Hi @fh2020  You can use streamstats command to count the OOC values, like this ...   ... your search ... | streamstats count AS alert_trigger reset_on_change=true BY host OOC | where alert_trigger=2    Here's a run anywhere example using dummy data matching your example table to better show how it works ...   | makeresults `comment("# generate dummy data start")` | eval host=split("A|A|A|B|B|A|A|B|A", "|") | mvexpand host | streamstats count | eval _time=(_time +count) | sort host _time | streamstats count | eval OOC=if(match(count, "[137]"), "NO", "YES") ,value=if(OOC="NO", 1, if(count=9, 5, 3)) | stats values(value) AS value values(OOC) AS OOC BY host _time `comment("# generate dummy data end")` | streamstats count AS alert_trigger reset_on_change=true BY host OOC | where alert_trigger=2   Results:   row    host    _time                                  value OOC alert_trigger 1 A 2020-09-03 19:29:28 3 YES 2 2 B 2020-09-03 19:29:29 5 YES 2   Use where alert_trigger>=2 if you want every instance to trigger an alert event. Hope this helps. ... View more

Hi @mbasharat  I believe you're asking for a regex to just extract the compliance-check-id for the event.  Is this correct?   There are a few ways to do this but if you just want that one field then this will work for you. ... | rex "id>(?<complianceCheckID>[a-fA-F0-9]+)\<" ... Hope it helps. ... View more

Hi @kaeleyt  Append the following to the end of your search query ...   | append [ |makeresults | eval column=split("Row 1|Row 2|Row 3|Row 4", "|") | mvexpand column | table column ] | stats values(*) AS * BY column | fillnull value=0   Here's a run anywhere example with some dummy data which should help demonstrate how it works ...   | makeresults | eval column=split("Row 1|Row 2|Row 4", "|") | mvexpand column | eval date1=48, date2=0, date3=99 | table column date* `comment("# append this to the end of your search query")` | append [ |makeresults | eval column=split("Row 1|Row 2|Row 3|Row 4", "|") | mvexpand column | table column ] | stats values(*) AS * BY column | fillnull value=0    Hope it helps.  Please mark post as answered, if it does. ... View more

Hi @ToniHuynh  If you see no results with the () then I suspect the where clause may be at fault and would start debugging around there.  So...   index=wineventlog EventCode=4660 OR EventCode=4663 Account_Name!="ANONYMOUS LOGON" host="myServer" Account_Name!="*$" | eval ObjectName=urldecode("D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg") | eval ObjectName=replace(ObjectName,"\\\\","\\\\\\") | where match(Object_Name,ObjectName) | table Object_Name ObjectName   If no results then change the where to negate the match, i.e. | where NOT match(.... If you get results now then the match function obviously consider the Object* fields are different so carefully compare each Object column for potential differences.  You may then need to add some more eval statements to make ObjectName exactly align with Object_Name. That's where I'd start anyway.  Hope it helps. Carefully compare the column outputs  ... View more

Hi @ashj  I don't believe this is possible.  The y axis needs to be a number. A possible workaround is to convert the ETA / ETD time data points in to hours as a decimal numbers, e.g. 2:45pm = 14.75 which could then be plotted. Hope this helps ... View more

Hi @willadams  Go back to the source csv file, I suspect that it must have a whitespace value or something so Splunk does not consider it a true null value, as the eval test proves in your example. Here's a run anywhere example of what I mean...   | makeresults | eval test=1, blank=" " , empty="" | foreach blank empty [ eval <<FIELD>>_size=len(<<FIELD>>) ] | foreach blank empty [ eval <<FIELD>>=if(isnull('<<FIELD>>'), "NULL", "NOT NULL") ] | eval empty=null() | appendpipe [ eval test=2 | foreach blank empty [ eval <<FIELD>>_size=len(<<FIELD>>) ] | foreach blank empty [ eval <<FIELD>>=if(isnull('<<FIELD>>'), "NULL", "NOT NULL") ] ]   Results     _time blank blank_size empty empty_size test 1 2020-09-01 17:24:52 NOT NULL 1   0 1 2 2020-09-01 17:24:52 NOT NULL 8 NULL   2 Hope this helps. ... View more

Hi @gauravmsharma  I think you need to read up on what a sourcetype is in Splunk and how it is used and should be used.  It will not help you here and is confusing when used in the context of this question. So for your question So the query remains can be use this initializing line for creating a sourcetype and assign logs to the same sourcetype till it recived a message Killed in the events. The answer is no. From what I can tell you are trying to tie individual events in a log file together, but these individual events have no unique key value to tie then together. Depending on the log content and the order of events in the log, you may be able to tie the individual events together using the Splunk processing language (SPL) with commands like transaction and stats.   Without a good look at the source log data it hard to know though.  If you attach some to this question then may be able to help.     ... View more

Hi @gauravmsharma  I'm not exactly sure what you're asking for here but I'll give an answer a go.  At least it might lead to some better understanding. I don't believe "dynamic sourcetype extraction based on the stanza" entry is something that can be done, or even should be done, if it was even possible in Splunk. The sourcetype determines how Splunk software processes the incoming data stream into individual events according to the nature of the data (ref: https://docs.splunk.com/Documentation/Splunk/latest/Data/Aboutdefaultfields#Source_vs_sourcetype).  It a useful way of grouping similar data sources based on their data format/syntax/structure.   If you could do this then you would also, potentially, have to configure lots of sourcetype entries to tell Splunk how to process the incoming data into events . It does not really matter anyway as you also have the source metadata field, which already contains the function-name (as you call it) in the monitor stanza.  You can extract/manipulate it for every event when you search it. For example     # inputs.conf [monitor:///var/log/test-function_name.log] sourcetype = some_sourcetype     Events found in this file would all be assigned with source="/var/log/test-function_name.log" Now you can use regex or eval functions in the Splunk search language to extract the function_name from the source field's value, e.g.     ... my base search ... | rex field=source "\/(?<func_name>)[^\.]+)" ...     Resulting in all events in the inputs file having a new key value pair of func_name="test-function_name" .  This could also be automated in Splunk's  field extractions so it just happens automatically without specifying it in the search query, Note, I'm just using examples above to show what could be done and you will need to adjust for your own needs. Hope this helps or gives you some ideas.   ... View more

Good point about the search  "Errorcode=*" @bowesmana, unless a "null" string is actually the output value in ErrorCode column.  @irishmanjb, that will change the query I provided.  The eval may need updating depending on the source data. ... View more

Hi @irishmanjb  I think in this case it may be simpler to only look at the previous 10 events and then use a group by clause on the ErrorCode and with reset_on_change to true, as shown ... ... | streamstats window=10 count(eval(if(isnotnull(ErrorCode), 1, null() ))) reset_on_change=true BY ErrorCode | where count=10 ... Hope this helps Also note, from your query, this may fix it ... | streamstats reset_after="("isnull(ErrorCode)")" count ... ... View more

Hi @keyu921  It's not overly clear what you are asking for so I not going to try, however if you want to have an OR statement generated for you base search, from the adhoc.csv file, then you need to use the format command, as shown   ... your search ... [| inputlookup adhoc.csv | fields Account | format] | ...   Substituted result of the subsearch would be   ... your search ... ( ( Account="test1" ) OR ( Account="test2" ) ) | ...     Having said that, more often than not, the use of the lookup command is far more efficient ...   ... your search ... | lookup adhoc.csv Account AS Account OUTPUTNEW <...some new field in adhoc.csv...> | where isnotnull(<some new field>)   Check the Splunk docs for more details, if interested. Hope this helps ... View more

Hi @aditsss  Depending on your needs another approach is to group by Request_URL instead which ensures every Request_URL is listed and does not care if an id is null or not. ... | rex field=Request_URL "\/(?<id>[0-9a-fA-F-]{8,})($|\/)" | stats values(id) as id count by Request_URL   ... View more

Hi @aditsss  If you provide the whole Splunk search query you are currently using and a sample of the raw data/events stored in Splunk (please remove/mask any possible customer or PII data).  Without this then there is no way to really assist as it could be due to many reasons that it does not display.  Though I suspect you are close now and it will be something simple to identify/fix in your search query.    ... View more

Hi @aamirs291  From the sounds of your requirements you'll need to create some sort of state machine logic with lookup files (csv file or kvstore) that can track the "trigger status" of the incoming webhook events and whether they have alerted out from Splunk or not. Based on your example input and requirements, I've of created a run anytime data set to demonstrate the type of state logic.  Adjust the dummydata at the     | makeresults `comment("# create some dummy data - modify data to test")` | eval dummydata="abc|Completed,bca|Queued,cab|Queued,def|unknown" | makemv dummydata delim="," | mvexpand dummydata | eval dummydata=split(dummydata, "|"), Process_Name=mvindex(dummydata, 0), Trigger Status=mvindex(dummydata, 1) `comment("# alert state logic: append previously triggered alert status event and filter out Completed ones")` | inputlookup append=true triggerAlertStatus.csv | fields Process_Name Trigger_Status | stats max(_time) AS _time latest(Trigger_Status) AS Trigger_Status BY Process_Name | where Trigger_Status!="Completed" | table _time Process_Name Trigger_Status `comment("# lookup against Process_Name to see if alert has triggered previously and set pending alert if not")` | lookup triggerAlertStatus.csv Process_Name OUTPUTNEW Alert_Status | eval Alert_Status=if(isnull(Alert_Status), "pending", "triggered") | outputlookup override_if_empty=false triggerAlertStatus.csv | where Alert_Status="pending"   In another search tab run "| inputlookup triggerAlertStatus.csv" command to see how the lookup file changes on each run.     Hopefully it has enough hints to get you going - it will need adjusting to match your data and base search results etc.   Your final search would become your regularly scheduled Splunk alert and every time it runs it would update the lookup file and maintain the alerting status.   There is a detail blog post here too for more background: https://www.splunk.com/en_us/blog/tips-and-tricks/maintaining-state-of-the-union.html Hope this helps. ... View more

Hi @ttovarzoll  Not sure why it is not working but maybe using rename instead is a workable solution to get set the CIDR field.  ... | spath "requestParameters" | fields *.cidrIp *.CidrIp | rename requestParameters.CidrIp AS CIDR requestParameters.ipPermissions.items{}.cidrIp AS CIDR requestParameters.UpdateSecurityGroupRuleDescriptionsIngressRequest.IpPermissions.items{}.IpRanges.CidrIp AS CIDR | eval CIDR=coalesce(CIDR, "not found") | .... Just a thought and hope it helps. ... View more

Hi @aditsss  With any pattern matching regex it is vital that the examples provide all the possible pattern combinations.  It is also important that you make some effort to understand what is being provided by the Splunk community.  Have you tried looking at regex tutorials yet and understand the regex patterns? Both @ITWhisperer & @to4kawa have now provided good answers based on the samples you had provided so far. ITWhisper's needs a slight adjustment to now deal with the new dash (-) character in the new examples you provided, so the matching character set now becomes [0-9a-fA-F\-]+.   I've also added capitals A-F in the set (just in case things change)  and also note that the dash character must be backslashed escaped (\-) as it has special meaning as a range definer in the character set.  So...     | rex field=Request_URL "\/(?<id>[0-9a-fA-F\-]{8,})($|\/)"     So this regex capture group will match any combination of hexadecimal characters and dashes that have a leading forward slash (/) and end with a trailing forward slash or line end of line ($).  It will also match if no dashes are in the id group.  It does not care where in the URL string this combination occurs.  I've also added a string length specify - {8,} - that means it must be a least 8 or more characters long to match, which should help prevent false/positive matches.  to4kawa's answer is also good but not as generic and your Request_URL IDs must have the exact pattern that the regex match is looking for.  Maybe this is the case with your data but based on the changing requirements so far, I'm not to sure. I've attached a screenshot from the https://regex101.com/ site .  Log in (it's free) and have a play with your data set.  It's a great place to learn more about regex and upskill yourself.  Knowing how to use regex in IT industry is a great skill set to have. ... View more

Hi @friskyapple  You are right and you're not able to use automatic lookups chained to further lookups, as an automatic lookup occurs at search time, i.e. the lookup field must exist in the results of your base search. https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Aboutlookupsandfieldactions#Automatic_lookups Couple of possible options: 1. Add the subsequent "lookup" commands into your search query, i.e. run manually 2. Create a new lookup that combines the 3 lookup files into 1 new lookup Would depend on your use case what works best. Hope this helps.  ... View more

Hi @pm771  I think the Splunk docs are not very detailed about this and could be improved, for sure.  I believe it's just python libraries in the Splunk backend so, yes, any valid python strftime() modifiers will work (dependent on the installed Splunk python version). Here's a run anywhere example I tried.   | makeresults | eval epoch=relative_time(_time, "@month") ,date1=strftime(relative_time(epoch, "@month"), "%Y-%m-%d") ,date2=strftime(relative_time(epoch, "@month"), "%Y-%m-%e") ,date3=strftime(relative_time(epoch, "@month"), "%Y-%-m-%-d") ,date4=strftime(relative_time(epoch, "@month"), "%Y-%#m-%#d")   Note the %e has a leading whitespace so stick to either %-d or %#d. Hope this helps.   ... View more

Hi @subhrangshu  Looks like you were getting pretty close.  Try this...   index=test sourcetype="testabc" Perf_Type=Perf* [ | makeresults | eval sre_job_id=replace("$jobID$", "-.*", "") | return sre_job_id ] | ...    Hope that helps ... View more

Hi @aditsss  Based on your examples, the following will work for you.   ...| rex field=Request_URL "([^\r\n\/]*\/){4,5}(connections|groups|services|processors)\/(?<id>[^\r\n\/]+)"    If you need to alter this further, or understand what the regex code is doing, then I suggest a site like regex101 (https://regex101.com/) as a useful place to test and learn about regex code. Hope this helps. ... View more