You have asked question to convert String time to epoch.... However, you are applying the same on _time field which should already be epoch. Following is a run anywhere example with string time converted to epoch. I have used replace to remove + sign and then %6N. | makeresults | eval time="2000-12-17T00:30:00.000+0000" | replace "+" with "" in time | eval time=strptime(time,"%Y-%m-%dT%H:%M:%S.%6N") Following worked for me without replace as well. | makeresults | eval time="2000-12-17T00:30:00.000+0000" | eval time=strptime(time,"%Y-%m-%dT%H:%M:%S.%6N") ... View more

@Esky73, Is your requirement to alert when status was up and then went down. But not to trigger again unless status goes up and then goes down again? In other words even if the status remains down for a day without someone restarting the service, you do not want second alert? Or is there a max limit to how long can the alert be continuously down (like 1 hou/1day/1week etc)? ... View more

You dont need to report every 5 min when the status is stopped and you don't want to throttle. So may be I am confused. Let me mark my answers as comment so that it flashes to others as unanswered and they provide you with the answer you are looking for. ... View more

@Esky73, head 1 will only give you latest Event with mySQL status. Only if status="stopped", then there will be a result in the search. Since you have scheduled this for every 5 minute it will test the same again in 5 minutes. Seems like you want to snooze alert for specific time once it has already triggered. There is an option called Throttle in Splunk Alert while setting up Trigger Conditions. This prevents subsequent alerts to be triggered while IT team loks at the issue and resolves. You can set the suppression to 15 minute(s), or 1 hour(s) or 1 day(s) etc as per your need. On a separate note you can test directly in search, or test alert in test system or else keep alert action local to be displayed in Alert list. ... View more

@mintughosh, if the issue was with access, can you please accept the answer. Or provide your own in case the fix was something else? ... View more

@proylea... Please go ahead and accept his answer so that this question gets marked as Answered. Only difference with coming up with proper field extraction would have been that you would have got a chance to avoid join and also would have saved field extraction for easier use in search query as a knowledge object. I am glad you have a fix!!! ... View more

Get only the most recent record by using head 1 (you can also try dedup). Then alert if the status=stopped i.e. result count >0 for the following query index=windows host="hostname" sourcetype="WinHostMon" Name=mysql status=* earliest=-5m latest=now | head 1 | search status=stopped ... View more

You should be able to use accum command to achieve what you need. If you are using timechart command to aggregate vehicle_count using min(), you can use as to provide it a simple alias to be reused further down the query for example. | timechart min(vehicle_count) as vehicle_count | accum vehicle_count as vehicle_count If you wish to retain existing fields you can provide a new name after as. ... View more

Could you please provide more context in terms of what kind of results to be stored in table? I am not sure if this fits in to your requirement... Please check outpulookup command to push search results to a csv file and that csv file can be referenced by another search commands. ... View more

@smaran06 What happens when you run. Do you see epoch time? | inputlookup lookup.csv|eval Logging_Time= strptime(Logging_Time,"%Y-%m-%dT%H:%M:%S.%3N%z")|table Logging_Time In your example you have Application_name as field name and you are performing filter based on application field name in your query. In your example you have application names like App1+, App2+. Are they the exact values? Based on whatever is the Application name in your lookup file please try the following instead of where: | inputlookup lookup.csv|search application="APP1*"| eval Logging_Time= strptime(Logging_Time,"%Y-%m-%dT%H:%M:%S.%3N%z")|table Logging_Time application With the second query that you have run, seems like the issue is with where condition itself. Try the following search as well and see if application is printed. inputlookup lookup.csv|where application="APP1" | table application ... View more

@722624... Have you tried escaping special characters in your search string with backslash \ ? Also use TERM() for defining exact term for search. https://docs.splunk.com/Documentation/Splunk/latest/Search/UseCASEandTERMtomatchphrases ... View more

@keerthana_k... have you checked following Splunk Answers? seems like it is login.css which needs to be updated : $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/css/login.css https://answers.splunk.com/answers/59008/change-the-login-page-and-master-page-of-splunk.html Also for Splunk login customization all configurations have been listed on Splunk Documentation link: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomizeLogin ... View more

You just need to change from last to max() <Your Base Search> | stats max(value) as MaxValue by source ... View more

@mintughosh...So what you mean to say that , when you do not have index present in your base search you are not able to search events just based on sourcetype or host. Is that correct? If this is so, it is linked with the way your Splunk User Role has been created. A default index can be set for your role so that index value is defaulted to the same when index is not specifically mentioned in the base search (through Indexes searched by default). Ideally you should make sure that your base search always has at least index and sourcetype. If other key fields like host and source (index time field extractions) or search time field extractions can be included that would be even better, because these tell splunk where to search(index), what data type to search (sourcetype) and any other additional filters. ... View more

@proylea, I have updated my query to include companyName. Also changed rex regular expression to pull email for both the events. However, as stated earlier, please create Field Extractions for both Activating and Processing events which are not Key Value pairs like user ID in Activating event. ... View more

@keerthana_k, I have converted my answer to comment so that it flashes for others as unanswered. ... View more

Custom Stylesheet should be placed for specific app under appserver/static folder. Following is the path: $SPLUNK_HOME/etc/apps/<YourAppName>/appserver/static Depending upon whether you want to apply CSS to specific Dashabord or all you can either create any CSS file and refer in your dashboard using <dashboard stylesheet="<yourStyleSheetName.css>"> Or <form stylesheet="<yourStyleSheetName.css>"> If you want to apply your CSS changes to all dashboards in your app, you should be creating a CSS file called dashboard.css and place the same in appserver/static folder as mentioned above. Refer to the following Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/UseCSS You can also refer to Custom Layout Example: Dark example in the Splunk 6.x Dashboard Examples app from Splunkbase. ... View more

[Updated] Based on the changes in Activating and Processing events, I have changed the rex command. However, you should definitely use Field Extractions for the two events. Since companyName is Key Value pair, I expect the same to be available during Search Time as Interesting Field. I have added companyName in the stats command. If your goal is to find the users who have Processing action but no Activation action event you can try the following: index=sit_ces "Processing user with email address" OR "Activating user with the email address" | rex "(?i)(?<action>\w+) user with[\w|\s]+email address[\s|\=]*(?<email>[\w|\d|\.|\@]+)" | stats count as actionevents values(action) as action min(_time) as EarliestAction max(_time) as LatestAction values(companyName) as companyName by email | search actionevents>1 action="Processing" and action="Activating" | eval duration=EarliestAction=LatestAction | fieldformat EarliestAction =strftime(EarliestAction,"%c") | fieldformat LatestAction =strftime(LatestAction,"%c") PS: I have used simple regex for the example, however, you should try Extract new fields from search results to make use of Splunk's Interactive Field Extraction to come up with regular expression as Field Extraction knowledge object. That way above fields will be available at search time and you do not have to explicitly perform rex command (easy maintenance of code). ... View more

When you search events by index in verbose mode, are you able to see sourcetype and host? Have you tried clicking on them and adding to the search by choosing Events with this field option from Selected Fields menu in the left side below the Search bar? ... View more

@mblauw, can you please explain the reason for linebreak? Are you trying to parse/read JSON KV pairs? If so, you can try spath command instead. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath#7:_Extract_and_expand_JSON_events_with_multi-valued_fields Also, as you have mentioned, if you are getting data file itself as json, Splunk should already do search time field extraction for you. Refer to KV_MODE settings for JSON data in props.conf. http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf ... View more

@srichansen... the query that returns you multiple values. Can it be further granulated through any key field so that it only returns whatever value you have at index 0 and 1(preferably filter in the base search itself)? ... View more

In terms of documentation what I can suggest is going to the following for choosing correct method for correlation: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation Please accept this answer if this has helped you, or else provide your own answer and accept the same. ... View more

@srichansen transaction command generates a field called duration which is the difference in seconds betwee first and last event in the transaction. Similar to transaction you can create a search using stats and compute your own duration using min(_time) as FirstStopDepartureTime and max(_time) and LastStopArrivalTime ... View more