Hi I have data like below in the Active Directory. Account Name - L-15485 D-5486 BLR-DC-09$ Here is my query; | search "Account Name"="-" showing Output: BLR-DC-09$ but actual output to be expected: L-15485 D-5486 BLR-DC-09$ Note: I read splunk document for -(hyphen) it says - for match any character. Now my question is how to escape that one as it works. ... View more

HI, I have data like below, Source_Address Event_Code Time User 10.10.10.010 4625 6/17/2014 00:12:26 Balaji 10.10.10.010 4625 6/17/2014 00:12:28 Balaji 10.10.10.010 4625 6/17/2014 00:12:30 Kumar 10.10.10.010 4624 6/17/2014 00:12:32 Rajesh In the above sample data 4 events are there So I want to get last row. we have to search based on "time".First 3 times he got failed. Not only 3, its sample data which I mentioned in the above The Failed attempts could be any number if he/she succeed after so many failed logins I have to capture that IP and few fields. Note:4625-Failed to login 4624-logged in ... View more

Hi, I have data like below, Contact_Number---------------Name land="1234" Phone="324"------Kumar land="3254" phone="458"------Ramu Now what i want is Phone number of each and every person like below, Contact_Number---------------Name Phone="324"----------------Kumar phone="458"-----------------Ramu please help me. Note:In the data there are only two fields one is "contact number" and another one is "Name", In the Contact Number there are two fields now i want to extract one field for one Name. ... View more

After converting Dashboard to HTML how to view that HTML in browser as appeared in the Dashboard ... View more

Hi all, Below is my search... source="computer_status_export_SEP12_Mar27.csv" | dedup "Computer Name","MAC Address1" | timechart count("Last time status changed") as count span=1d | sort - _time _time↕ count↕ 2014-03-27 24 2014-03-26 21790 2014-03-25 32439 2014-03-24 4017 2014-03-23 1336 2014-03-22 334 2014-03-21 441 2014-03-20 1540 2014-03-19 1134 2014-03-18 1874 2014-03-17 1363 2014-03-16 760 2014-03-15 261 2014-03-14 253 2014-03-13 698 2014-03-12 684 2014-03-11 541 2014-03-10 473 2014-03-09 425 Now what I want to do is I want add the count after 10 values it means from 2014-03-17 to ending so please help me......... ... View more

Hi I want to write the search like this.. if(file_path=("C:" OR "D:" OR "E:" OR "c:" OR "d:" OR "e:"),"Local",file_path=("\\"),"Network",file_path=(".com" OR ".org"),"Web",USB) Plz help me ... View more

Hi, I have a search and output. source="risks_repor.csv"| dedup "Computer Name" | search D- Output: values count % Cleaned by deletion 10 19.608% Left alone 6 11.765% Deleted 5 9.804% Cleaned 4 7.843% Question: sum as "Some string"="Cleaned by deletion" + "Left alone" sum1 as "Some string1"="Deleted" + "Cleaned" Expected output: Some string Some string1 16 9 ... View more