| makeresults | eval data_string="40:56.1,00J7ER7SGO8PHCAU4O2CM2LAES0006CA,eree334|40:56.2,00J7ER7SGO8PHCAU4O2CM2LAES0006CA,face|41:27.6,00J7ER7SGO8PHCAU4O2CM2LAES0006CA,face|41:27.7,00J7ER7SGO8PHCAU4O2CM2LAES0006CA,dsafasdf|41:27.8,00J7ER7SGO8PHCAU4O2CM2LAES0006CA,earweraw|49:02.1,00J7ER7SGO8PHCAU4O2CM2LAES0006CF,eqtdzgta|49:02.2,00J7ER7SGO8PHCAU4O2CM2LAES0006CF,12341234|49:03.1,00J7ER7SGO8PHCAU4O2CM2LAES0006CF,efgwerwe|49:03.2,00J7ER7SGO8PHCAU4O2CM2LAES0006CF,dafdsaf|49:03.3,00J7ER7SGO8PHCAU4O2CM2LAES0006CF,erwqerqw|50:08.0,00J7ER7SGO8PHCAU4O2CM2LAES0006CF,daadsfad|50:08.7,00J7ER7SGO8PHCAU4O2CM2LAES0006CF,qerqwer|50:08.7,00J7ER7SGO8PHCAU4O2CM2LAES0006CF,ewrqwerqr|50:08.8,00J7ER7SGO8PHCAU4O2CM2LAES0006CF,dfasdfsad|50:08.9,00J7ER7SGO8PHCAU4O2CM2LAES0006CF,ewqrqewr" | eval data_string=split(data_string, "|") | mvexpand data_string | rex field=data_string "^(?<time>[^,]*)\,(?<id>[^,]*)\,(?<value>[^,]*)" | eventstats min(time) AS first_time by id | eval id_sort=id | eval id=if(time=first_time, id,null()) | table time id_sort id value ... View more

Try these to see if you  get any results: index="_internal" sourcetype="splunkd*" host="test1"  index="_internal" test1 ... View more

Share some examples. ... View more

Try this: index=* alert.tool.name=* action="fixed" | eval create_time=strptime('alert.created_at'."+00","%Y-%m-%dT%H:%M:%SZ%z") | eval duration=_time-create_time     ... View more

You can use transactions to do this. However there are limits to transactions -- how large are the datasets and the number results you are expecting? ... View more

Ok, the way I understand it is that you are using fields from B to enrich A and lacking common field with unique id/key to combine the records. You should try to identify some fields and values that is common to both A and B for grouping. For example, if the both datasets have an "account name" but in different columns, you can normalize it into a new field.  | eval common_account_name=LOWER(COALESCE(service_account_name,cn,account_name))   (`index=A) OR (index=B) | table is_interactive account_name cn au acct_name elid full_name email_address manager_name service_account_name job_title lob pwd_expires account_type service_account_id owner_elid au_owner_name au_owner_email | eval common_account_name=LOWER(COALESCE(service_account_name,cn,account_name)) | eventstats MAX(job_title) AS job_title MAX(lob) AS lob MAX(account_type) AS account_type MAX(owner_elid) AS owner_elid au_owner_name MAX(au_owner_name) AS au_owner_name MAX(au_owner_email) AS au_owner_email BY au common_account_name | search account_name=*     ... View more

| rest /services/authorization/roles ... View more

Help me understand this better. Could you list all the inscope fields of Index A and Index B seperately and indicate which index is being used for the enrichment? What does AU stand for?   ... View more

Yes that's easy to do. Instead of MAX, use VALUES(*) AS *. Then run this command for each mutivalued field that you want to expand/flatten.  | mvexpand field_name_1 | mvexpand field_name_2   ... View more

Instead of MAX, you can use VALUES to list out the multivalue fields.   VALUES(*) AS * ... View more

TIME_PREFIX = timestamp_s\x22: TIME_FORMAT = %s,\"timestamp_ms\":%6N ... View more

For color formatting: <format type="color" field="pdf_state"> <colorPalette type="expression">case (like(value,"accepted"), "#037FFC", like(value,"denied"), "#FC030F", like(value,"pending"), "#FFFF00")</colorPalette> </format> ... View more

You have to make sure that: the alert is configured to trigger only when the number of results is greater than 0. your search query is actually filtering out results that you don't want alerted on. Per @ITWhisperer  | where timedelta="Please Investigate"   ... View more

That's strange and interesting. Lets rule out a few things. 1. Could you enable the options "Attach CSV" and "Attach PDF"? Run another test and see if the data is in the attachments. 2. Let's replace the data in Message with safe characters and see if that works. | eval message="testing_"._time       ... View more

Assuming  b_name, b_email, b_manager_name, b_full_name are the fieldnames for index "B". (index=A OR index=B) | table AU, name, email, full_name, manager_name, b_name, b_email, b_manager_name, b_full_name | stats MAX(*) AS * BY AU | eval name=COALESCE(name, b_name) | eval email=COALESCE(email, b_email) | eval full_name=COALESCE(full_name, b_full_name) | eval manager_name=COALESCE(manager_name, b_manager_name) | table AU, name, email, full_name, manager_name ... View more

Bunch of different ways. Here's one: | makeresults | eval _raw="CEF:0|vendor|product|1.1|1234|PolicyAssetUpdated|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=20888 cs3label=AssetName cs3=ABCDPQRS.domain.com cn3label=DirectoryId cn3=856 cs4label=DirectoryName cs4=Active Directory cs5label=DomainName cs5=domain.com" | rex field=_raw "^.*?\|(?<_raw>cn1label.*)" | rex field=_raw mode=sed "s/\s?c[n|s]\d+label\=/;/g" | rex field=_raw mode=sed "s/\s?c[n|s]\d+\=/:/g" | extract pairdelim=";",kvdelim=":" | table AssetId AssetName DirectoryId DirectoryName DomainName EventUserId EventUserDisplayName EventUserDomainName ... View more

Could you post a sample of the search result and also the email template config. ... View more

Depends on your data,  this could be a reasonable solution: index=events_hp state IN (0, 2, 3) | transaction hostname endswith=(state=0) startswith=(state=2 OR state=3) | fields state hostname service_description output ... View more

Couple of searches I've saved around Indexers, Forwarders, etc. -- Indexer and Search Head System and Hardware Utilization | rest /services/server/status/resource-usage/hostwide | table splunk_server cpu_arch cpu_count virtual_cpu_count cpu_idle_pct cpu_system_pct cpu_user_pct mem mem_used pg_paged_out pg_swapped_out normalized_load_avg_1min runnable_process_count os_name os_name_ext os_version splunk_version | append [| rest /services/server/status/partitions-space | rename available AS disk_available capacity AS disk_capacity free AS disk_free | table splunk_server disk_available disk_capacity disk_free fs_type mount_point] | append [| rest /services/server/info | eval server_role=mvindex(server_roles, 0) | table splunk_server, server_role, cluster_label] | stats values(*) AS * by splunk_server | table splunk_server server_role cpu_arch cpu_count virtual_cpu_count cpu_idle_pct cpu_system_pct cpu_user_pct mem mem_used pg_paged_out pg_swapped_out disk_available disk_capacity disk_free fs_type mount_point os_name os_version splunk_version cluster_label -- TCP Input Stats to Indeder by Forwarder index=_internal sourcetype=splunkd group=tcpin_connections (connectionType=cooked OR connectionType=cookedSSL) fwdType=full guid=* | rename fwdType AS forwarder_type version AS splunk_ver arch AS os_arch os AS os_type | stats max(_time) as _time, sum(kb) as tcp_kb_total, sparkline(avg(tcp_KBps), 1m) as tcp_kbps_avg_sparkline, avg(tcp_KBps) as tcp_kbps_avg, avg(tcp_eps) as tcp_eps_avg, max(tcp_eps) as tcp_eps_max by hostname forwarder_type splunk_ver os_arch os_type | foreach tcp_kbps_avg tcp_kb_total tcp_eps_avg tcp_eps_max [| eval <<FIELD>>=ROUND(<<FIELD>>, 0)] | eval hostname=UPPER(hostname) | table _time hostname forwarder_type splunk_ver os_arch os_type tcp_kbps_avg_sparkline tcp_kbps_avg tcp_kb_total tcp_eps_avg tcp_eps_max -- Average 24 Hourly Event Throughput in MB (Forwarder) index=_internal source=*metrics.log group=per_sourcetype_thruput earliest=-2d@d [search index=_internal sourcetype=splunkd group=tcpin_connections fwdType=full | dedup hostname | rename hostname AS host | table host] | bucket _time span=1h | eval series=host | stats sum(kb) AS size_kb BY _time series | eval size_mb=size_kb/1024 | eval event_hour=strftime(_time, "%H:%M") | rename series AS data_source | chart limit=24 avg(size_mb) AS size_mb by data_source event_hour | fillnull value="0.00" | addtotals fieldname="hourly_avg" | eval hourly_avg=ROUND(hourly_avg/24, 2) | foreach *:* hourly_avg [| eval <<FIELD>>=ROUND('<<FIELD>>', 2)]   ... View more

The actual value stored in _time is (GMT/UTC Unix) is "1637846400 " which actually converts to 2021-11-25 13:20:00 GMT." Your UI displays  _time by converting "1637846400"  + your local timezone to a human readable format.   ... View more

How did you validate the time zone of _time? If you're not sure how to validate: | eval epoch_time = _time and take the value and input it into an online unix/epoch time converter.  ... View more

@gcusello, Agreed but I'm not the OP, did not recommend join, maybe you've mistaken? My response is withinin the constraints and limited information that the OP provided.  My understanding was that:  report.csv contains a list of 5000 IDs for the purpose excluding a larger population on the main dataset (not enrichment). report.csv was saved as an inputcsv and wont work as a lookup unless it's moved/configured. used eventstats instead of stats in the event that the inscope ID contains multiple records since OP mention there are multiple certifications per ID. ... View more