<option name="drilldown">cell</option> <drilldown> <condition field="sourcetype"> <set token="sourcetype">$click.value2$</set> </condition> <condition field="*"> </condition> </drilldown> The above code let user to drilldown only on field "sourcetype". The remaining fields will be clickable but no action will be taken because of "field=*" ... View more

@VijaySrrie  There is a problem with URL generated by sendemail alert action. The URL which is generated by sendemail is not matched with the actual URL of results of your job.  you might be seeing something like below in your view results link generated by sendemail alert action (not working)   https://localhost/app/SplunkEnterpriseSecuritySuite/@go?sid=scheduler_aGVscGFnX2J0aGFtYmlzZXR0eQ--SplunkEnterpriseSecuritySuite--RMD5d9601e54d98432f3_at_1629087420_8139   The actual URL should be like below (working)   https://localhost/app/SplunkEnterpriseSecuritySuite/@go?sid=scheduler_aGVscGFnX2J0aGFtYmlzZXR0eQ__SplunkEnterpriseSecuritySuite__RMD5d9601e54d98432f3_at_1629087420_8139     if you had closely observed the two URLs, -(hyphens) are replaced with _(underscore).  As a workaround, try replacing -(hyphens) with _(underscore). It should give you the results if the job is not expired. ... View more

@scottfrandsen  May I know what exactly you have done to fix the issue? ... View more

small correction:  if the application contains -(hyphen) then the regex from your search is not matching. for example application applications.Splunk_TA_bit9-carbonblack.stateOnClient I would suggest using below regex that will capture first . (period) to next .(period) applications\.(.*)\.stateOnClient ... View more

2021-04-02 14:44:05,821 INFO pid=7784 tid=MainThread file=base_modinput.py:log_info:295 | metric=log | message=_okta_caller n_val does not match our valid pattern with 0 results, store the current URL: https://[redacted].oktapreview.com/api/v1/logs ... View more

| sort ENVIRONMENT The below example is run anywhere : | makeresults | eval ENVIRONMENT="STAGE_INT,STAGE_QA,STAGE_INT,STAGE_PERF,STAGE_QA" | makemv ENVIRONMENT delim="," | mvexpand ENVIRONMENT | sort ENVIRONMENT ... View more

I don't think the new features released by servicenow will affect the Splunk add-on for servicenow. The features are used in TA are very limited to Splunk & Servicenow. you can install on test Splunk machine and try integrating.  ... View more

How did you open lookup in app context ?  who is the owner of lookup? has the lookup been migrated from old search head to new search head ? you should change the permissions in lookups knowledge object found in settings. If there is definition for the lookup you should change permission in lookup definition also.   ... View more

Did you try : | inputlookup <yourlookupname> ... View more

FYI - earliest=-30d and span=1s will produce 1 day = 86400 seconds * 30 days = 2,592,000  tstats will limit results to 50,000 hence the output of the search will truncate results. ... View more

@alexspunkshell  what kind of input are you referring above. is that monitor or network or script? ... View more

@Azeemering  The one you mentioned is neither supported by developer nor Splunk support. what exactly are you looking for? Are you looking for o365 defender TA  ? do you want to  just collect Microsoft/windows defender agent logs installed on endpoints from cloud? if you are looking for second  2  then you can try my TA link shared in my first response. ... View more

@MittalKamal  what is your rising column? are events overwritten in 5 minutes in DB?   ... View more

@Azeemering  There are couple of TA around this subject.  can you share TA URL? I have also developed one ... View more

@vamsigurram  Try moving one user object from UI and check in below two log files if you see any GET/POST requests: /opt/splunk/var/log/splunk/splunkd_ui_access.log /opt/splunk/var/log/splunk/web_access.log ... View more

@k31453  I believe you are looking for below: Note: you can only index _internal logs using this method. https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad#Selective_indexing_and_internal_logs   ... View more

@rahuljchavan  you can try below: Query will display error & success percentage both. | rex field=_raw "(?ms)^[^\"\\n]*\"(?P<http_method>\\w+)\\s+((?P<path>/[a-zA-Z0-9-_/=]*).*) (?P<http_ver>[^\"]+)\"\\s+(?P<status_code>\\d+)" offset_field=_extracted_fields_bounds | rex field=_raw "(?ms)^[^\"\\n]*\"(?P<http_method>\\w+)\\s+((?P<path>/imgproxy/*).*) (?P<http_ver>[^\"]+)\"\\s+(?P<status_code>\\d+)" offset_field=_extracted_fields_bounds | eval endpoint=http_method." ".path | where like(path, "/info%") OR like(path, "/status%") OR like(path, "/imgproxy%") OR like(path, "/error%") OR like(path, "/rest/suite/%") | eval result=if(status_code>299,"error","success") | stats count count(eval(result="success")) as success_count count(eval(result="error")) as error_count by endpoint | eval error_perc=(error_count/count)*100,success_perc=(success_count/count)*100 | table endpoint,error_perc,success_perc ... View more

@ddelmont  yes, you can define field which you would like look up against field from lookup table. Fields mentioned after output/outputnew are output of matched field. why do you want to define variable in output? ... View more

@jaibalaraman  You need to identify distinct useragent formats to develop regex which will match 100% events. For example if you look at below two events: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Mozilla/5.0 (Linux; Android 8.1.0; CPH1851) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Mobile Safari/537.36   you don't have same fields you have mentioned in your regex for the second event above. If one regex is not going to match 100% events then you might need to create os1,os2 and then you need to coalesce all fields into  one field "os". you need to do same thing for other fields as well. ... View more

@rahuljchavan  can you post your query here. ... View more