This is because you use a 5* in the if statement, that does not work. You have to add a like() (pro tip: for easier reading and understanding move eval out of stats - no performance impact at all 😉 😞 source="Dataset_Finance.csv" host="sample" index="dataintegration" sourcetype="SampleFinance" ObjectAccount="4*" OR ObjectAccount="5*" | eval Sales=if(ObjectAccount="411010",DomesticAmount,0), Costs=if(like(ObjectAccount, "5%"),DomesticAmount,0) | stats sum(Sales) as Sales, sum(Costs) as Costs | eval CM=Sales+Costs | eval CMPer=CM/Sales cheers, MuS ... View more

Hi FritzWittwer, If this is only related to new events, you can use this approach here https://answers.splunk.com/answers/354923/how-do-i-route-events-into-different-indexes-based.html which will rewrite the _MetaData:Index field based on the event content. Existing, already index events need to be transferred using some export method or the collect command but this was marked as not an option. Hope this helps ... cheers, MuS ... View more

A capturing group is basically within ( ) have a read here https://answers.splunk.com/answers/214487/can-i-extract-a-field-with-a-regexed-dynamic-field.html where I used two capturing groups $1 and $2 both were created using this regex ([a-z]+)=([a-z]+) . Also starting a regex with .* is .... let's call suboptimal because it matches everything. I would optimise the nullQueue regex to match the things you don't want and skip the [passthru] completely 😉 cheers, MuS ... View more

Usually $1 refers to the first capturing group, but I don't see a capturing group in your regex? ... View more

Hi yu94, as admin user you can run this search: | rest /servicesNS/-/-/data/indexes | table title eai:acl.app | rename "eai:acl.app" AS app title AS index | stats count values(index) AS index by app to get a table of indexes per app. If you don't have the admin role assigned, ask your friendly Splunk admin to create a saved search and report/dashboard for you. Hope this helps ... cheers, MuS ... View more

I messaged the docs team to verify with dev team this works this way and if so update the docs 😉 cheers, MuS ... View more

Hi mstark31, What version are you on? Because this works just fine on 6.6.3 using this search: | makeresults | eval Reason="Thing1 / Thing2" | eval Bool = case(Reason=="Thing1 / Thing2", 0, 1=1, 1) | eval Bool2 = case(Reason=="Thing2 / Thing2", 0, 1=1, 1) cheers, MuS ... View more

Hi dddillic, If you want to see the config for the mail server you can use either of these commands: | rest /services/configs/conf-alert_actions/email | table mailserver or $SPLUNK_HOME/splunk btool alert_actions list email and look for the mailserver option. Hope this helps ... cheers, MuS ... View more

so this regex .+\"(?<json_data>{.+})\" matches everything in the { } try this props.conf setting as kyaparla suggests and also move the { } out of the capturing group: EXTRACT-json_data=.+\"{(?<json_data>.+)}\" ... View more

Can you please post some sample events? ... View more

Just try it and you will see that it just gets events from either the 1. September OR the 6. September in the most efficient way 😉 cheers, MuS ... View more

Hi chetanhonnavile, you can use multiple time modifiers in your search, just try this: your search here earliest="09/1/2017:00:00:00" latest="09/1/2017:23:59:59" OR earliest="09/6/2017:00:00:00" latest="09/6/2017:23:59:59" This will return the events from your base search on the 1. September or the 6. September. You can read more about the time modifiers here http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers Hope this helps ... cheers, MuS ... View more

Hi bjaylsu, have a look at this answer https://answers.splunk.com/answers/305328/how-to-search-the-names-of-triggered-alerts-their.html#answer-306463 it will provide you a search that creates a report of triggered alerts and their thresholds. Be aware that you need to have the admin role assigned to be able to access index=_audit Hope this helps ... cheers, MuS ... View more

Sure, but the transforms would look like this: [stanza_name_goes_here] SOURCE_KEY = MetaData:Host REGEX = 192\.168\.3\.217 DEST_KEY = _MetaData:Index FORMAT = SomeIndexNameGoesHere ... View more

Additionally to this advice, use a base search and post process the results http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Post-process_searches_2 As base search use a search that skips the join and use stats instead, read here http://sideviewapps.com/slides/2017_05_02_sideview_let_stats_sort_them_out.pptx to get some create advice on how to use stats or here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html cheers, MuS ... View more

Well your request is indeed very simple, though there is not much I or anyone can do to help. Since you have the power user role and not admin you cannot access the index _audit and therefore will not be able to get the search working. Ask your friendly Splunk admin to create a report for you or to schedule a saved search which feeds into a summary index so you can run the reports on the summary index. cheers, MuS ... View more

If you remove the last | gauge ... search command you will see what each of the values represent. But here is the what they mean: x = usedGB (License usage for today) y1 = gauge_base (License base) y2 = gauge_danger (License usage 80% of total license size) y3 = totalGB (License total size) y4 = gauge_top (License total size plus 1Kb) cheers, MuS ... View more

Okay, can you please explain what is not working for you? You need to have the admin role assigned to use the search posted in the original answer. ... View more

Hi DimkoBilanko, using the following search I was able to produce the table result you expected: | makeresults | eval _raw="{\"result\":{\"addr\":\"456hR5drYrYrdY5wTYreYrdyerYe6y\",\"workers\":[[\"host04\",{},29,1,\"80000\",0,22],[\"client3001\",{\"a\":\"0.27\"},1,1,\"80000\",0,22],[\"host02\",{\"a\":\"0\"},16,1,\"80000\",0,22],[\"host06\",{\"a\":\"0.27\"},4,1,\"80000\",0,22],[\"client52\",{\"a\":\"0.27\"},10,1,\"80000\",0,22],[\"host03\",{\"a\":\"0.54\"},5,1,\"80000\",0,22],[\"host01\",{\"a\":\"0.54\"},26,1,\"80000\",0,22],[\"host08\",{\"a\":\"0.53\"},3,1,\"80000\",0,22],[\"f05\",{},19,1,\"80000\",0,22],[\"client4004\",{\"a\":\"0.27\"},76,1,\"80000\",0,22],[\"host05\",{\"a\":\"0.54\"},36,1,\"80000\",0,22],[\"host07\",{},6,1,\"80000\",0,22],[\"client5004\",{},2,1,\"80000\",0,22],[\"client3002\",{\"a\":\"0.27\"},7,1,\"80000\",0,22],[\"client4003\",{\"a\":\"0\"},111,1,\"80000\",0,22],[\"host02\",{\"a\":\"0.54\"},25,1,\"80000\",0,22],[\"client9006\",{\"a\":\"0.53\"},21,1,\"80000\",0,22],[\"client6001\",{\"a\":\"0.55\"},9,1,\"80000\",0,22],[\"P4003\",{\"a\":\"478.71\"},1937,1,\"256\",0,24],[\"P6001\",{\"a\":\"349.75\"},1936,1,\"256\",0,24],[\"p9006\",{\"a\":\"225.7\"},1936,1,\"128\",0,24],[\"P5004\",{\"a\":\"369.91\"},1936,1,\"128\",0,24],[\"P3002\",{\"a\":\"522.23\"},1937,1,\"256\",0,24],[\"P52\",{\"a\":\"449.7\"},794,1,\"256\",0,24],[\"P4004\",{\"a\":\"551.24\"},1643,1,\"256\",0,24],[\"P6004\",{\"a\":\"406.18\"},1936,1,\"256\",0,24],[\"P3001\",{\"a\":\"377.17\"},1788,1,\"256\",0,24]],\"algo\":-1},\"method\":\"stats.provider.workers\"}" | spath | table result.workers{}{} | rename COMMENT AS "Above code is used to create events" | rename result.workers{}{} AS results | makemv results | mvexpand results | rex field=results max_match=0 "(?<_raw>\w+\d+\s(\d+\s){4}\d+)" | stats values(*) AS * by _raw | rex "(?<host>\w+\d+)\s(?<value1>\d+)\s(?<value2>\d+)\s(?<value3>\d+)\s(?<value4>\d+)\s(?<value5>\d+)" | fields - _raw results This may work for a small set of events, but can break for a larger set of events because of the mvexpand command. I would suggest to use props.conf to create a search time field extraction using this rex (?:\[\[|,\[)\"(?<host>\w+\d+)\",(?:\{\}|\{\"a\":\"(?<value1>[^\"]+)\"\}),(?<value2>[^,]+),(?<value3>[^,]+),\"(?<value4>[^\"]+)\",(?<value5>[^,]+),(?<value6>[^\]]+) to create the fields and values. Hope this helps ... cheers, MuS ... View more

I will check that we I have access to an instance that has alerts enabled. Just one thing for now, rest calls are ignoring time but I'm sure there is some information available to see when an alert was triggered. ... View more

Hi kiran331, May not be the best answer, but at least an idea: On the forwarder create a scripted input http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptedInputsIntro that polls the current system time and puts it into a value of a field of your choice. This way you can index the time on the windows machine running the UF. In Splunk Enterprise then need a scripted input or custom search command http://docs.splunk.com/Documentation/Splunk/latest/Search/AddthecustomcommandtoSplunk to poll/query a NTP server to be able to compare it with the time from the UF. But, my advise would be a different approach. Instead of hunting wrong times, why not check if NTP is configured on your windows machine? First configure NTP for all machines and then check if any of them are out of sync. Maybe this blog post can help https://blogs.technet.microsoft.com/heyscriptingguy/2015/05/27/powershell-time-sync-get-and-evaluate-synchronization-state/ ? Sorry not a windows person, just trying to be helpful 🙂 Cheers, MuS ... View more

Not an answer, but you can add the first two where statements into the base search like so: index=main sourcetype=cpumetric metric_name=CPUUtilization Environment="WEB" Average>2.00 cheers, MuS ... View more

Hi katzr, If you remove or modify the group or user on the LDAP provider, you need to tell Splunk to reload the authentication using either this REST call | rest splunk_server=* /services/authentication/providers/services/_reload or this CLI Splunk command ./splunk _internal call /authentication/providers/services/_reload -auth This will refresh/reload the LDAP provider information and your removed users/group should be gone. If the users/group is still visible, check with non-Splunk LDAP tools against the LDAP provider and see what you actually get back. Hope this helps ... cheers, MuS ... View more