I would like to say the thing for timestamp extraction. We have props.conf where we can set TIME_PREFIX = MAX_TIMESTAMP_LOOKAHEAD = TIME_FORMAT = which are really useful. If we are extracting a field with the same value as a different field type then we have to extact it with that intention. Proper regex usage will solve the second field extraction. Which ever TIME_FORMAT you mention with the proper values in props will extract the time field. Better you do the test in the GUI then set it in conf files. ... View more

Are you sure its right? It may work for now, but you will not get "BrIPs" ever if the "ArIPs" value is not NULL. Please follow the definition of coalesce carefully. Thanks. ... View more

Try using .css file and follow the float param like other modules. ... View more

You need JAVA SE. Need to setup JAVA_HOME variable properly. Then the JVM param should come automatically when you configure the DB app. Give the JRE path of the installation for the JAVA HOME option. ... View more

Yes it will always return the value of fieldIpA if its not Null at any place. That's the job of coalesce function. if you want both of them then you have to do the below query. table fieldIpA,fieldIpB| lookup LtDes fieldIpA |lookup LtDes fieldIpB as fieldIpA|stats list(fieldIpA,fieldIpB). Lets hope it gives you the result. ... View more

it should be prop.conf I declare IPDes: LOOKUP-< rIP> = LtDes fieldIpA OUTPUTNEW rIPs | eval fieldIpA=coalesce(fieldIpA,fieldIpB)| lookup LtDes fieldIpA | stats list(fieldIpA) please give correct column name in lookup table. Have fieldIpA,rIPs as lookup fields, that should do the job for you. ... View more

Could you share the search query? after the eval fieldIpA=coalesce(fieldIpA,fieldIpB)|lookup fieldIpA as Lookuptable_field should give you the result. ... View more

Are you doing the eval to same field and assigning to itself? Assign it to some other variable if you are using for other purposes. Try doing the lookup after the eval is done and you have the final result for the field. And while calling lookup try to specify the field names e.g. |lookup search_field as lookup_field ... View more

|rex "(?i)(?P \d+:\d+:\d+.\d+|\d+:\d+:\d+.\d+)|" |eval t=split(temp,"|")|eval starttime=mvindex(t,0)|eval endtime=mvindex(t,1)|table starttime,endtime. Another approach... ... View more

source="source_name" "Error"|stats count if its no separate event set props.conf SHOULD_LINEMERGE=false and start re-indexing your data/ use mvexpand command to get the fields separated as it will hard to find exact stats from a multivalued field. Done!! ... View more

If you want to set a value by default and that's default you can use pulldown module's static fields to display parameter. If the result may come again from the search query you can put a NOT "value" in the search. Hope i understood your requirement. ... View more

You can with your default splunk web access port. which is by default 8000. Splunk authenticated user will be able to access through this. Others can use SSO like you have configured. ... View more

I guess it's not possible. You can assign one user, admin privilege. the local admin can access through splunk web default port. As LDAP will not find any name "admin" in your groups i suppose it's not possible. ... View more

Please provide sample log. ... View more

Thank you for the reply. I was talking about the indexers where its acting as search peers. If i create an index i have to restart the splunkd service alone in that particular server. Will the "splunk reload deploy-client" command able to do the job for me? ... View more

Could you check whether your _internal index has the historical data for anything for that period? You can also try this search to get the usage. index=_internal source="license_usage." |eval GB=b/1024/1024/1024)|rename GB as Usage_Stats ... View more

eval t=mvzip(event,AVG)|eval z=split(t,",")|eval event=mvindex(z,0)|eval avg=mvindex(z,1)|table _time,event,avg i am not sure where you need to apply mvexpand as i dont have the same records with me ... View more

Could you try this your search query|where NOT [|inputcsv file.csv] in file.csv contains User_Name,Image_File_Name list. Please give it a try. ... View more

Could you try mvzip(event,Avg),Split to two different fields,mvexpand then create a table on _time,event,Avg? See if gives you any chart on splunk search app.. ... View more

Yes you can put replace command , but count it first then apply the case/replace command. You can do a column chart to show your stats. Thanks e.g. host="*" source="/home/abc/tomcat/logs/app_error_log.txt" chart count by host| eval teamname=case(host="1234", "abc", host="5678", "def") |fields teamname,count ... View more

round takes 2 arguments eval average_risk = round(average_risk,2) | eval average_target = round(average_target,2) ... View more

If everytime its the same port number it will not create an issue if we actually ignore one value , but if its different it should be a problem. To the solution part , from my point of view we should work on to extract that field with a different name like T_port or like that. ... View more