can you explain why it is generating more than once? It's hard for me to infer the problem because for any of my data sets, this would work fine. Can you provide an example of when you can alert more than once? ... View more

Are you specifying "allowed" indexes for that token on the HEC. I think that's when I've seen the "Incorrect index" problem before - the index you're sending to isn't in the allowed list. I think typically the approach is to not define any allowed indexes and rely on the default index to catch unexpected data. ... View more

it may also result in the first step in troubleshooting anything with support to be to upgrade to something newer. ... View more

I'm having hard time understanding what exactly is getting returned in your subsearches, but maybe for the one returning an address, something like below. This is based on a "similar" scenario of wanting dashboard panel to have "0" instead of "no results found" (https://answers.splunk.com/answers/582253/replacing-no-results-found-with-0.html) So essentially, append a count of events to your results, and if it's 0, then set the return to something that results to false? Not sure if you have to do it sooner in your search or not, but just take each subsearch by itself and try to get that logic working - finding some way to identify no results and then return something false. .... | eval addr="\"".addr."\"" | appendpipe [ | stats count | where count=0| eval $addr="1=0" ] | return $addr ] ... View more

I don't think that limit comes into play with lookups, but I could be wrong. I would also check to make sure that you don't have any white space around the id field in your data and the one in the lookup. ... View more

seems like that should work...and i don't see any subsearches in there. Are you expecting to see users in your results that you don't? Or do you see users you don't expect? is the lookup case insensitive or is all of your unique_id's in the same case in the data and in the lookup? ... View more

Well I think the problem is that with no events, your search resolves to something like this, which is invalid index=blah OR OR You already have incredibly complicated search here, why not make a bit more complicated. In your subsearches add some logic to determine if there's no events and return something that results to false? ... View more

So what is the timestamp of the event based on then? Why would you see a job that ended say 20 minutes ago if you're only searching for the past 5 minutes? In any case, you could filter out data where the StopTime is greater than 5 minutes ago. Not sure what format the timestamp is in, but assuming you could use strptime to make it epoch if not already, then something like: ... | where StopTime > relative_time(now(),"-5m") ... View more

I guess that depends on how the search works and what the data looks like. I assumed you'd have a log entry at like 8am that a job ran and then you wouldn't have another until the next day. So what does your data look like and how are you searching it? ... View more

I reached out to our account team to share my frustration and disappointment with how Splunk is handling this and asked that they share it with their management. If you can, I suggest you do the same. Maybe if enough of us make noise, they'll change their ways....but won't get my hopes up. ... View more

create your search and use the time picker to run it over the past 5 minutes. save that as an alert choose to run it on a cron schedule and set that to */5 * * * * ... View more

i wonder if the bucket rolls when splunk is stopping and your setting took effect as splunk was starting. So that bucket had rolled off before it knew about the directory? ... View more

you may want to run this more often, maybe every 5 minutes and find a way to deal with dups. Or run it over a longer period and use delta to find the time between alerts. If you run it every 30, you could miss failed attempts that cross timespans. For example, if it runs on the 0 &30 minute mark and attempts fail on the 57 and 02 minute marks. The first run at the 0 min would only see the attempt at 57 and the run at the 30 mark would only see the attempt at 2nd minute. And so even though the attempts are 5 minutes apart, your alert would miss them. ... View more

what about something like this for your line breaker....assuming you don't need the comma (,\s*)(?=\d{10}) ... View more

Played with this on Splunk 7.1.x. I have always created a search, used addinfo to the earliest latest, manipulated them as needed and then created tokens to use elsewhere. But I like your approach too. Anyway, I removed some quotes and added a check for the case when latest is now...because that didn't seem to work as a modifier in the relative_time() function. Also, you may need to account for the all time scenario too... Here's a very simple dashboard that just shows the tokens in the title of an empty panel. <form> <label>Timepicker Test</label> <fieldset> <input type="time" token="Time_Range" searchWhenChanged="true"> <label>Time</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> <change> <eval token="weekearliest">relative_time(relative_time(now(),$earliest$,-7d)</eval> <eval token="weeklatest">if($latest$="now",now(),relative_time(now(),$latest$)</eval> </change> </input> </fieldset> <row> <panel> <title>$weekearliest$ $weeklatest$</title> <single> <search> <query/> </search> </single> </panel> </row> </form> ... View more

when in doubt, remove parts of your search until you can see where the problem lies. In this case, your very first command (tstats count) will literally create a number....that's it - at that point you don't have any data to use spath on and to filter farther with. Splunk search works by getting a set of results and then passing that set of results to other commands that act on it. Each command changes the set of results before sending to them to the next command in the pipe list. If your first set of results is one row with one count field, you're going to be able to do much with it. Do you know what sourcetype your data is? That may tell us if we can use tstats at all, or whether we have to search the index for the raw data and the filter it. ... View more

I think the best you can do for that is to use the trellis layout option, which could create one radial gauge for each channel. The visualization itself isn't designed for multiple series. ... View more

That seems a little buggy I think. What version of Splunk? Have you tried multiple browsers? I have 7.1 installed on my laptop and couldn't reproduce in chrome with a simple search of _internal. ... View more

You should be able to use strptime to convert to epoch and then do the check. So let's say your birthday field is in the a mm-dd-yyyy format... your base search | eval bd_epoch = strptime(birthday,"%m-%d-%Y"), bd_earliest_epoch = strptime("01-01-2015","%m-%d-%Y") | where bd_epoch >= bd_earliest_epoch ... View more

not sure if i understand exactly what you're asking...but given a sourcetype, this will run a subsearch to find the source with the latest timestamped event and use that source to limit your main search. index=your_index sourcetype=your_sourcetype [|tstats latest(source) as source where index=your_index AND sourcetype=your_sourcetype | table source] ... View more

run it every 5 minutes only, looking back over the previous 5 minutes? ... View more

does the Namespace to Index Routing section on the readme help? https://github.com/splunk/splunk-connect-for-kubernetes/blob/develop/README.md ... View more

Correct. In the Web, it's considered a Calculated Field (Settings -> Fields -> Calculated Fields) as is typically applied to a sourcetype. And on the backend that is just written to props.conf [your_sourcetype] EVAL-my_val = case(match(_raw,"aaa\s+:\d\d:"),2,match(_raw,"aaa\s+:\d:"),1,true(),"n/a") Not sure what your environment looks like, but just note that this is considered a knowledge object and as such has permissions (who can read/write it) and scope (private/app/global) associated with it. ... View more

maybe in that case you can put it in props.conf as an EVAL .... and then my_val would just automatically be created for that sourcetype? or if it's needed in a dashboard, the a lookup could be used to ultimately create a token (dashboard var) with the case functionality and then that token used in the search. or maybe (but unlikely) something could be done to add each pattern as a new field to the data and then foreach used to loop through and test your field against that pattern - could work maybe, but pretty ugly. the problem is that the way you want to use the lookup, isn't what lookups were designed for, with respect to the regex matching part. that looping/matching is inherently done with the lookup command and that command knows nothing of regex i believe. ... View more

well that's a good question...hopefully it was an accident and not a severe bug or anything...we planned to upgrade to 7.3.1 next week ... View more