Hi I tried to parse the sample without success. Are you sure the sample complies the rules for JSON formatting like the following? { "columnNames": [ "usersession.city", "Browser", "name", "count(duration)", "median(duration)" ], "extrapolationLevel": 1, "values": [ [ "City1", "Browser1", "URL1", 1, 4795 ], [ "City2", "Browser2", "URL2", 1, 9761 ] ] } ... View more

Hi. Is it in JSON format? If it is you could try with spath command. https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Spath https://answers.splunk.com/answers/401942/how-to-parse-my-json-data-with-spath-and-table-the.html ... View more

Hi You could use the following (although it could be optimized a lot more): index=wipscrap OR index=componentscrap Department=D2 | chart sum(Scrap) AS totalscrapdept BY "Scrap Reason Description" | sort - totalscrapdept | eventstats sum(totalscrapdept) as total | eval percent=round((totalscrapdept/total)*100, 3) | streamstats sum(percent) as percent_pareto | fields "Scrap Reason Description" totalscrapdept percent_pareto And then in visualizations select Column Chart, then Format -> Chart Overlay (select the percent_pareto field and View as Axis [On]) Hope it helps ... View more

Have you tried explicitly declaring the receiver ip in the netflowReceiver..ip parmeter under the [streamfwd] stanza in the local/streamfwd.conf file? Once had an instance of Splunk Stream where netflowReceiver..ip=localhost or netflowReceiver..ip=127.0.0.1 would NOT work. https://docs.splunk.com/Documentation/StreamApp/7.1.3/DeployStreamApp/ConfigureFlowcollector Hope it helps ... View more

Hi @TylerJVitale . Have you tried the map command? Although not sure if its optimal to use it in conjunction with the predict command. https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Map ... View more

Check this: https://answers.splunk.com/answers/695347/where-can-i-find-the-service-dependencies-in-splun.html#answer-759898 Basically trythe getservice command. ... View more

For Custom Alert Actions tokens you could use this guide: https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ModAlertsLog#Pass_search_result_values_to_alert_action_tokens https://docs.splunk.com/Documentation/Splunk/7.3.0/Alert/EmailNotificationTokens#Search_metadata_tokens So in your case if you want to pass some field results (lets name it Results_To_Pass) and also the sid of the search, you could put it like this in the UI: Results: $results.Results_To_Pass$ Search Job: $job.sid$ Then the python script would parse this and perform its particular function. If you could provide more info it would be great. Hope it helps. ... View more

Hi Could you provide more info? Cheers!!! ... View more

Maybe with the map command. I will try making an example and check if its possible. ... View more

Yes. As per the doc for transaction states: The transaction command is most useful in two specific cases: When a unique ID (from one or more fields) alone is not sufficient to discriminate between two transactions. This is the case when the identifier is reused, for example web sessions identified by cookie or client IP. In this case, time spans or pauses are also used to segment the data into transactions. In other cases, when an identifier is reused, for example in DHCP logs, a particular message may identify the beginning or end of a transaction. When it is desirable to see the raw text of the events combined rather than an analysis on the constituent fields of the events. In other cases, it's usually better to use the stats command, which performs more efficiently, especially in a distributed environment. Often there is a unique ID in the events and stats can be used. ... View more

Have you tried this: https://answers.splunk.com/answers/2602/can-splunk-filter-match-events-and-bring-back-neighbouring-events-like-gnu-grep.html Hope it helps ... View more

Hi Try without the prestats option (it works as desired for me): | tstats summariesonly=t allow_old_summaries=f count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.action!="unknown") by _time,sourcetype,All_Traffic.action span=1h | `drop_dm_object_name("All_Traffic")` | stats count as total_connections count(eval(action="allowed")) as allowed count(eval(action="blocked" OR action="dropped")) as blocked by _time, sourcetype Hope it helps ... View more

There is an error in the 2 line (if command missing a else case): ... | eval id = if(like(source, "%:ec2_security_groups"), sgid) ... This should be: ... | eval id = if(like(source, "%:ec2_security_groups"), sgid, id) ... ... View more

You could use rename at the end of the search string: .... | rename 0 as Zero_Counter, 1 as First_Counter .... ... View more

Hi The following should do the trick: [^_]+\_(?<extracted_string>.*) Applied to rex (just copy and paste into splunk directly): | makeresults | eval events="bllablla_toni bloobloo_jony" | eval events=split(events, " ") | mvexpand events | rename events as strings | rename COMMENT AS "--- Sample Generated Events Above ---" | rex field=strings "[^\_]+\_(?<extracted_string>.*)" Hope it helps ... View more

Try using this: ... | timechart max(CounterValue) as CounterValue by CounterType limit=0 useother=0 And in visualizations choose Line Chart ... View more

Hi We have some topologies running with many independent Search Heads with diffrent and greater versions than the Indexer Cluster that they are connected to and have experienced no impact whatsoever. It should not cause any problem as far as you have you Independent Search Head with version 7.3.0 and the Search Peers (Indexer cluster) with version 6.5.3. Hope it helps. ... View more

Hi The documentation for Indexer clusters states the following: Compatibility between peer nodes and search heads Starting with 6.3, the peer nodes and search heads can run different versions from each other. The search heads must run the same or a later version from the peer nodes. https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Systemrequirements#Compatibility_between_peer_nodes_and_search_heads You should check this link also. https://answers.splunk.com/answers/484456/using-different-splunk-version-for-search-head-clu.html Hope it helps. ... View more

What error does it show? ... View more

Have you tried killing splunkd first and then its helpers, then make a clean start?: [Server@splunk]/APPLICATIONS/SPLUNK/currentversion/splunkforwarder/bin> ./splunk status splunkd is running (PID: 9634304). splunk helpers are running (PIDs: 18088142). [Server@splunk]/APPLICATIONS/SPLUNK/currentversion/splunkforwarder/bin> echo "Killing splunkd" ; kill 9634304 [Server@splunk]/APPLICATIONS/SPLUNK/currentversion/splunkforwarder/bin> echo "Killing helpers" ; kill 18088142 [Server@splunk]/APPLICATIONS/SPLUNK/currentversion/splunkforwarder/bin> ./splunk start Check the forwarder logs for any errors: [Server@splunk]/APPLICATIONS/SPLUNK/currentversion/splunkforwarder/bin> cd /APPLICATIONS/SPLUNK/currentversion/splunkforwarder/var/log/splunk [Server@splunk]/APPLICATIONS/SPLUNK/currentversion/splunkforwarder//var/log/splunk> tail splunkd.log | egrep "ERROR|WARN" Also check this link: https://answers.splunk.com/answers/238155/splunk-process-compulsion-stop.html ... View more

Hi You could try this stanzas for you sourcetype: SHOULD_LINEMERGE=true BREAK_ONLY_BEFORE = ^\s*host_details\| Hope it helps!!! ... View more