Try (index=index1 OR index=index2) (sourcetype=sourcetype1 OR sourcetype=sourcetype2) | complete the query ... View more

That's because in our use case we were only interested in the lines having "Caused by:" from the entire stack trace; which is the actual cause of error and there might be a lot of errors/subExceptions in the stack trace: index=myIndex sourcetype=mySourcetype "Caused by:" | rex field=_raw "Caused by:\s(?<myException>[\S]+)" | stats count by myException Your log lines which you posted should work out with this query I posted initially if that's how the errors occur in your logs: your query to return events | rex field=_raw "\[SEVERE\](\s|\sat\s)(?<myException>[^\s\(]+)" | stats count by myException ... View more

If all you are doing is add commas to the existing field then try fieldformat rather than eval which will preserve the format in case the sorting might be needed on the field later on. So eval command | eval TotalCnt =tostring(TotalCnt, "commas") changes to | fieldformat TotalCnt =tostring(TotalCnt, "commas") ... View more

It will require two adjustments: Exclude events in query Changing refresh interval of the query to get you the real-time view. If you don't want launching VM you can exclude that in your base query like: index=yourIndex sourectype=yourSourcetype NOT(launching VM) | rex "^(?<status>[^\s]+) | stats latest(status) by host For the part to get the latest realtime results you can either use real time search or the refresh option of the query, panel or dashboard. See here: http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Aboutrealtimesearches https://answers.splunk.com/answers/483783/define-refresh-interval-for-formdashboard.html#answer-484018 ... View more

How about you try this and take whichever one you are interested in out of preFix OR sufFix fields if your initial string is in field Message : your query to return events | rex field=Message "^(?<preFix>^.*?)(\s:\s|\sfor\s)(?<sufFix>.*)" | table preFix, sufFix, Message See here for the extraction at work. Notice the Group PreFix and Group SufFix on right sidebar after reaching the extraction hyperlink page. ... View more

If GET and POST is all you are interested in then you can try this as well: your base search | rex "\"(?<actionUri>(GET|POST)\s*?[\S]+)" | table actionUri If additional actions are needed feel free to add in (GET|POST|...) part of the above rex ... View more

In case the xml was not edited, as edit can happen via edit panels/ui too, so this might also work: index=_internal sourcetype=splunkd_ui_access method=post edit ui/views | rex field=other "\s*?\-\s*(?<sessionId>[\S]+)\s*" | table user, useragent, req_time, file, sessionId | rename file as dashboard req_time as editTime ... View more

transforms.conf and props.conf might be the right place to start with and from. Please have a look here: https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Overridedefaulthostassignments#Configuration ... View more

If the one @masonmorales gave isn't sufficient already Or perhaps to get the comma as well in the capture try below 🙂 your query to return events | rex "StatusMsg=(?<statusMsg>.*?)CrlMsg=" | table statusMsg ... View more

If the name changes and the extension stays the same a good option might be to monitor the files having the same extension within a directory as follows, example, monitor all files *.log in directory /jfplogs/prod/CP/ : inputs.conf should have stanza as follows (or something silmilar) [monitor:///jfplogs/prod/CP/*.log] sourcetype=yourSourcetype index=yourIndex See below for other options to specify the file names as per your need: http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Specifyinputpathswithwildcards#Input_examples ... View more

Initially you wanted the options to be dynamic and now the comment seems jst to get only a few static options so I am quite confused what's the exact need. However from the comment and code above few things I noted were: Name of your token is same as your field name, can you make them different, in case, something like token as tok_device_vendor and field as device_vendor : device_vendor index="tripleabc" earliest=-20d sourcetype="eventscount" | stats count by device_vendor device_vendor device_vendor What is the need of a second drop down if you are using the same query to populate the panel as well? Shouldn't you be using tok_device_vendor token to populate the device_product query and then use both the tok_device_vendor and tok_device_product to update the panel query to reflect the choice (something like this): <input type="dropdown" token="tok_device_product" searchWhenChanged="true"> <label>device_product</label> <search> <query>index= "tripleabc" earliest=-20d sourcetype= "eventscount" $tok_device_vendor$ | stats count by device_product</query> </search> <fieldForLabel>device_product</fieldForLabel> <fieldForValue>device_product</fieldForValue> </input> And <panel> <title>EVENT DISPLAY AS PER SELECTION</title>30.<table> <title>EVENT DATA DISPLAY</title> <search>20. <query> index= "tripleabc" sourcetype= "eventscount" $tok_device_vendor$ $tok_device_product$ | stats count by device_product </query> <earliest>-20d</earliest> <latest></latest> </search>25.<option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> </table> </panel> ... View more

Please check the suggestions made by @richgalloway, however one way to check if the data is duplicate you can use stats as follows too: If the events are duplicate then their time value in logs shall also be repeating for the duplicate events. Doing a stats on minimal fields, including time field, can prove duplicate events and can be done as follows : your query to return events | stats count by Time, TaskId, Measure1, Measure2, GlobalContextVariable, GlobalContextVariable2, LocalContextVariable .... | sort TaskId That shall tell you the duplicates if the count field value is more than one any of the table rows. The ... in the above query should be updated with all the remaining fields you might have or want to use to see the duplicate events. Once you know you are getting the counts as you had hoped, you can remove the count field by appending | fields - count and get the de-duplicated data. ... View more

Which version of Splunk are you using. You might not need to refresh all the queries piecemeal and can refresh the entire dashboard every 15 secs. using refresh="15" . I have tried it on 6.4.2 and 6.5.0 . See my comment above for sample code of how to make it work and see if that helps in your case. ... View more

Here is a sample code of a dashobard which refreshes every 15 secs in Splunk 6.4.2 irrespective of however many panels it has. My example has three panels and doesn't need each query refresh but only <dashboard refresh="15"> at the top: <dashboard refresh="15"> <label>timer</label> <row> <panel> <table> <title>Panel 1</title> <search> <query>| makeresults | eval abc=relative_time(now(), "-1s") | table abc</query> <earliest>0</earliest> <latest></latest> </search> <option name="wrap">undefined</option> <option name="rowNumbers">undefined</option> <option name="drilldown">row</option> </table> </panel> <panel> <table> <title>Panel 2</title> <search> <query>| makeresults | eval abc=relative_time(now(), "-2s") | table abc</query> <earliest>0</earliest> <latest></latest> </search> <option name="wrap">undefined</option> <option name="rowNumbers">undefined</option> <option name="drilldown">row</option> </table> </panel> <panel> <table> <title>Panel 3</title> <search> <query>| makeresults | eval abc=relative_time(now(), "+1s") | table abc</query> <earliest>0</earliest> <latest></latest> </search> <option name="wrap">undefined</option> <option name="rowNumbers">undefined</option> <option name="drilldown">row</option> </table> </panel> </row> </dashboard> If you happen to have <form>...</form> use it refresh="15" similarly like it is used in dashboard above <form refresh="15">...</form> Same should work in 6.5.0 . ... View more

This should work for all the cases if say the values are in field called testField : your query to return testField | rex field=testField "^(?<myField>(([\d\.]+)|(\w+)))[:.]" | table myField See extraction here. You can also replace the last capturing group [:.] to include comma if required [:.,] ... View more

Try this using mode=sed your query to return events | rex field=Indicator_Value mode=sed "s/\[//g s/\]//g" Please ensure to keep the string "s/\[//g and s/\]//g" split over two lines exactly how it appears in the query. Take care of the " (double quotes) to be same as it appears in the query. ... View more

Editing response to change the csv name 06/18/2021 Let's say ip's within the lookup ‘denylist.csv’ are called ‘lookup_ip’ and your csv looks like this: lookup_ip 1.2.3.4 11.22.33.44 111.222.111.222 The you can use the following command to search these lookup_ip IPs of lookup table in you events where ip is stored in a field called src_ip as follows: index=yourIndex source=x sourcetype=yourSourcetype [| inputlookup denylist.csv | table lookup_ip | rename lookup_ip as src_ip ] If you want to avoid searching these denylist IPs then try: index=yourIndex source=x sourcetype=yourSourcetype NOT ( [| inputlookup denylist.csv | table lookup_ip | rename lookup_ip as src_ip ] ) If the ip within your events is stored in some other field than src_ip then just rename the lookup_ip to that field in | rename lookup_ip as src_ip part of the above commands. ... View more

Can you please try this option and see if it works out for your version of Splunk: <!-- Set font color (axis labels, legends) --> <option name="charting.fontColor">#FFDDCC</option> Use the hex code of your choice in it. ... View more

Addressing this part of the question: My problem is that the elapsed time stays static, when it needs to be calculated and displayed continuously in real time The panel will report static data for the instance when the search was run and it will stay as is till its refreshed again. You have the option to refresh the query if you are using the latest Splunk version wherein depending on the refresh interval the data will be automatically updated. Example on how to refresh the query every 5 minutes is below: <search> <query> </query> <earliest></earliest> <latest></latest> <sampleRatio></sampleRatio> <refresh>5m</refresh> </search> Explore the other options of refresing data in your panels/dashboard which are mentioned here: https://answers.splunk.com/answers/483783/define-refresh-interval-for-formdashboard.html#answer-484018 ... View more

Same regex would have worked well in the field extraction too. But if you have solved it, then good, else this regex above is much more compact and will not be too dependent on the strict sequences of \d{n} as your regex might fail if: The \d's were to mismatch in any log line. If the content within the capturing group (\D|\d){15,75}) were to exceed 75 chars. ... View more

Since your duration in hours will be a very small number in comparison to the throughput values which are in 100s or 200s range hence to represent both values on same scale better try to use the log scale to represent the y axis. It can be chosen from the format option of the visualization. The hour should be eval Durationhrs=(Durationsec / 60/60) . ... View more

It depends on the version of Splunk you are using. Since the latest version gives you the option to refresh the query within a panel then start from there: <search> <query> </query> <earliest></earliest> <latest></latest> <sampleRatio></sampleRatio> <refresh>5m</refresh> </search> Otherwise depending on the Splunk version following might work: Form refresh: <form refresh="30"> Dashboard refresh <dashboard refresh="30"> Panel refresh <option name="refresh.auto.interval">60</option> ... View more

index=_audit (action=*edit* OR action=*create* OR action=*delete* OR action=*change* OR action=*embed* OR action=*restart* OR action=*update*) user=admin| stats count by user, action You have to have admin rights to search index=_audit . If you do, then above command can be saved as an alert. ... View more