Hi @bud4, Please try below sample, there is no need to use join command; (index=index1 host=tnsm123*) OR (index=index2 sourcetype=db) | stats latest(Status) as Status latest(StartTime) as StartTime latest(EndTime) as EndTime latest(AvgRunTime) as AvgRunTime latest(BypassFlag) as BypassFlag by JobName ... View more

Very nice to hear you solved and thank you for the information.     ... View more

Hi @Nidd, You can use below query; index="myIndes" host=myHost source="/my/app/location/app.log" TYPE=ERROR | rex "message=(?<message>.+)" | table message | sort _time   ... View more

If not too many inputs seem to be migrated, you can copy the query and setting to create new inputs. It maybe a faster solution. ... View more

Hi @AL3Z, You can package your edited apps using Splunk Enterprise CLI command or Third-party utilities and CLI commands (Linux tar command). You can also check the following link for tar command examples. https://www.linuxtechi.com/tar-command-in-linux-with-examples/   ... View more

Hi @SplunkDash, Yes, correct. Then DBConnect app will show the DB2 driver installed. ... View more

Hi @SplunkDash, There is no specific installation info. You can install it like any Splunkbase app. It should be installed on the same server that DBConnect App working.  https://docs.splunk.com/Documentation/DBX/3.11.0/JDBCDB2/Install     ... View more

Hi @joshiro, You can try below migration script. https://docs.splunk.com/Documentation/DBX/3.9.0/DeployDBX/MigratefromDBConnectv1#Upgrade_and_migrate_instructions  ... View more

Hi @razzeri, Join command default type is  INNER which tries to match all possible fields. Can you try below? Assuming connection A is your Incidents table. | dbxquery query=[...] connection=A | join type=left max=0 INCIDENT_NUMBER [ dbxquery query=[...] connection=B]   ... View more

Hi @utkarsh__, You can use below query to find all exports including pdfs. index=_internal pdf (sourcetype=splunkd_access OR sourcetype=splunk_pdfgen) | stats latest(_time) as _time values(user) as user values(filename) as filename | eval output_mode="pdf" | append [ search index=_internal export sourcetype=splunkd_access | regex uri_path="(jobs|results|events)\/export$" | table _time user output_mode ]   ... View more

Hi @AL3Z, You can use 7z application to update tgz files in Windows. https://www.7-zip.org/download.html ... View more

Hi @gemrose, You can setup two alerts with below cron settings and time ranges using the same SPL; Mondays; Cron -> 0 8 * * 1 TimeRange --> -3d Other days; Cron -> 0 8 * * 2-5 TimeRange --> -24h     ... View more

Hi @sjs , You have a typo in your eval , you are missing n in buildAndTearDown, please try below; my query | rex "filterExecutionTime=(?<FET>[^,]+)" | rex "ddbWriteExecutionTime=(?<ddbET>[^)]+)" | rex "EXECUTION_TIME : (?<totalTime>[^ ms]+)" | eval buildAndTearDownTime=(tonumber(FET)) + (tonumber(ddbET)) | table totalTime FET ddbET buildAndTearDownTime   ... View more

Hi @sjs, You can use below eval; | eval row1=tostring(row1,"duration")   ... View more

Maybe you can try writing if you didn't already. Sometimes apps list only a few indexes but show when you write some letters. I cannot think of any other reason. ... View more

Hi @AL3Z, You can easily use inputlookup command. Assuming your subnets is in subnets.csv lookup with ip field.  And your events are in src_ip field. | search [|inputlookup subnets.csv | rename ip as src_ip]   ... View more

Hi @neerajs_81, I just replied on your previous question in the previous post. Please try below; index="firewall" sourcetype="proxy" | map search="search index="firewall" sourcetype="proxy" http_referrer=$URL$ OR http_referrer="-" | eval finalURL=$URL$ " | map search="search index="firewall" sourcetype="proxy" http_referrer=$http_referrer$ | eval finalURL=$finalURL$ " | search http_referrer="-" | dedup _raw | rename URL as originalURL | table finalURL originalURL ... View more

Hi @neerajs_81, Please try below sample with map command; index="web_proxy" sourcetype="proxy" | map search="search index="web_proxy" sourcetype="proxy" http_referrer=$URL$ OR http_referrer="-" | eval finalURL=$URL$ " | map search="search index="web_proxy" sourcetype="proxy" http_referrer=$http_referrer$ | eval finalURL=$finalURL$ " | search http_referrer="-" | dedup _raw | rename URL as originalURL | table finalURL originalURL   ... View more

Hi @ptur, You can find information about where to install apps below; Splunk App for Stream (https://splunkbase.splunk.com/app/1809  Forwarder management, dashboards, calculators, and admin tools Splunk Add-on for Stream Wire Data (https://splunkbase.splunk.com/app/5234  Knowledge objects for parsing Stream data for use by users. Installed on Indexers and Search Heads. Splunk Add-on for Stream Forwarders (https://splunkbase.splunk.com/app/5238  Network data collection tools for capturing network data, interpreting protocols, extracting custom fields, and sending to Splunk. Installed on Splunk Universal or Heavy Forwarders.   ... View more

Hİ @AL3Z, If you are using separate indexers or indexer clustering you may not see the indexes defined on indexers or cluster. If the app does not allow you to type index name your should manually add this test index to your SH index settings. After that, you will be able to select test index.  ... View more