You can try reversing the order of the coalesce. ... View more

@bowesmana, i was wondering how long it'll take until the transaction police reads this post. 😀 ... View more

It's hard to optimize the regex with such a small sample size. But you can try this: ^[^\s]*\s(?<ip_address>\d+\.\d+\.\d+\.\d+)\s(?<status_code>[^\|]*)   ... View more

Yep the logic assumes the ID is null for the response event. Try this instead: | eval event_type=CASE(MATCH(_raw, "samlp:AuthnRequest"), "request", MATCH(_raw, "samlp:Response"), "response") ... View more

To help understand this better, could you provide some sample data and rather than using foo/bar, provide  the fieldname and sample values? If you can create a mockup of the end result, that would help as well. ... View more

Transaction will give you an output of unique values for each field -- are you sure you're only seeing start and end events? Try this as a test: <base_search> | rex "\:\s(?<event_type>END|START)\s" | eval events="[".event_time."] : "._raw | transaction startswith=(event_type="START") endswith=(event_type="END") | table events   ... View more

Livy is basically a restapi service to access Spark. DB Connect does not support restapi -- you will have to configure a custom app to access your Livy endpoint via restapi. DB Connect via JDBC to Spark is probably faster, more efficient and flexible.   ... View more

  | rex "\:\s(?<event_type>END|START)\s" | transaction startswith=(event_type="START") endswith=(event_type="END") ... View more

You're referencing the csv file for the lookup instead of the the lookup definition. | lookup Historical_Uptime_Blacklist.csv excluded OUTPUT start end note Make sure you run it against the "Name" you defined in the lookup definition rather than the csv file name. For example, if you named it Historical_Uptime_Blacklist:  | lookup Historical_Uptime_Blacklist excluded OUTPUT start end note ... View more

Is there any identifier that can tie the 3 middle events together with the start or end event or are you looking for all events between start and end? ... View more

  | bin _time span=10m aligntime=latest   ... View more

This will extract the first IP address after the field originatingAddress | rex "originatingAddress\"\:\s\"(?<first_ip>\d+\.\d+\.\d+\.\d+)" This will extract the first IP address of the event | rex "(?<first_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" ... View more

If you have on-prem Splunk, you can look into this add-on (https://splunkbase.splunk.com/app/6169). For Splunk Cloud, the most straight forward way is to download the Maxmind databases in CSV and create a lookup definition for it. For example, to configure the Geolite-ASN lookup definition you want to set the match type to CIDR(network) and maximum match to 1.   ... View more

The duration is a field that is automatically calculated by the transaction. By default, the transaction command will take the start and end time to calculate the duration in seconds. The _time value represents the begining of the transaction which is the user logon event. Are you actually having issues? ... View more

Yes, the result is immediate as long as you refresh/reload the search. The lookup does not impact or change any data in the datamodel, so no rebuild necessary. One caveat is that if you're summarizing data, you need to first summarize it at an small enough time interval that matches the granularity of your maintenance window, e.g. if your maintenance window is typically 30 minute block increments, you should set the tstat span=30m, then run the lookup to filter result, and then run stats to summarize by day.     | tstats span=1h summariesonly=true allow_old_summaries=true count(device.status) as count from datamodel=Devices.device where device.status!="" AND device.customer="*" AND device.device_id ="*" by device.customer, device.device_id, device.name, device.status _time | eval excluded=1 | lookup exclude_maintenance_window_lookup excluded OUTPUT end | eval end_time=strptime(end, "%Y-%m-%dT%H:%M:%S.%3N%z") | where _time<end_time | bucket _time span=1d | rename device.customer AS device_customer device.device_id AS device_id device.name AS device_name device.status AS device_status | stats sum(count) AS count BY _time device_customer device_id device_name device_status       ... View more

I would recommend adding another HF before cloning add-ons because it will be tricky to maintain. Also 3rd party tools like Cribl would give you this flexibility. ... View more

Why don't you change the test searches to distinguish between real data and test data, and filter out the real data? One way to do this is to insert a field and value into your test data to identify as such.  ... View more