Hi, index="spectrum" * | eval foo=_cd | rename "ns1.alarm.ns1.attribute{}.$" as value "ns1.alarm.ns1.attribute{}.@id" as attr | table _time foo attr value| eval id=_cd | eval value=mvzip(attr,value) | mvexpand value | eval attr=mvindex(split(value,","),0) | eval value=mvindex(split(value,","),1) | lookup attr_alarm_spectrum.csv attr OUTPUT field | table _time,field,value,foo | fillnull field,value,foo | eval {field}=value | fields - field,value | stats values(*) as * by _time,foo | fields - foo | eval Severity=if(Severity="3","Critical",if(Severity="2","Major","Minor")) | search Severity=Minor (Name="***" OR IP="*") | lookup State_of_the_Asset_List_on_Unicorn.csv Ip as IP output "Infrastrucure Name" | table _time, Severity,Name,IP,Secure_Domain,Type,Title,Landscape,Acknowledged,Ticket_ID "Infrastrucure Name" | sort -_time In this query i was using ns1.alarm.ns1.attribute{} and ns1.alarm.ns1.attribute{}.@id but now due to the tool upgrade the json data which am receiving has got changed to alarms.attribute{} and alarm.attribute{}.@id. So if i go ahead and update this query then post upgrade data is only visible but not before upgrade as the column names were different. So what do you suggest here to do ? to be able to see all the data with same 1st query ? ... View more

My VLAN value looks like below: |inputlookup vrf_usage.csv | search VRF="*" | search VLAN=Vlan819(RVP_CDN) Could you please help me getting VLAN value as Vlan819 just before ( symbol. That is just before the bracket starts. ... View more

Hi, I have a field called categories. And the values look like below. Please help me with regex or a way to split them and add values to new columns. General News Instant Messaging, Web Phone Business, Software/Hardware Search Engines Finance/Banking, General News, Search Engines I want : categories| category1 | category2 | category3 General News | General News Instant Messaging, Web Phone | Instant Messaging | Web Phone Finance/Banking, General News, Search Engines | Finance/Banking | General News | Search Engines Basically delimeted with comma. ... View more

Hi, I have a dropdown with 5 values. But in the following panel query the table and index which i am using has no reference to that above dropdown values. So i have used makeresults to populate the token and use it in the query Now how can i say if from dropdown A is choosen then taken token1 and if from dropwn B is choosen then use token2 I tried with a if and eval but thats not working can you may be help with the if condition here so that i can use the same token but gets populated accordingly or use a case statement <form> <label>abc</label> <search> <query>|makeresults |eval cfd_hosts=if($infraname$="FRA-CLOUD GTS","SC2CLK-CLOUD-CFD-VDC2 OR host=SC2BJV-CLOUD-CFD-VDC2 OR host=DC2A4-CLOUD-CFD-VDC2",1 )| fields cfd_hosts </query> <done> <set token="tokField1">$result.cfd_hosts$</set> </done> </search> <search> <query>|makeresults |eval fra_bip_hosts="TIGR7-BIP-CFD-A2 OR host=TIGR4-BIP-CFD-A1 OR host=SC2CLK-SVC-CFD-A OR host=SC2ASV-SVC-CFD-A1" | fields fra_bip_hosts </query> <done> <set token="tokField2">$result.fra_bip_hosts$</set> </done> </search> <fieldset submitButton="false"> <input type="dropdown" token="infraname" searchWhenChanged="true"> <label>field1</label> <fieldForLabel>Infrastructure Name</fieldForLabel> <fieldForValue>Infrastructure Name</fieldForValue> <search> <query>|inputlookup temp_infraname.csv | table "Infrastructure Name"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset> <row> <panel> <table> <title>$infraname$ choosen</title> <search> <query>| mstats max(_value) as Bits_in_sec where index=ehealth (host=$tokField2$) AND metric_name="*in" by host,metric_name, info span=1d </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> ... View more

| mstats max(_value) as Bits_in_sec where index=ehealth (host="SC2CLK-CLOUD-CFD-VDC2" OR host="SC2BJV-CLOUD-CFD-VDC2" OR host="DC2A4-CLOUD-CFD-VDC2") AND metric_name="*in" by host,metric_name, info span=1d | rex field="metric_name" "(?P<Interface>.*)\_(?P<InOut>[^\_]+)$" | eval BandW=trim('info',"Bandwidth:") | eval "BW_in"=round(Bits_in_sec/300/BandW*100,5) | appendcols [| mstats max(_value) as Bits_out_sec where index=ehealth (host="SC2CLK-CLOUD-CFD-VDC2" OR host="SC2BJV-CLOUD-CFD-VDC2" OR host="DC2A4-CLOUD-CFD-VDC2") AND metric_name="*out" by host,metric_name, info span=1d | rex field="metric_name" "(?P<Interface>.*)\_(?P<InOut>[^\_]+)$" | eval BandW=trim('info',"Bandwidth:") | eval "BW_out"=round(Bits_out_sec/300/BandW*100,5)] |rename BandW as BandWidth| table _time host Interface BandWidth Bits_in_sec BW_in BW_out Bits_out_sec | rename BW_in as "BW_in%" BW_out as "BW_out%" | sort - "BW_out%" |head 20 In my above query i want to replace (host="SC2CLK-CLOUD-CFD-VDC2" OR host="SC2BJV-CLOUD-CFD-VDC2" OR host="DC2A4-CLOUD-CFD-VDC2") with value from a csv file. I have a mapping file where i have a HostName column |inputlookup preview_infra.csv | search InfraName="FRA-CLOUD GTS" | fields HostName I get below output for above query. host="SC2CLK-CLOUD-CFD-VDC2" OR host="SC2BJV-CLOUD-CFD-VDC2" OR host="DC2A4-CLOUD-CFD-VDC2" Now how to add this query to above query . Please help. urgent. in place hos that host =bla bla i want to replace host=$HostName$ ... View more

######################## Mcafee ################################ $template RemoteHostMcafee,"/applis/LMD/logs/mcafee/%HOSTNAME%/%$MONTH%-%$DAY%.log" ## process mcafee messages # define new ruleset and add rules to it: $RuleSet mcafee *.* ?RemoteHostMcafee ## bind ruleset to tcp listener $InputTCPServerBindRuleset mcafee ## and activate it: $InputTCPServerRun 514 ## bind ruleset to udp listener $InputUDPServerBindRuleset mcafee ## and activate it: $UDPServerRun 514 I have added above patch of code to rsyslog.conf file to get the data coming via port 514 but even then i am not seeing the machine ips folder created under mcafee directory. Is there any other configuration which i need to do to get the logs to splunk ? ... View more