Hi Andrew, this is just me guessing, but I would rather expect that splunk treats a summary index different from an event index due to its different nature and behaviour. Since the whole sense of a summary is to reduce the number of events, I expect the sort on the summary to be the lesser evil. Again, there is no "natural" chronology on a summary, because the "chronology" of a summary may seem to be obvious in your case, but in fact is not well defined and differs from one use case to another. Oliver ... View more

Hi Andrew, rethinking your question, your solution might be as simple as adding a | sort _time to your search that retrieves the summary data. ... View more

Hi, to include the script in your dashboard, please check the following: You have included it in your dashboard's simpleXML form tag: <form script="myfile.js"> ... </form> The .js file name is relative to the $SPLUNKDIR/etc/apps/<appname>/appserver/static and the file is in the right place The file has read permissions for the splunk process user You have cleared or disabled your local browser cache You have reloaded the server settings and cleared the caches: https://yourserver:yourport/en-GB/debug/refresh and https://yourserver:yourport/en-GB/_bump If it still doesn't work, maybe you could post your simpleXML and a little more details. Hope it helps Oliver ... View more

Hi woodcock, do you refer to multisearch ? ... View more

It is a known bug when using the base search feature. Please take a look at the "base-search" feature documentation. You can always press the "open in search". Once you have opened it in a new search window, you can export to csv. Alternatively, you could use the outputcsv command: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Outputcsv ... View more

Please create an empty dashboard, edit source and paste the code that I've inserted above. Oliver ... View more

Hi Branden, the solution works fine with AD, provided you get a read-only AD user set up in your AD domain. If you can't get access, though, this page tells you the right messages to get into splunk and look for: https://blogs.manageengine.com/active-directory/2018/08/23/monitoring-service-account-password-changes-active-directory.html Best Oliver ... View more

Sorry, cut & paste error 🙂 forgot to paste the final " ... View more

Hi, please try this: |makeresults|eval IP-Group="{ip1} {ip2} {ip3} {ip4}"|makemv delim=" " IP-Group | mvexpand IP-Group | rex field=IP-Group "\{(?<ipvalue>.*)\} You want to have one event per ip value, because the length of your list is dynamic and there is no other way that comes to my mind to parse a variable number of values from a list. Hope it helps Oliver ... View more

Hi, from a data point of view, join is one of the most expensive operations you can do. If you want to optimise your query without using join, you will have to restructure your data in such a way that it can be avoided. For enriching the events with data that is available and valid at index time, you could consider to include lookups at index time or automatic lookups at search time. If .csv files are too slow for like 1M+ rows of lookup data, check out the kvstore as an alternative or use filtering or advanced lookup features like time lookups. IMHO join was never meant to be a replacement for lookups as it is a totally different operation and unless you actually need the product of two sets of data, should be avoided due to the high complexity of the operation - Oliver ... View more

Hi, to me it appears as if you import csv system snapshots into an index on a regular basis. In your query, I assume that you only need the last snapshot result as a lookup in order to enrich your data with a current status from the last reports. If so, you should consider to replace all of your joins with regular lookups. Best regards Oliver ... View more

Hi, thanks for your help. We finally got this one right and because there have been several people looking for hints on how to resolve this duplicate value issue, we decided to highlight our answer below. ... View more

Hi, this is a very general question and you are looking at a steep learning curve, be prepared to do some reading, testing and learning yourself and please don't get frustrated! You will find that after a few "ah-ha"-moments it will get a lot easier and suddenly make sense. To get you started on your journey: 1. Configure your syslog server so that every host will get his own subdirectory: /var/log/<hostname>/... 2. A sourcetype in Splunk is just a name to a set of parameters in the configurations that help Splunk to tie metadata together. Splunk uses this sourcetype mainly to: Determine event breaking, timestamp and field extraction and transformations of the raw data both at index and at query time. Some well known sourcetypes are "built-in" whereas others need to be defined by you or are predefined inside an app. For Checkpoint logs, please check https://splunkbase.splunk.com/apps/#/search/checkpoint/ There are several apps that define sourcetypes based on CP logs 3. After you have a sourcetype defined, you need to create an inputs.conf stanza to monitor the log files and tie this file to a certain sourcetype that is being defined in the app that you installed or that you have defined yourself. There are ways to ingest all logs with a "dummy" sourcetype and do the actual matching afterwards. However, that method has some tremendous drawbacks and should be considered advanced and its use limited to very special use cases. 4. Lastly, you need to get that inputs.conf file onto your forwarder by copying it into the right directory or by using a deployment server. There is some great documentation on this topic at: https://docs.splunk.com/Documentation/Forwarder/7.3.2/Forwarder/Abouttheuniversalforwarder If you get stuck, please do post a specific question with the error or the problem that you encounter and I am certain, we'll be able to help. - Hope it helps Oliver ... View more

To answer 1: _raw is already set by your own search that selects the events. Just omit the first line of the query and you are good to go. Your own search would likely look like this index=... | ...<the query starting with line 2 from above> To answer 2: Yes, it can be done and it is quite easy from where I left off or taken the answer from woodcock below. The challenge is to think about your problems in a splunky way. There are usually many solutions, all deliver the same results and all having their pro's and con's. Whatever it is, though, Splunk always works on sets of events that have something in common and works either by doing stats on some values inside those events or some statistical analysis on the common characteristics like: Of the n events that show failures, please list the type of failure in percent by failure type/category. My approach above would be the latter: combine all results together and get the number of fails in comparison to the total number. ... View more

Please take a look at the corrected and tested answer above. My apologies: I didn't test with your data the first time I tried. My bad! ... View more

Hi, as stated above, lookup won't help. You could, however, try this one instead, using a join with inputlookup to get your values: ... deleted Plan A that isn't working in this case, as previously I used tokens instead of query fields... let's move to plan B... This time it works, I've just tested it wit the following prices.csv: product_id,effective_start,effective_end,price foo,1560962373,1570962373,66 foo,1570962373,1590962373,69 bar,1550962373,1580962373,96 bar,1580962373,1590962373,99 And this is the query to solve your question: |makeresults | eval product_id="foo" | eval time=now() | join max=0 product_id [|inputlookup prices.csv]|where time>effective_start AND time<effective_end Note: 1. The join is still necessary, because you want one event per match, not one event in total with multi-value fields for price and dates that you would get from a lookup 2. As always, the first line is just to recreate some meaningful data for the join. Exchange with your own query to get the product_id 3. Use your own lookup instead of my prices.csv and for being a lazy typist I omitted the _date in the time names ... View more

Hi orion44, no. If it were somewhere in the GB range, we possibly were onto something. As it is, this should not affect the performance. Still, you could clear the artifacts and see if it makes any difference. ... View more

hi spisiakmi, glad I could help! ... View more

Simply put: Yes. All cluster members must have the same configurations that are being deployed through the cluster-master. Please refer to the Cluster-Management Class and the documentation. In regards to other comments about duplicating data if an app resides on multiple indexers: The only configuration item that influences the redundancy of data is the replication factor that has been defined for the index. Data will only be indexed twice, if some app contains inputs.conf settings that lead to ingesting data in duplicates. Hence the best practice for distributed environments is to keep all inputs.conf separated from the original app and deploy them through the deployment server to forwarders. As a general rule of thumb: only forwarders should have any inputs.conf files in their ./etc tree... unless the special use case calls for an exception. Alternatively the inputs.conf stanzas can be disabled everywhere other than inside the ./etc/deploment-apps/ subdir on the deployment server. ... View more