakjr0318, Check the examples from Splunk on setting up alerts on this page: Alert examples. ... View more

hi @manojsrms, Try running rex separately: index=*windows* | rex "Account\sName:\s+(?<ModifiedAccountName>[\w]+[\$])" | rex "Account\sDomain:\s+(?<ModifiedAccountDomain>[\w]+)" | rex "Logon\sID:\s+(?<ModifiedLogonID>[\w]+)" | rex "Logon\sType:\s+(?<ModifiedLogonType>[\d]+)"   If this reply helps you, a like would be appreciated. ... View more

hi @Susha, Provide string in double quotes. | makeresults | eval Customer="ABC DEF" | search Customer="*DEF*" ... View more