Below is the code that i have. It is in a table where colors will come up pending on the text that i have. I want to be able to put in TEST_* and not have to define TEST_1 TEST_2 etc... If i put in TEST_* nothing happens. <format type="color" field="Event_Name"> <colorPalette type="map">{"TEST_1":#6A5C9E}</colorPalette> </format> ... View more

Hi I am looking to set a condition match for a drop-down, when a drop-down is selected the host_token is set [for the first time]. Then i want the condition match to pass and set the TPS_ON_ALL_PANELLS. The issue is: do i set the condition match to a * or something else to pick up any value of when the token is set? <input type="dropdown" token="host_token" searchWhenChanged="true" rejects="$SHOW_HISTORICAL_ENVIRONMENTS$"> <label>Data Source:</label> <search> <query>| metadata type=hosts index=mlc_live | fields host</query> <earliest>-1months</earliest> <latest>now</latest> </search> <default>-</default> <change> <condition match="$host_token$ == &quot;*&quot;"> <set token="TPS_ON_ALL_PANELLS">true</set> </condition> </change> ... View more

Hi I am updating a chart drilldown with a token, from "undefined" to "all" to "undefined". <option name="charting.drilldown">$Zoom_ON_POINT_GRAPH$</option> It works great at the start when "undefined" is set, but i can't drill down into the timechart Then i set the token to "all" and again it works, i can now drill down - perfect 🙂 The issue is when i reset the token back to "undefined", the graph does not pick this up and i can still drill down. I have also tied to set it to off... still does not work. I have done this before with below and it works well (I can flip as much as i want to), perhaps there is a difference. SO i am not really sure, if i am missing something here. <option name="charting.axisY.scale">$Log_vs_Linear$</option> ... View more

Hi My company is looking to run a POC on Splunk for sysmon via UDP for a few hundred Unix / Linux machines. Is there already a pre-made app for this? I can find the Microsoft one but i don't think it's the same thing. Thanks in advance. If the POC works, we will need to monitor 5000 machines. Cheers ... View more

I have used this index=_audit action="login attempt" "info=succeeded" | stats count by action , user , _time | timechart span=1d count by user But all the users get put into the same bucket. ... View more

Does Splunk internally know the "number_of_cpus" for the below maths? max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches I have 2 CPU with 10 cores each for 20 cores, Splunk version 6 So, is the following good, or should i change something? [search] batch_search_max_pipeline = 2 base_max_searches = 10 max_searches_per_cpu = 1 max_rt_search_multiplier = 2 ... View more

Hi I am looking for a way to get the number of events from host=ALL with sourcetype=tps. However it looks like i can't. I am looking to display all the host that have a TPS sourcetypes. However the below search is giving me all the events for every sourcetype. Can i refine the search? in bold below is not having any impact | metadata type=hosts index=mlc_log_drop sourcetype=tps | search host=* | rename host as log_drop_name | lookup PROJECT_GROUPINGS.csv log_drop_name OUTPUTNEW project | stats first(recentTime) as time, max(project) as project, first(totalCount) as total_events by log_drop_name | rename total_events as TPS_Events | eval TPS_Events=tostring(TPS_Events, "commas")| sort -time | fieldformat time = strftime(time,"%a, %d %b %Y %H:%M:%S") | head 5001 ... View more

Hi I have a working tstat query and a working lookup query. I am trying to us a substring to bring them together. I want to pass information from the lookup to the tstats. This is the basic tstat. | tstats summariesonly=true avg(All_TPS_Logs.duration) AS Average_TPS ,earliest(_time) as Start, latest(_time) as Stop FROM datamodel=MLC_TPS_DEBUG4 WHERE (nodename=All_TPS_Logs host=EXCESS_WORKFLOWS_UOB) NOT All_TPS_Logs.overflow=true All_TPS_Logs.fullyQualifiedMethod=murex.limits.engine.stream.histo.TPSHistoCounter#COMMIT earliest=10/11/2016:11:00:00 latest=10/13/2016:11:12:00 BY All_TPS_Logs.fullyQualifiedMethod RESULT All_TPS_Logs.fullyQualifiedMethod Average_TPS Start Stop murex.limits.engine.stream.histo.TPSHistoCounter#COMMIT 44215.741873 1473760462 1476302078 I add in the earliest and latest to control the time from the query. (This works) | tstats summariesonly=true avg(All_TPS_Logs.duration) AS average ,earliest(_time) as Start, latest(_time) as Stop FROM datamodel=MLC_TPS_DEBUG4 WHERE (nodename=All_TPS_Logs host=EXCESS_WORKFLOWS_UOB) NOT All_TPS_Logs.overflow=true All_TPS_Logs.fullyQualifiedMethod=murex.limits.engine.stream.histo.TPSHistoCounter#COMMIT earliest=10/11/2016:11:00:00 latest=10/13/2016:11:12:00 BY All_TPS_Logs.fullyQualifiedMethod RESULT (the average has changed as we have moved time on the search) All_TPS_Logs.fullyQualifiedMethod average Start Stop murex.limits.engine.stream.histo.TPSHistoCounter#COMMIT 1121886.932 1476180959 1476302078 However i have multiple of earliest and latest stored in a "lookup". So i want to pass in multiple of them into tstat to give me multiple rows in the answer. Basic lookup (I have them stored in epoc as Start and Stop) | inputlookup Saved_Tests.csv | where Host="EXCESS_WORKFLOWS_UOB" | where Status="GOLD" | eval Start = strftime(Start, "%Y-%d-%m:%H:%M:%S") | eval Stop= strftime(Stop, "%Y-%d-%m:%H:%M:%S") | table MX_Build_ID ID Start Stop RESULT (Average_TPS and All_TPS_logs.fullQualifiedMethod are empty as they need to come from the tstat) MX_Build_ID ID Start Stop Average_TPS All_TPS_Logs.fullyQualifiedMethod 3700334-160923-1106-2100451 259 2016-07-10:19:40:00 2016-08-10:03:16:00 3700334-160923-1106-2100451 258 2016-06-10:17:30:00 2016-07-10:00:00:00 3637272-160804-1733-2013125 215 2016-25-08:17:00:00 2016-25-08:18:37:50 So i need to pass the start and stop from the lookup into the "tstat" and for the tstat to give me back an average for that time period. I have tired to use a substring for this below hower it is not producing any results and i am unsure what is the issue. so i dont know if i should but the tstats first and use the inputlookup as a subsearch or visaversa etc... Below is what i hvae, however i hvae tried many different things,.... | inputlookup Saved_Tests.csv | where Host="EXCESS_WORKFLOWS_UOB" | where Status="GOLD" | eval Start3 = strftime(Start, "%Y-%d-%m:%H:%M:%S") | eval Stop3= strftime(Stop, "%Y-%d-%m:%H:%M:%S") | table MX_Build_ID ID Start Stop Average_TPS All_TPS_Logs.fullyQualifiedMethod | search [| tstats summariesonly=true avg(All_TPS_Logs.duration) AS average ,earliest(_time) as Start, latest(_time) as Stop FROM datamodel=MLC_TPS_DEBUG4 WHERE (nodename=All_TPS_Logs host=EXCESS_WORKFLOWS_UOB) NOT All_TPS_Logs.overflow=true All_TPS_Logs.fullyQualifiedMethod=murex.limits.engine.stream.histo.TPSHistoCounter#COMMIT earliest=Start3 latest=Stop3 BY All_TPS_Logs.fullyQualifiedMethod ] ERROR is = Invalid value "Start3" for time term 'earliest' If i replace start3 with a value is get no row returned | inputlookup Saved_Tests.csv | where Host="EXCESS_WORKFLOWS_UOB" | where Status="GOLD" | eval Start3 = strftime(Start, "%Y-%d-%m:%H:%M:%S") | eval Stop3= strftime(Stop, "%Y-%d-%m:%H:%M:%S") | table MX_Build_ID ID Start Stop Average_TPS All_TPS_Logs.fullyQualifiedMethod | search [| tstats summariesonly=true avg(All_TPS_Logs.duration) AS average ,earliest(_time) as Start, latest(_time) as Stop FROM datamodel=MLC_TPS_DEBUG4 WHERE (nodename=All_TPS_Logs host=EXCESS_WORKFLOWS_UOB) NOT All_TPS_Logs.overflow=true All_TPS_Logs.fullyQualifiedMethod=murex.limits.engine.stream.histo.TPSHistoCounter#COMMIT earliest=10/11/2016:11:00:00 latest=10/13/2016:11:12:00 BY All_TPS_Logs.fullyQualifiedMethod ] o results. ... View more

Hi I have set up a data model and I am reading in millions of data lines. The issue is some data lines are not displayed by tstats or perhaps the datamodel is not taking them in? This is the query in tstats (2,503 events) | tstats summariesonly=true count(All_TPS_Logs.duration) AS count FROM datamodel=MLC_TPS_DEBUG WHERE (nodename=All_TPS_Logs.User_Operations host=EXCESS_WORKFLOWS_UOB) GROUPBY All_TPS_Logs.operationIdentity Result All_TPS_Logs.fullyQualifiedMethod count murex.limits.utilities.cache.statistics.CacheStatisticsTimerTask#publishCacheStatistics 2503 This is the same query in a normal search index=mlc_live sourcetype=tps host=EXCESS_WORKFLOWS_UOB (user=* OR NOT user=*) NOT overflow=true | search name = "*" | eval fullyQualifiedMethod = name."#".operationIdentity |eval duration = endTime - startTime | stats count(duration) as Count by fullyQualifiedMethod This is the result - We get more data! (As expected) fullyQualifiedMethod Count murex.limits.utilities.cache.statistics.CacheStatisticsTimerTask#publishCacheStatistics 2503 murex.risk.control.excesses.service.DefaultExcessService#closeAll 1 murex.risk.control.excesses.service.DefaultExcessService#enlist 408 murex.risk.control.excesses.service.DefaultExcessService#query 10 murex.risk.control.excesses.service.DefaultExcessService#transition 50672 *Data that both normal search and tstats are reading* {"endTime":1474387803162,"startTime":1474387803162,"operationIdentity":"publishCacheStatistics","name":"murex.limits.utilities.cache.statistics.CacheStatisticsTimerTask","context":{"parentContext":{"id":-1,"parentContext":null},"data":[{"value":"BATCH-640@2016-04-13--CountryEERisk-164--ProfileNettingUTable-13067","key":"name"},{"value":"0","key":"hits"},{"value":"0","key":"misses"},{"value":"0","key":"count"},{"value":"4096","key":"maxElements"},{"value":"0","key":"evictions"},{"value":"Default","key":"policy"}],"id":1957}} Example of Data not been picked up by Datamodel {"endTime":1474384787832,"startTime":1474384787777,"operationIdentity":"closeAll","name":"murex.risk.control.excesses.service.DefaultExcessService"} Another one {"endTime":1474387506930,"startTime":1474387505531,"operationIdentity":"query","name":"murex.risk.control.excesses.service.DefaultExcessService"} It looks like the large traces get picked up and the smaller ones dont... Any help would be super 🙂 - Going crazy here. ... View more

Hi I have a situation where i had to change the mgmtHostPort on my forwarder from 8089 to 9089 as it would not start as it said address already in use. When SPLUNK starts is does uses this port for the mgmtHostPort. The forwarder works as it write data to the index on 9997. The question is what is mgmtHostPort used for on the forwarder? https://answers.splunk.com/answers/118859/diagram-of-splunk-common-network-ports.html ... View more