and from the last startup in previous splunkd log i see this: 08-08-2018 17:03:05.010 -0700 INFO loader - win-service: Starting as a Windows service: will run various system checks first... 08-08-2018 17:03:05.010 -0700 INFO loader - win-service: Splunk starting as a local administrator 08-08-2018 17:03:05.010 -0700 INFO loader - Automatic migration of modular inputs 08-08-2018 17:03:17.464 -0700 INFO loader - win-service: Command pre-flight-checks ran successfully. 08-08-2018 17:03:20.995 -0700 INFO loader - win-service: Command check-xml-files ran successfully. ... View more

there is no user/service account. it was installed using account Administrator. Which is what i used to log into windows system as and then attempt to start. I can stop Splunkd service no problem. ... View more

thx nittala_surya. I've looked for if's and but's so far I can't see where I'm going wrong. Just now I created 2 macros, for example, made one of them Global, then other shared in App. Then went into 'All Configurations', search for my objects and macros (and my lookups) do not appear. I actually see no macros at all in Search app. ... View more

Hi nittala_surya.... I've been assigned super and power roles when set to global; in addition, I have asked one of our Splunk admins to look for the macros and lookups objects and still do not see them under 'All Configurations'. Note, the admin role has 'admin_all_objects' assigned to him. ... View more

Ah, thank you nittala_surya! Is there a Reassign Knowledge Objects option for Macros and Lookups and these object types don't appear in 'All Configurations'? ... View more

I forgot to mention I'm a member of the super user role. ... View more

cool. I will give this a try tomorrow. Will keep you posted and thanks for the quick response! brdr ... View more

Hi Dal Jeanis, I was able to push through my issue using map. going to close this one. ... View more

Dal Jeanis... could I entice you to help me further for 25 Karma points? 🙂 ... View more

No it is not. In my search that makes up the alert I have this as the last line: | table 1 2 3 4 5 6 7 The inline table results I receive via email has them in this order: 7 1 2 3 5 4 6 ... View more

First all, thank you DalJeanis for responding back. And yes, lets remove the map verb please. Question. In Line 2 you have 2 fields; ‘created’ and ‘request.created’. They are actually the same field. So when I coalesce I get no events. NOTE: For clarity, the add_time is a timestamp (actually called timestamp) field shared by all events (i.e. add and remove). In the original second map I’m only interested in a) capturing the remove timestamp and b) carrying the other fields from the original search into the final map call. You are correct the fields you see at the bottom is from myindex2. Sample data from myindex1 looks like this: _time, “add”, timestamp, host1 _time, “remove”, timestamp, host1 _time, “add”, timestamp, host2 _time, “remove”, timestamp, host2 Sample data from myindex2 looks like this: _time, src_user, src_user_name The early and late time (add_time and the offset of add_time) gotten in the first search will be used to find the appropriate event in myindex2 by comparing its _time field. In the end, after some renaming, it is this: | table Account, Name, “Checked Out (_time_from myindex2)”, “Host Targeted”, “Add Time”, “Remove Time” Please let me know if you have any questions. Thank you. brdr ... View more

here is where the search just goes away.... After the last map (going against myindex2) I have the following 2 commands just prior to rename and table'ing the final results results.... | eval check_out_time_ep=relative_time(_time, "+4h") | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(check_out_time_ep) AS check_out_time If I remove these 2 lines the search runs as expected. ... View more

Sure. here is the essential logic for the search(es): index=myindex1 message=”add” | eval early_time=_time | eval late_time=relative_time(_time, "-60m") | sort _time | table early_time late_time created host add_time | map search="search myindex1 “request.created"=$created$ message=”remove”| eval created=$created$, host=$host$, add_time=$add_time$, early_time=$early_time$ late_time=$late_time$ | head 1" maxsearches=100 | sort _time | table add_time remove_time early_time latest_time host | map search="search index=myindex2 (_time > $early_time$ OR _time > $late_time$) | sort _time | eval host=$host$, add_time=$add_time$, remove_time=$remove_time$ | head 1" maxsearches=100 | table add_time remove_time early_time latest_time host | convert ctime(_time) as time | rename src_user as Account, src_user_name as "Name", time as "Checked Out", host as "Host Targeted", add_time as "Add", remove_time as "Remove" | table Account, Name, "Checked Out", "Host Targeted", "Add", "Remove" In terms of the output it is straight forward. Just have account info, date account checked out, host, and add and remove times. ... View more

i forgot the '$' around the my earliest and latest variables in the search.. doh. ... View more

Ah, thanks xpac... This is the change, and now works. rex field=test "(?<Path>^.+\\\)(?<File>[^\\\]+\.\w+$)" ... View more

Hey @jowenssi.... to be specific I was curious if there is a Splunk command, that when passed an argument to it, it would check if there are any binary characters in it. For example, we are presently looking for any malformed file names. I did find this article (using regular expressions) to help me with what I was looking for. Thank you for your answer. https://www.safaribooksonline.com/library/view/regular-expressions-cookbook/9781449327453/ch06s03.html thank you. ... View more

@pfabrizi... Is this for a forwarder or enterprise install? ... View more