Hello, After getting the value from Latency. Just try this: ...|eval Latency=split(Latency," ")|eval l1=mvindex(Latency,11)|eval l2=mvindex(Latency,15)|eval l=l1." ".l2|eval Latency=split(l," ")|mvexpand Latency|sort - Latency But i am not sure whether you want to sort it per event or by time. Just a thought as it's very messy ... View more

I found something. Could you try this search instead of the one you are using. The earliest one is not sending any mail as it doesn't have a condition to match the result. sourcetype="source"|table _time,host,RequestURI|where RequestURI="/ping" Configure this in the alert it will work for sure. Other configurations are correct. ... View more

Could you run this in your search replacing the correct values? sourcetype="source" RequestURI="/ping" |table _time,host,RequestURI| sendemail [email protected] server=smtp_server sendresults=true format=html inline=true Choose a timeperiod where you have result. Let us know if you get the email for the result. ... View more

In which app the alert is configured? Is the Request_URI is an extracted field? ... View more

Emails should be separated by ";" action.email = 1 action.email.cc = abc.abc@com;abc.abc@com action.email.from = abc.abc@com action.email.inline = 1 action.email.sendresults = 1 action.email.to = abc.abc@com alert.digest_mode = False alert.expires = 30m alert.suppress = 1 alert.suppress.fields = host alert.suppress.period = 1h alert.track = 0 cron_schedule = * * * * * dispatch.earliest_time = rt dispatch.latest_time = rt displayview = flashtimeline enableSched = 1 quantity = 0 relation = greater than request.ui_dispatch_view = flashtimeline search = ..... ... View more

It doesn't depend on whether you have 15/20 realtime searches, it's about how it's configured. Are you getting any mail for any of the configured alert? If not these are the possible cause may happen: The sendmail.py file which sends the mail may be corrupt. The alert condition doesn't match any event. The throttling parameter is not the actual field name The SMTP server is not configured correctly. simple way to test from search app: ...| sendemail [email protected] server=smtp_server sendresults=true format=html inline=true test it under http://server:8000/en-US/app/App/flashtimeline ... View more

I would like to know the search and the throttling parameters. The real time alerts work fine, i had struggled with it but i got it worked with precision. So do explain with the search and condition so that we can look at. Probably you can show us in the image. ... View more

Made a change, Could you check and let me know if it's useful? Haven't tried it myself actually. ... View more

Hello Tim, i suppose there are no best practices for using these keywords as they are used for different purpose. e.g. Join can be used if we have common column, where as append we can use anywhere just to combine the result. What's the fields we are having in the first source? ... View more

You actually do as per the splunk documentation, props.conf.example Version 5.0.4 The following are example props.conf configurations. Configure properties for your data. To use one or more of these configurations, copy the configuration block into props.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations. ... View more

Did some changes, please give it a try ... View more

I have updated the answer, Could you please give it a try. ... View more

Best way will be for the weekdays, run it everyday at 8 AM till Saturday morning using cron-schedule with earliest_time = @d-6h latest_time = @d+8h And for the weekend you can do earliest_time=-1w@w6-6h latest_time=@w1+8h ... View more

Hello ChhayaV, The log doesn't have anything to match for the second regex so i can't try with it. The first regex matches the fields which you require. If you want to do on UI, you can do it one field at a time after that save the field or ignore the matches which are not required. ... View more

Use dedup to get only the unique results OR you could only use a search like this: Index=blah sourcetype=blah NOT account_name=""|your search.. Thanks ... View more

How do you know the server is down? I meant is there anything you do to know the status? ... View more

You could use join rather than append. index=asindex source=Prod sourcetype=performance vo!=null lastLap>10000 earliest=-3d@d latest=-2d@d | chart avg(lastLap) as avg_time count by vo | eval key="1st" | fields vo avg_time count key | join host [ search index=asindex source=Prod sourcetype=performance vo!=null lastLap>10000 earliest=-2d@d latest=-1d@d | chart avg(lastLap) as avg_time2 count as count2 by vo | eval key="2nd" | fields vo avg_time2 count2 ] ... View more

Hello, For the concerns you raised there are some explanations which will clear your doubts. For the first part, if you have multiple .conf files with similar definitions as well splunk will then check precedence and take the conf file having the higher precedence i.e. the app folder. The local folder will be considered for the conf files over the default folder if there is any overlap. If it is confusing you can remove the duplicate entries and specify in the local directory of every app not only in forwarder also indexer,search head. You can take a look at this documentation: http://docs.splunk.com/Documentation/Splunk/latest/admin/Wheretofindtheconfigurationfiles Second part, The TA add-on helps you get the information which is pre-configured. Again it does the thing which you can also do manually through conf files i.e. inputs,perfmon,wmi etc.. So you can safely get rid of it if it doesn't help much. The parsing you can do it on indexer/ search head yourself that can be index/search time, doesn't depend on that app. Have a look at props.conf, transforms.conf for more insight. Thanks ... View more

My apologies for the comment before, actually cisco firewall is an add-on more than a app. The Cisco_firewall is a saved search shared across which i found out now after i installed it. If you don't want the reports/views you can go to the CiscoSecuritySuite app and remove the views from the NAV files. Let me know if have any trouble , will happily help you out. ... View more

Answer to question 1 , i am sure the conf files of the app always stays with that app unless you move it. even if they are integrated with other app it's no problem as you may not find the views/data to work with. Second question am not sure why it didn't work. ... View more

Did it work? i am not sure if we can achieve the format you are looking for in splunk search output. ... View more

Are you suggesting the echo.bat doesn't generate your output file in the folder? Did you check if splunk has permission on the folder where the bat file is present? ... View more

delete the app from the folder and restart the instance. ... View more