Great! Happy to help! ... View more

I thought this question was dead, too! 1) When Excel saves files to CSV, there will be a comma between the fields. I stated what I did only because there were spaces delimiting your fields in your sample file. 2) No, sorry, I think you misunderstood my "final SPL". You would not need to list out all of your CIDR notations in the SPL, only in the CSV. Once you get your CSV in good shape and the lookup configured in Splunk, line 11 ( | lookup priv_ip_lookup IP OUTPUT Application) is the only line you need to worry about in your SPL. I'll start watching this question a little more closely! rmmiller ... View more

@Shashank_87, is your expected output is supposed to look like this? temp count /review-basket 3 /review-basket 3 /review-basket 3 /check-your-details 1 ... View more

And if that's the case, what is the output of your first and drill down queries supposed to look like? ... View more

You mean Error1 is a medium as long as there are not more than 250 within a 30 minute time period? ... View more

@i17065 did this solve your problem? ... View more

@prettysunshinez, did this solve your problem? ... View more

Ah! Now it makes sense. Amending my answer. ... View more

Your base search: index = <details of your search> | regular expression to catch error max_match=0 | mvexpand error | lookup lookupfile_name error outputs Description Comments Threshold | stats count BY Description,Threshold,Comments | eval Comments = case(count > Threshold AND lower(Comments)=="high","Critical(Upgraded)",count > Threshold AND lower(Comments)=="medium","High(Upgraded)",count > Threshold AND lower(Comments)=="Low","Medium(Upgraded)",1==1,Comments) | table Comments,count You need to include the threshold value as output from your lookup command then compare the counts against the threshold. Unfortunately, you have to build your own translation from one value of Comments to the next (upgraded), but we can do that with the eval / case command. Note: I took the liberty of adding some insurance against your Comments fields maybe not always having the correct Capitalization. Step 1: Change your lookup command to include the threshold value: | lookup lookupfile_name error outputs Description Comments Threshold Note I've included "Threshold" as an output field. Step 2: Use stats to compute the count per Name, Comments and Threshold | stats count BY Description,Comments,Threshold This will tally all the errors up, split by Name, Comments, and Threshold. Step 3: Compare each count against the Threshold value: | eval Comments = case(count > Threshold AND lower(Comments)=="high","Critical(Upgraded)",count > Threshold AND lower(Comments)=="medium","High(Upgraded)",count > Threshold AND lower(Comments)=="low","Medium(Upgraded)",1==1,Comments) This command upgrades the Comments value if the count is greater than the Threshold value. If count is equal to or less than Threshold, there is no change in the value of Comments. Step 4: Display the interested fields in a table showing the Comments and count: | table Comments,count This just displays the Comments and count fields in a table, from which you can click to drill down to your next search. Doing another stats count here will yield incorrect results. You have already run stats, so just show the interested fields. Your drill down search: You are pretty close with your attempt; you just need to add in the logic that addresses the threshold violations. index = <details of your search> | regular expression to catch error max_match=0 | mvexpand error | lookup lookupfile_name error outputs Description Comments Threshold | stats count BY Description,Threshold,Comments | eval Comments = case(count > Threshold AND lower(Comments)=="high","Critical(Upgraded)",count > Threshold AND lower(Comments)=="medium","High(Upgraded)",count > Threshold AND lower(Comments)=="Low","Medium(Upgraded)",1==1,Comments) | search Comments=$selectedcomment|s$ | table Description,count This assumes your drill down token is named selectedcomment. Note there's a pipe and an extra s here -- it tells Splunk to put double quotes around the value of this variable when running the search as a drill down. Mocked-up Data Some run anywhere SPL to help make sense of this using randomly-generated data is below. You can ignore this unless you want to learn more about how this works. Sometimes you might get no results, but it's only because of the randomness. Remove the search clause to validate the logic, if interested. | makeresults count=50 | eval raw=split("SplunkForwarder,SMTP_Server,WWW_Publishing,Server,Workstation",",") | eval comm=split("Low,Medium,High,Low",",") | eval thold=split("15,10,5,10",",") | eval Random = random()%4 | eval Description=mvindex(raw,Random) | eval Comments=mvindex(comm,Random) | eval Threshold=mvindex(thold,Random) | fields - raw,comm,Random,thold | stats count BY Description,Threshold,Comments | eval Comments = case(count > Threshold AND lower(Comments)=="high","Critical(Upgraded)",count > Threshold AND lower(Comments)=="medium","High(Upgraded)",count > Threshold AND lower(Comments)=="low","Medium(Upgraded)",1==1,Comments) | search Comments="High(Upgraded)" | table Description,count Hope that helps! rmmiller ... View more

Another clarification: For your example drill down when Comments="Medium" -- do you want that drill down to include Medium(Upgraded)" also? Or only the "native" Medium, regardless of Threshold violation? ... View more

You don't have a Comments column in your last lookup result. Was that just an omission? ... View more

OK, after taking a careful look at your other question, I think the approach is still largely the same. 1) Pull all results back in a single query 2) Use an eval statement to distinguish folders from systems. 3) Use stats to aggregate/correlate your systems and folders events. Amending my answer now. ... View more

If I understand your data and intent correctly, this should do the trick: index=email MID= | stats values(subject) AS Subject, values(recipient) AS recipient BY MID | where NOT isnull(mvfind(Subject,"Password Expiring Soon")) Joins are painfully inefficient and can usually be avoided using stats and filtering after aggregation. This is definitely one of those instances. Hope that helps! rmmiller ... View more

Fiendishly clever! ... View more

One of the best examples of using xyseries I've ever seen! Bravo! ... View more

What does the transaction command that's producing these results look like? ... View more

I don't see where these other field names are coming in. They weren't part of your original query. Is this a duplicate of your other question here? https://answers.splunk.com/answers/813580/how-can-i-create-a-key-for-two-searches-and-combin.html ... View more

Answer: index="vmware-inv" (sourcetype=vmware:inv:vm OR sourcetype=vmware:inv:hierarchy) | fields + _time, changeSet.name, moid, changeSet.summary.runtime.host.name, changeSet.storage.perDatastoreUsage{}.committed, changeSet.config.name, vm_name, mem_capacity, logical_cpu_count, vm_os, hypervisor_name, cluster_name, host, hypervisor_os_version, changeSet.summary.runtime.powerState, changeSet.summary.vm.moid, changeSet.parent.moid | eval folder=if(NOT match('changeSet.name',"Failover") AND match('changeSet.name',".\s\-\s."),'changeSet.name',null()) | eval changeSet.parent.moid = if(isnull(folder),'changeSet.parent.moid',moid) | eval folder_moid = if(isnull(folder),null(),moid) | eval moid = if(isnull(folder),moid,null()) | eval changeSet.name = if(isnull(folder),'changeSet.name',null()) | stats values(*) AS * BY changeSet.parent.moid | where NOT isnull(folder) AND NOT isnull('changeSet.name') Explanation: Step 1: Construct your search so all events of interest are returned at once. We'll deal the folders from the systems later. You can still use fields if you want, but might not be necessary since you'll get getting away from join and using stats instead. index="vmware-inv" (sourcetype=vmware:inv:vm OR sourcetype=vmware:inv:hierarchy) | fields + _time, changeSet.name, moid, changeSet.summary.runtime.host.name, changeSet.storage.perDatastoreUsage{}.committed, changeSet.config.name, vm_name, mem_capacity, logical_cpu_count, vm_os, hypervisor_name, cluster_name, host, hypervisor_os_version, changeSet.summary.runtime.powerState, changeSet.summary.vm.moid, changeSet.parent.moid *Note: I added changeSet.name and moid to your original list of fields from your system-specific query. Again, this might not be necessary anymore since you're being much nicer to your search head with this approach. 🙂 Step 2: Identify folders by the value of the changeSet.name field | eval folder=if(NOT match('changeSet.name',"Failover") AND match('changeSet.name',".\s\-\s."),'changeSet.name',null()) The regular expressions here correspond to your folder-specific search in your other question. Search results that match appropriately will have a non-null value in the folder column consisting of the folder's changeSet.name value. Systems will have a null value in this column. Presto! Folders and systems distinguished. Step 3: Adjust fields for folders and systems to line up stats for success | eval changeSet.parent.moid = if(isnull(folder),'changeSet.parent.moid',moid) | eval folder_moid = if(isnull(folder),null(),moid) | eval moid = if(isnull(folder),moid,null()) | eval changeSet.name = if(isnull(folder),'changeSet.name',null()) For folders, do 4 essential things: Set the value of the folder's 'changeSet.parent.moid' field to be equal to its moid field. We will use this column with stats to match systems and folders later. Create a new column named folder_moid using the value of the moid. Useful for understanding logic later, but might not be needed in your end result. Set the value of the moid column to null. This will help to prevent creation of multivalue fields when we use stats. Set the value of the changeSet.name column to null. This will help to prevent creation of multivalue fields when we use stats. Note: There's only 1 effective change to systems, and that's a null folder_moid field. Step 4: Use stats to roll up the data for same values of changeSet.parent.moid | stats values(*) AS * BY changeSet.parent.moid Remember when we set the changeSet.parent.moid field of folders to its moid? That's what lets this do the heavy-lifting of matching up your systems and folders. Step 5: Almost there! Remove any systems without matching folders as well as any folders without matching systems | where NOT isnull(folder) AND NOT isnull('changeSet.name') You should be left with only matched systems and folders that meet your original criteria. Mocked-up data: I mocked-up some data for developing this answer. Because I use random numbers to generate my data, I had some anomalies you might not have (like a multivalue fields in places you might not expect). This causes the final result to look off, but it's only an artifact of the randomly generated data. | makeresults count=100 | eval sysnames=split("Foo Failover Bar,Bar,Foo - Bar,Bar - Failover - Bar - Foo,Far,Boo,BooFar,FarBoo",",") | eval changeSet.name=mvindex(sysnames,random()%8) | table changeSet.name | eval changeSet.parent.moid = if(NOT match('changeSet.name',"Failover") AND match('changeSet.name',".\s\-\s."),null(),random()%40) | eval moid=random()%40 | rename COMMENT AS "**" | rename COMMENT AS "Above this line just replicates minimal data to develop logic" | rename COMMENT AS "**" | rename COMMENT AS "First create the folder columnn if it really is a folder which we do by a regex match on the changeSet.name field" | eval folder=if(NOT match('changeSet.name',"Failover") AND match('changeSet.name',".\s\-\s."),'changeSet.name',null()) | rename COMMENT AS "Retain value of changeSet.parent.moid if this is a system but set this value to the folder moid if it is a folder" | eval changeSet.parent.moid = if(isnull(folder),'changeSet.parent.moid',moid) | rename COMMENT AS "Create a folder_moid columnn for easier visualization but might not be needed in end result" | eval folder_moid = if(isnull(folder),null(),moid) | rename COMMENT AS "Blank out the moid column for folders to help prevent mvfield creation with stats" | eval moid = if(isnull(folder),moid,null()) | rename COMMENT AS "Blank out the changeSet.name column for folderes to help prevent mvfield creation with stats" | eval changeSet.name = if(isnull(folder),'changeSet.name',null()) | rename COMMENT AS "The hardest working line in the whole SPL" | rename COMMENT AS "Merges all the lines based on the changeSet.parent.moid values" | stats values(*) AS * BY changeSet.parent.moid | rename COMMENT AS "Remove any systems without a matching folder and any folders without a matching system thereby replicating an inner join" | where NOT isnull(folder) AND NOT isnull('changeSet.name') | rename COMMENT AS "**" | rename COMMENT AS "Below this line removes bogus multivalue changeSet.name and moid data due to use of random" | where mvcount('changeSet.name')==1 and mvcount(moid)==1 | rename COMMENT AS "**" If you're not sure about the logic or want to understand it a little better, copy from the start of this SPL to the line that reads "Above this line just replicates minimal data to develop logic". Then start adding lines one at a time to see how the results change. If you do this, I found it useful to replace the where commands with an eval so I could make sure the logic was right. For example you could replace this | where NOT isnull(folder) AND NOT isnull('changeSet.name') with this: | eval IGNOREWITHWHERE_SINCENOFOLDERMATCH = if(NOT isnull(folder),0,1) | eval IGNOREWITHWHERE_SINCENOSYSTEMMATCH = if(NOT isnull('changeSet.name'),0,1) Hope that helps! rmmiller ... View more

Have you looked at streamstats? ... View more

Yes, for your application, you need to have 2 columns: subnet and state. ... View more

I answered a very similar question not too long ago. Take a look here: https://answers.splunk.com/answers/801332/how-do-you-match-ip-address-with-ips-with-cidr-not.html#answer-802882 You don't need to do any fancy regex to extract parts of the IP address. Make Splunk do the work with your lookup! 🙂 Hope that helps! rmmiller ... View more

Is there a common field or common data in all of the events you are interested in? Can you provide anonymized sample data instead of just wiping out sensitive information with blue? I think that additional info will be needed in order to link the event containing the "Successful" message back to an event containing the user name. ... View more