Hi skoelpin, add a text field like this: <input type="text" token="ip"> <label>IP</label> <default>*</default> <prefix>'IP Address'="</prefix> <suffix>"</suffix> </input> and use the $ip$ token in your search like this: <table> <search> <query> index=access OR index=main | transaction RTG_JSession | stats count values(RTG_Browser) values(RTG_WebRequest) BY RTG_IPmain | sort -count | rename RTG_IPmain AS "IP Address" count AS "JSession Count" "values(RTG_Browser)" AS "Browser" "values(RTG_WebRequest)" AS "Web Request" | serach $ip$ | table 'Web Request' Browser 'JSession Count'</query> <earliest>-15m</earliest> <latest>now</latest> </search> </table> And just a tip: don't use field names which contain a space 😉 Hope this helps ... cheers, MuS ... View more

Hi sympatiko, there is a rss feed related to security and bug fixes http://www.splunk.com/page/securityportal/rss cheers, MuS ... View more

Hi Isedrof, I don't want to be mean nor rude; but like some famous answers member once said: You need to learn to walk, before you run @rich7177 and @woodcok pointed out some information. I think it can be done, but it is not worth the effort! Because you would have to get each single value for the user_name normalize them and compare each single character one by one. But as I said, this will take some effort and if I recall the trouble you had just to get this search working ...... Well, see You need to learn to walk, before you run My suggestion: clean up your data! Have the user_name in all sources to be the same and your done. Most of my costumers check their data before it will be ingested into Splunk and if the data is not in a useful format (any key=value pair will work fine) they simply reject it. This may be harsh, but it will pay off in the end! cheer, MuS ... View more

Hi lys1030, try this little regex: your base search here | rex field=F1 "(?<F2>[a-zA-Z])" | table F1 F2 Hope this helps ... cheers, MuS ... View more

Hi sushmitha_mj, did you create a root event for your data model? Data models are composed chiefly of object hierarchies built on root event objects, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Designdatamodelobjects#Add_a_root_event_object_to_a_data_model cheers, MuS ... View more

Hi isedrof, Just guessing here, but try this updated search: | inputlookup lookup_file.csv | search NOT [ search index=* source="index_file.csv" | dedup user_name| table user_name ] search NOT [|inputlookup lookup_file2.csv | fields user_name| dedup user_name] cheers, MuS ... View more

Hi zd00191, did you change the js script line 14 return _(['active_hist_searches', 'active_realtime_searches']).contains(cell.field); to match your fields? Also, remember to restart the Splunkweb using $SPLUNK_HOME/bin/splunk restart splunkweb and last but not least clear your browers cache. Hope this helps ... cheers, MuS ... View more