I asked a previous question about how to get daily sparklines and learned a bit there. But discovered that the resulting sparklines on each row represent the entire data set, not just the (daily) data set for the row. What do I need to to so that the sparkline only represents the day's data? Below are screenshots of what I see. The first one shows the full dataset with a sparkline spanning a week The second one shows the same dataset, with daily summaries. but the sparkline for each day includes blank space for the other days. This makes visual comparisons of trends more difficult. It also increases the amount of data represented by the sparkline so that over a larger dataset, the last data gets chopped off. Query for the first screenshot: | tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic WHERE All_Traffic.dest_ip=134.170.30.203 BY _time span=1m | eval Day=strftime(_time,"%F") | chart sparkline(sum(count),2h) as countTrend sum(count) as Count min(_time) as First max(_time) as Last | eval First=strftime(First,"%m/%d/%y %H:%M") | eval Last=strftime(Last,"%m/%d/%y %H:%M") Query for the second screenshot | tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic WHERE All_Traffic.dest_ip=134.170.30.203 BY _time span=1m | eval Day=strftime(_time,"%F") | chart sparkline(sum(count),2h) as countTrend sum(count) as Count min(_time) as First max(_time) as Last by Day | eval First=strftime(First,"%m/%d/%y %H:%M") | eval Last=strftime(Last,"%m/%d/%y %H:%M") ... View more

I recently noticed that my sparklines may appear to lose data when I make the resolution too fine. For example over the course of a days data, sparkline(sum(count),1h) as countTrend1h will represent the trend OK, but sparkline(sum(count),5m) as countTrend5m will show only part of the results. I think that this is because at a resolution of 1hour, I have only 24 datapoints, while a resolution of 5m has 288. What is the maximum number of datapoints that Splunk can reasonable handler in a sparkline? Also, is there a way to deal with it if I inadvertently exceed that number of data points? ... View more

I am trying to summarize network traffic to or from an IP address. I would like to look for daily patterns and thought that a sparkline would help to call those out. I cannot figure out how to make a sparkline for each day. What I have so far: traffic counts to an IP address by the minute: | tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic WHERE All_Traffic.dest_ip=134.170.30.203 BY _time, All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.dest_port span=1m Which I can summarize over each day with | tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic WHERE All_Traffic.dest_ip=134.170.30.203 BY _time, All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.dest_port span=1m |timechart sum(count) as Count min(_time) as First max(_time) as Last span=1d | eval First=strftime(First,"%m/%d/%y %H:%M") | eval Last=strftime(Last,"%m/%d/%y %H:%M") The initial span of a minute is just there so that I can get 1 minute resolution to the first and last times of each day. I actually use an intermediate time chart so that I can save daily fist and last times | tstats summariesonly=t count FROM datamodel=Network_Traffic.All_Traffic WHERE All_Traffic.dest_ip=134.170.30.203 BY _time, All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.dest_port span=1m | timechart sum(count) as minCount earliest(_time) as minFirst latest(_time) as minLast span=1m | timechart sum(minCount) as Count min(minFirst) as First max(minLast) as Last span=1d | eval First=strftime(First,"%m/%d/%y %H:%M") | eval Last=strftime(Last,"%m/%d/%y %H:%M") So the above gives me a record for each day with the date, number of network events, first network event, and last network event, looking something like: _time..............Count.....First........................Last 2016-12-25....30...........12/25/16 04:25.....12/25/16 23:24 2016-12-26....42...........12/26/16 02:18.....12/26/16 09:14 2016-12-27....430.........12/27/16 03:51.....12/27/16 20:13 2016-12-28....48...........12/28/16 03:51.....12/28/16 10:20 2016-12-29....48...........12/29/16 05:27.....12/29/16 08:23 I would like to add a sparkline indicating how the network events were distributed across the day each day. Can someone help me figure out how to do this? ... View more

My company wants to set up Windows 10 Protected Event Logging for sensitive fields (currently this is only done for Powershell, but Microsoft may choose to use it for other logs as well). Protected Event logging would encrypt protected log events with a public key and then the accessing application would decrypt with a private key. Does anyone know if Splunk can handle Protected Event logs and allow for their decryption as needed? And what it would take to set Splunk up for Protected Event Logging? Things like - how do I add the private key - note the protected fields to decrypt - specify which users get the field decrypted ... View more

Lets say that I periodically get threat data in the forum of reports that contain URLs and IP addresses. I parse these reports and build a list of URLs and IP addresses that I want to add to a lookup table in Splunk so that I can match on the lookup table values in a search. Is there an efficient way for me to do this if I cannon have access to the server? All of the examples that I see say put a .csv on the server or collect the data via a web request. Can I just dump a bunch of comma separated values on a search and use that to load a csv? something like "url1","url2","url3"....|outputlookup mybadurllist.csv ... View more