I believe there are many dest in your events. You want to get this report per dest? ... View more

If you have already blacklisted on universal forwarder why do you want to do it at heavy forwarder level. the best recommended way of blacklisting windows events is using universal forwarder. ... View more

There is no such mechanism to identify os type with the logs. You may identify os type based on host if your organization is following some kind of naming convention to distinguish servers and endpoints. or have csv file which contains hostname and os type of hosts which are sending logs. Then you can lookup os type based on host field. ... View more

Your question is not clear with respect to events you shared. Can you elaborate little bit with example. ... View more

Great. You got what you want. ... View more

1. The same app would work in Splunk Cloud also. You should request splunk cloud support to install the TA on IDM (Inputs Data Manager) cloud instance and you can configure like how you configure on Splunk Enterprise.  2. You should create your own app and then give it to Splunk cloud support to go through vetting process and then they will install the TA which you have created. ... View more

ResourceTitle="$dropdown_token$"  OR ResourceTitle="$field1$" ... View more

@to4kawa  answer works only for the data you posted, what if the values gets changed , lets say -2 becomes -3, every time you can't hardcode the value if you don't know the value exactly. ... View more

  I am using inputcsv and outputcsv.  if you run below search that contains field town has same value. | makeresults | eval state="AndhraPradesh,Karnataka,Tamilnadu" | makemv state delim="," | mvexpand state | table state | eval city=case(state="AndhraPradesh","Nellore,Vijayawada,Vizag",state="Karnataka","Bengaluru,Mysore",state="Tamilnadu","chennai") | makemv city delim="," | mvexpand city | eval town="certain value"   and I have written these results to csv to make use of them in search which is used in fields command. The subsearch will take fields which have different values. | makeresults | eval state="AndhraPradesh,Karnataka,Tamilnadu" | makemv state delim="," | mvexpand state | table state | eval city=case(state="AndhraPradesh","Nellore,Vijayawada,Vizag",state="Karnataka","Bengaluru,Mysore",state="Tamilnadu","chennai") | makemv city delim="," | mvexpand city | eval town="certain value" | outputcsv test.csv | fields [| inputcsv test.csv | stats dc(*) as * | transpose | where 'row 1' > 1 | table column | stats values(column) as search delim="," | table search]   ... View more

open /etc/init.d/splunk using any text editor and place ulimits  in between . /etc/init.d/functions and splunk_start() { of file then file should appear like below: . /etc/init.d/functions ulimit -Sn 64000 ulimit -Hn 64000 ulimit -Su 20480 ulimit -Hu 20480 ulimit -Hf unlimited ulimit -Sf unlimited splunk_start() {   And then restart the server to take effect of these changes.   don't forget to upvote if this helps ... View more

can you share some examples? ... View more

It's easy to apply color for values in a column. you have to save the report or add report to dashboard to apply colors to single column like below:   but your requirement is to color entire line based on one field text value, in this case you have to write js and css as mentioned in below answers. https://community.splunk.com/t5/Splunk-Search/Change-the-color-of-rows-in-a-table-based-on-text-value-in/td-p/348021   ... View more

  <form> <label>test</label> <fieldset submitButton="false"> <input type="dropdown" token="state"> <label>state</label> <search> <query>| makeresults | eval state="AndhraPradesh,Karnataka,Tamilnadu" | makemv state delim="," | mvexpand state | table state | eval city=case(state="Andhra Pradesh","Nellore,Vijayawada,Vizag",state="Karnataka","Bengaluru,Mysore",state="Tamilnadu","chennai") | makemv city delim="," | mvexpand city | dedup state | table state</query> <earliest>-15m</earliest> <latest>now</latest> </search> <fieldForLabel>state</fieldForLabel> <fieldForValue>state</fieldForValue> </input> <input type="dropdown" token="city"> <label>city</label> <fieldForLabel>city</fieldForLabel> <fieldForValue>city</fieldForValue> <search> <query>| makeresults | eval state="AndhraPradesh,Karnataka,Tamilnadu" | makemv state delim="," | mvexpand state | table state | eval city=case(state="AndhraPradesh","Nellore,Vijayawada,Vizag",state="Karnataka","Bengaluru,Mysore",state="Tamilnadu","chennai") | makemv city delim="," | mvexpand city | search state=$state$ | dedup city | table city</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset> </form> ---------------------------------------------------------------------- upvote if this is what you are expecting  ... View more

you need time series data to do that.               sample search      index=_internal | timechart count   ... View more

I am using Network Toolkit app for pinging some of my servers and getting the status as "Down" or "UP" and using lookup file I am showing other details of that server such as Area, Location, Data_Port and Time_server. The above you have already got as per the screenshot you have attached. next - > your search  | append [| index=indexwhereyourtimeserver_pingdetails sourcetype=timeserver_ping | table time_server_ip ping_status] | stats values(*) as * by time_server_ip Note: the time_server_ip from your search results and timeserver_ping should match to combine results and show in single table. hope this helps. upvote if this solves your problem   ... View more

double quotes for string. single quotes are used in eval command to identify field names if names contain space or any other special characters. ... View more

do not append all your raw events. you should append processed results from second search. this way you can improve the performance of search. ... View more

Add below search to your dataset. | rex "packages\":\[(?<packages>[^\]]+)" | rex mode=sed field=packages "s/\"//g" | eval packages=split(packages,",") | mvexpand packages | stats count, sum(packages) as sum | table count, sum ... View more

You can first search for both the data sources, lets say you have sourc1 for ping status of servers and source2 for ping status of time_server source1 OR source2 | then your search and apply lookup. ... View more