first things first, you want to get the jobid in both logs. assuming your source is the filename/path, maybe something like this: | rex field=source "(?<job_id>[^\-]+)\-[^\-]+\.log" I don't want to keep typing that out, so i'll assume you do that in field extraction and that the job_id field is generally available. You can of course just put that rex command in the searches/subsearches as needed. Depending on how many logs you have, one option may be better than the others. And since I don't know any details about your logs, this is really all pseudo spl for you - just giving you ideas on what to try. I would probably use the last option, maybe the first. Subsearch You could try to use a subsearch to only include raw logs from ones with a failed summary. The subsearch returns a list of failed job_id's which is then used in the main search. From there, just count the errors by the job_id, since they are all failed jobs index=jobs sourcetype=jobs:raw [ search index=jobs, sourcetype=jobs:summary | where result="failed" | table job_id] | dc(error) as distinct_errors by job_id Join Not the most efficient command and there are some default limitations, but with a smaller set of events i think it's fine. In this case we use the job_id to join events from the raw data to the result in the summary data. index=jobs sourcetype=jobs:raw | join type=left job_id [search index=jobs sourcetype=jobs:summary | table job_id, result] | where result="failed" | do whatever with failed job_ids Append Most things you do with join, you can do with append, which is more efficient, but still has some default limits. In this case we'll get all the raw data and all the summary and then manipulate it with common job_id field as needed. index=jobs sourcetype=jobs:raw | append [search index=jobs sourcetype=jobs:summary] | stats values(result) as result, values(error) as error by job_id | where result="failed" Without Append Append isn't necessarily needed here because in my version of your data, it's all in one index, so we can just search for it all initially. Append is useful if your appending data sets that are too difficult to search together, for example if you need a lot of spl to actually get thing things you want to append. For just a bunch of raw data, just search for it all... index=jobs (sourcetype=jobs:raw OR sourcetype=jobs:summary) | stats values(result) as result, values(error) as error by job_id | where result="failed" ... View more

maybe you could provide the actual problem you're trying to solve? Initially, i would say that splunk doesn't work that way, no. You would more likely have to search for all of the data, and then use spl to filter/manipulate results to show the specific events on each day that you want. ... View more

let's get the dumb question out of the way first....it's not just hidden, right? You don't have a "Show Fields" link available? ... View more

For the parse time settings, i think this should work. [teamsite_xml] DATETIME_CONFIG = CURRENT LINE_BREAKER = ([\r\n])+(?=\s*\<iwuser) SHOULD_LINEMERGE = false Splunk uses the line breaker to determine where events are broken. It will essentially replace the first capture group of the regex with its line breaker. So in this case we're capturing a crlf, but specifically the crlf before the opening iwuser tag. That captured crlf is where splunk will break events. We use this format with a lot of line breakers as most logs are broken with a crlf followed by some specific thing like a timestamp. And of course, since we're telling splunk exactly where to do it, we don't want Splunk to then try to merge lines back together. I believe that's what all of the " must break *" settings are used for. Again, those are your parse time settings - things done before splunk indexes the data. The KV_MODE and FIELDALIAS settings happen at search time - after the data has been indexed. So if you have a separate search head, then you want to put your props.conf out there as well. You can have one conf with both parse/search time settings. Or you could create one with just parse time for your indexers and one with just search time for your search heads. In any case, the search heads need to know about your field aliases and kv mode. My laptop is both my indexer and search head, and i do have nextID, userName, etc. with your settings..so they are correct. And one last note, the NO_BINARY_CHECK setting happens at input time, when the xml file is read initially, probably on a UF? I always recommend this wiki page to understand which settings happen where and what that might mean in your env. https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F ... View more

Yeah, a bit more flexibility with an html dashboard, glad it's working for you. I would suggest too, maybe submit an Enhancement Request for this functionality to be added to splunk's built-in textbox? ... View more

the reason i'm trying to understand your exact fields is because your examples aren't very telling. For example, "|rename myOriginalName as NewName" would work fine. Do you not know the names of the fields you want to rename? Are you trying to rename multiple wildcarded fields to the same field name....because that won't work. That said, you could look into the foreach command....which will loop through all of your fields. Maybe that will give you the means to rename them the way you want? ... View more

can you maybe give us a more concrete example of the fields you're working with and what you want to rename them to? i don't quite understand the problem with your "somewords" type example. ... View more

i think this is a bit more complicated than you might imagine? You're essentially trying to add a button to an existing text box and have that button take some action. And you want to do it with just a styling engine? Probably not doable. Adding html elements and placing them in existing divs from simple xml is impossible i think. But even if you could, no idea how you would also use css to take action when that button is clicked? Without js? I know css can be pretty powerful, but it does have its limits, right? That said, you can sort of mimic that functionality with simple xml. And maybe with this approach, you could use css to further style these elements...adding to the illusion that it is "built-in"? <form> <label>Playing Around</label> <fieldset submitButton="false" autoRun="false"> <input type="text" token="my_text"> <label>Enter Some Text</label> </input> <input type="checkbox" token="clear_button" searchWhenChanged="true"> <label></label> <change> <unset token="form.clear_button"></unset> <unset token="form.my_text"></unset> </change> <delimiter> </delimiter> <choice value="clear">X</choice> </input> </fieldset> </form> ... View more

I probably should have mentioned that it's also in the community app for threatstream that was created a couple years back...i wonder if they just started with that app when they created their own. ... View more

I agree, they were great during the POC. But the POC is over, and I don't think I still have access to them (I have to go through our SOC team for contact). I imagine if we buy the product, the service will remain as good. ... View more

that definitely seems like too long, so not sure if this will help at all but it can't hurt....this is a conf session from 2017 that had some good tuning tips - may be a bit outdated now? https://conf.splunk.com/files/2017/slides/measuring-hec-performance-for-fun-and-profit.pdf ... View more

@louisawang i wanted to follow up here. I saw that you may have commented at some point, but possibly deleted it. Did my answer help? I am using _time, but you can change that to whatever field you're using as long as you make it epoch first. ... View more

just to be clear, when you're ready, go ahead and post your answer with a link to your script and then accept that answer. Just want to be sure you weren't going to literally close the question...having it answered with your solution will likely help others in the future. ... View more

i'll ask the dumb question...is the report field in the "3 more fields" link? ... View more

I didn't try to digest your search, but i think relative_time() is your friend here. Quick question just to verify though, in your post do you mean that if the ticket is created Monday at 9pm it should start on TUESDAY at 8am? Not well tested but i think it should mostly work. If the ticket comes in off hours (hour >=20, hour< 8 ) or over the weekend (day 5/6/0), then adjust the start to the next work day at 8am. Get the initial end time by adding the appropriate hours based on the sla, then figure out how far past the 8pm that is. Again, check the day and adjust appropriately for off-hours/weekend and finally add the remainder back. So if I didn't make any mistakes, this should result in start and end fields containing the official start and end times based on when the ticket came in and the SLA...using ctime()/table at the end to just see if the dates look right. index="test" sourcetype="incident_all_v3" | eval start_hour = tonumber(strftime(relative_time(_time, "@h"),"%H")), start_day=tonumber(strftime(relative_time(_time,"@d"),"%w")) | eval start = case(start_day=0 OR start_day=6 OR (start_day=5 AND start_hour>=20),relative_time(_time,"+1w@w1+8h"),start_hour < 8, relative_time(_time,"@d+8h"), start_hour>=20,relative_time(_time,"+1d@d+8h"), true(), _time) | eval end = if(SLA = "SLA Level 1",relative_time(start,"+4h"), relative_time(start,"+8h")), end_hour = tonumber(strftime(end,"%H")), end_day = tonumber(strftime(end,"%w")), end_rem = end - relative_time(start,"@d+20h"), end_rem = if(end_rem <0, 0, end_rem) | eval end = case(end_day = 6, relative_time(end, "+1w@w1+8h"), end_hour >=20, relative_time(end,"+1d@d+8h"), end_hour < 8, relative_time(end,"@d+8h"), true(),end), end = end + end_rem | convert ctime(start), ctime(end) | table start, end, SLA ... View more

If you can't use the re-assign objects interface for those searches, then i would suggest either deleting savedsearches.conf from the user ($SPLUNK_HOME/etc/users/the_user/some_app/local/savedsearches.conf) or just delete the user directory all together. If it's shc, you can do that on each member and then a rolling restart. Of course, first ensure those searches should no longer be running. If they should still be running, then just recreate them yourself. ... View more

i could be wrong, but i don't think this is possible at parse/index time. One of the first things splunk will do is break the stream of data into events...and it only does that once. At that point, if you want just one id/host object per event, you've lost the context of masters/slaves and i don't think you can get it back. The option of large events with multiple objects would allow you to set the sourcetype the way you want i think, but then you have giant events with many id/host objects. maybe you could break into large "masters" and "slaves" events and then come back around at search time with the collect command to split it up the way you want. Of course if you can change the source and just split it up before you send to splunk, then that's a good option as well. Curious too if this sort of problem might be a use case for the Data Stream Processor that's in beta now https://www.splunk.com/en_us/software/splunk-next.html ... View more

i think you could still do that on the file system - just do it on the deployer (if needed in your env, e.g. local dashboard/reports) and do it on each member of the cluster. then push the bundle and/or rolling restart. Or maybe a little less user-friendly, you could try to make the changes via the api against a member, as i think changes via the api will trigger replication. ... View more

understood...important thing is you got what you needed. And although xyseries may not be needed for this particular case, keep it in your toolbox, because it can definitely come in handy ... View more

I think that's the Office 365 Endpoint. Seems like there a handful of them. Here is the worldwide one...links to the others are on this page too. https://docs.microsoft.com/en-us/office365/enterprise/urls-and-ip-address-ranges ... View more

if you expect low cardinality maybe you could aggregate some of the data first and save in a json, e.g. like an array of "int: count" objects or something...but i think that would still make your life harder once it's in Splunk. ... View more

not that it's helpful, but we never had luck with this add-on. We query the data warehouse directly now with dbconnect. that said, when we were struggling with the add-on, nexpose support did try to help us troubleshoot...so maybe toss a ticket their way. ... View more