It's kind of hard to answer the question without more context, but It sounds like you already have a month field in your results? If that's the case, some thoughts... You can eval _time to that field, using striptime() to cast it to epoch if needed. At that point, timechart should work fine. Find a way to sort your data from earliest to latest using your month field, then I think the line graph should work. Depending on how your data is formatted, it might help to use xyseries/untable to put the results in a more graph-friendly format. Of course, if you give us a bit more information about your data and your current search, we might be able to help you use timechart natively ... View more

I think you want the timechart command index="okta" AND result="User updated their Okta password" earliest=@w0 | timechart partial=f span=1d count The earliest filter can (should) be replaced by a timepicker (eg, week to date). By default, timechart will try to determine the interval to perform the aggregates over, but you can tell it the span as well (1 day in this case). Also, you can tell timechart to not include partial intervals. For example, if you ran this at Friday at 8am, it wouldn't include results for Friday, because it hasn't been a full day yet. ... View more

did you create that inputs.conf manually? if so, in what directory? my guess is that your disabled=0 setting is in conflict with a disabled=1 somewhere else...and losing. This could help you track it down, but I think HEC settings may get a little convoluted. /opt/splunk/bin/splunk btool inputs list http --debug | grep disabled It might be worth putting your inputs.conf in /opt/splunk/etc/apps/splunk_http/local ... or maybe at least enabling the http stanza there? ... View more

you can look in the _audit and _internal indexes for that user to see if there are any errors and which searches they ran. Does that compliance role inherit from the user role? Or another role maybe? If the users are mapped to that role and that role has access to the index, then I'm wondering if it's missing something like the search capability? ... View more

Not that users would (accidentally) lie but have you witnessed that they can't search the data? Maybe their time range or source or sourcetype (etc) are wrong, so they just aren't getting the results? Are there any restricted search terms in any of the roles they belong to? Is the user running the search from the same search head as you? If not, do they have the same settings for the role? Can you create a test account, give it that role and see results? ... View more

Thanks for the reply, I'll take a look. I think our MS resource said he might be able to update the code as well. If we're successful, I'll follow up here. ... View more

It's important to understand the phases of data in Splunk and where different setting apply. The field extractions you were seeing were coming from two places. The INDEXED_EXTRACTIONS setting is done during the input phase. When you use that setting, the fields are indexed with the data. So that's where the first set of fields is coming from. The next set of extractions are coming from your search head during the search phase. As you mentioned, you didn't configure any settings on the search head for that sourcetype. So that means your sourcetype will be using the default settings. The default value for AUTO_KV_JSON is true. So when you are running searches against that sourcetype, splunk is parsing the json again. It's important to note that setting kv modes on heavy forwarder are not going to have any effect when searching from your search head. Your search head only knows about its setting. The settings do not carry over from phase to the next. So when you commented out the indexed extractions in the first case (just like it was in the second case), you eliminated the first set of extractions, leaving just the search-time extractions. ... View more

are the usernames exactly the same? No domains or anything to strip out? if you remove the where command at the end and maybe sort by username do you see any you would consider duplicates? Or in general do you see data you'd expect - a username, a count and field for types, probably containing one or two entries? ... View more

I don't think you need the proccessor time filter in your base search. Let your stats worry about the calculation. for similar requests, we've typically used min(). If the minimum over a period is greater than your threshold, then it was above your threshold the whole time. The avg() could be above the threshold even if it's dipping/spiking over that period. ... View more

If there is a user field in the cisco ise data that would match the user coming from ldap, then I think one way could be to append these searches together with a common field name and use some stats to filter down to the users you want to see. Not tested at all, but maybe something like this sourcetype="cisco:ise:syslog" NetworkDeviceName="MYVPN" action=failure OR action=success PIX7x_Tunnel_Group_Name=MYVPNGroup | rename user_field as Username | eval type = "ise" | append [ | ldapsearch domain=MYDOMAIN search="(&(objectClass=user)(memberOf=CN=MyGroup,OU=Groups,DC=Mydomain,DC=com))" | rename sAMAccountName as Username | eval type = "ldap" ] | stats dc(type) as count values(type) as types by Username | where count=1 AND types="ldap" ... View more

I think you're sort of mixing solutions here. If you haven't already, please read up on the phases of data in Splunk. If you want to do this during the input phase (on your forwarder), then you probably want to play with these settings in your props.conf on the forwarder. For example, something like this maybe (didn't verify) [your sourcetype] HEADER_FIELD_LINE_NUMBER = 1 HEADER_FIELD_DELIMITER = ~~ FIELD_DELIMITER = ~~ Or if you want to do it during search time, you can use props/transforms on your search head. You can probably find a lot of examples like this out here and it's documented in the spec files as well. Something like this maybe (didn't verify). props.conf [your sourcetype] REPORT-my_fields = tilde_fields transforms.conf [tilde_fields] DELIMS = ~~ FIELDS = A,B,C,D,E ... View more

Have you tried setting KV_MODE=none and/or AUTO_KV_JSON=false for these sourcetypes on your search heads? if you don't set something at your search layer, I think splunk will use the default values (e.g. AUTO_KV_JSON=true) , which would explain the double extraction Configuring search-time settings at your parsing layer won't carry through to your search layer...they need set at the search layer. ... View more

I think this is what our ES users have been requesting for the past few years now. As of 4.7, I don't think the functionality is there. I'm not sure if they added it in 5.0. Hopefully since it seems like ITSI can do it, they'll make it available in ES soon. ... View more

Also, if I understand what you're asking correctly, I typically add a manual entry to the input as well. You can call that one "All" and give it a value of *. So then your users would have an All option in the dropdown along with each pageURL from your dynamic search. That's might be a bit easier than trying to append it to your dynamic search. ... View more

you could pipe to the addinfo command, which will add fields for info_min_time and info_max_time to your events. And then you could do the math from there. Of course, you'd have to determine how to handle odd scenarios like "All Time"... ... View more

yes, very excited about this...upgrading to 7.0.2 this week ... View more

ok, maybe i didn't test it fully enough. I don't think i ever left the dashboard and came back to it...just updated the xml, saved and refreshed. I do see similar behavior on 6.5.2 as well ... View more

do you need them to be the same sourcetype when indexed? or can you rename the new sourcetype back at search time? the reason i ask is because the docs make it sound like the cloned event will only get index-time transformations and sed commands. meaning, it might not go back through the rest of the typing queue? maybe to prevent looping? or maybe i'm reading it wrong. props.conf [clone_test] TRANSFORMS-clone = clone_sourcetype,trim [clone_test2] # rename is done at search time rename = clone_test transforms.conf [trim] REGEX = ^([^,]+,[^,]+) FORMAT = $1 DEST_KEY = _raw [clone_sourcetype] REGEX = ^([^,]+),[^,]+,(.+) FORMAT = $1,$2 DEST_KEY = _raw CLONE_SOURCETYPE = clone_test2 ... View more

seems to work on my free 7.0.1 license...had to change the role search to admin since there are no users in the free version, but the input displayed as expected. And when i changed the role search to something else, the dropdown didn't display. ... View more

are you trying to set the source to /var/log/syslog? Or is that the source you want to apply the transform to? I don't think your props is doing either correctly, which is why I think it's barking at you. but it also looks like you may have typed that in above or missed some bits during copy/paste, so not sure if that's exactly how your config looks? ... View more

I believe you want to set them to nothing in your local copy [WinEventLog://Security] # disabling the blacklists set in default blacklist1 = blacklist2 = ... View more