Doing some long-tail analysis and I am running in Fast Mode but the query for 24 hours is taking a long time. Please let me know if there is a way to speed this up. Not that familiar with TSTATS but if there is an option, please let me know. index=wineventlog sourcetype="WinEventLog" |stats count by EventCode TaskCategory | where count<10 |sort count Thanks ... View more

I have a search that calculates a time duration for windows events logon and logout. ....| eval duration=tostring(logoff_time-logon_time,"duration") I get a lot of time values for duration which is 00:00:00 and I would like to drop / remove from the results. What is the best way to remove those values? ... View more

I have a scheduled alert that I need to send to different recipients with different messages depending on the search results, the following is the basic search... index=secApp sourcetype=secApp_json "malware_CB" OR "malware_Obj" |rename alert.occurred as Occurred |stats values(alert.name) as Alert values(alert.src.ip) as SourceIP values(alert.dst.smtp-to) as Recp values(alert.src.host) as Hostname values(alert.src.url) as Attachment-or-Link values(appliance) as Appliance values(alert.smtp-message.subject) as Subj values(alert.src.smtp-mail-from) as Sender values(alert.smtp-message.id) as Msg_ID values(alert.smtp-message.smtp-header) as Header by Occurred |transpose |rename column as Details, row* as occurrence* Now I would like to add a token for alert recipient and a token for alert message... the following is code I crafted for the alert_msg |eval alert_Msg = case (Appliance = USA-emailscan-01, "msg1", Appliance = UK-emailscan-01, "msg2", Appliance = USA-netscan-01, "msg3", Appliance = UK-netscan-01, "msg4") is it possible to use a lookup to populate the message content? instead of adding the message text directly in the eval statement? Thank you ... View more

I am searching the _internal index to find out how much data a universal forward is sending per day. Here is my code (taken from settings>Monitor Console> Forwarders: Instance "Outgoing Data Rate" dashboard) `dmc_get_forwarder_tcpin` hostname=SomeNAME | `dmc_timechart_for_metrics_log` sum(eval(tcp_KBps)) as "KB/s", max(tcp_eps) as "Events/s" Does anyone know the correct syntax to convert this to GB/day? This is my attempt below, is this correct and accurate? I don't think so... looks like I need to sum all the data. `dmc_get_forwarder_tcpin` hostname=SomeName | `dmc_timechart_for_metrics_log` max(eval(tcp_KBps/1024/1024/60/60/24)) as "GB/day", max(tcp_eps) as "Events/s" Thanks ... View more

is there a way to search who has access to an index without having to dig thru the access controls, roles and users? Thank you ... View more

I am working on a matrix of data sources for my splunk deployment. I need to map my data sources -collection method (for example firewalls, DC(s), servers and other appliances) from forwarders or syslog or other log feeds. Many of the data sources were setup prior to my involvement. How would one take on the is challenge and no - forwarder monitoring is not enabled. Thank you ... View more