I could be wrong here, but fairly certain your issue is that you no longer have the literal _time field, which is required for the timechart command. Example: | makeresults count=3 | timechart count This works. | makeresults count=3 | eval time=_time | table time, count | timechart count This doesn't work. Rename/coalesce your time variables to _time and give it a shot? ... View more

I'd suggest taking a look at the documentation, Splunk usually offers examples at the bottom of their docs pages https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Makeresults#Examples. The command doesn't actually create any "events", it looks like. It just creates "statistics" to play around with. For example, if you wanted to alert on something like "what happens when a field has a value of X", you could play around with the syntax like this: | makeresults count=3 | streamstats count | eval fieldToAlertOn=case(count=1, "I'm Fine", count=2, "ALERT", count=3, "null") | search fieldToAlertOn="ALERT" In this example, I create 3 fake rows, use streamstats to effectively number them, add a field with an eval / case pairing. You can then set this up as an alert and ensure that it successfully triggers, sends the right message to the right location, etc. You can probably extrapolate this to whatever case you need! ... View more

Have you played around with relative time modifiers such as @h? https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/SearchTimeModifiers#Searching_the_time_and_fields In this sense, you can have everything snap to the nearest hour, for example: relative_time(now(),"-h@h" will snap to 7 PM whether you run this at 8:02 PM or 8:47 PM. ... View more

Have you tried setting the token drilldown in the XML, and then using that variable? That works for me. However, I'm not using the gentimes command, instead just using the earliest and latest in a where clause downstream. Example: <set token="time">$click.value$</set> K, I can't get the drilldown tags to format but that should be within drilldown tags in the XML ... View more

Hi - are you able to find it by looking at the xml for the dashboard in {SplunkMachineName}{SplunkPath}\etc\apps\app(default|local)\ui\views? ... View more

Perhaps I'm misinterpreting the question, but are you just asking how to edit permissions on knowledge objects so everyone has access to it? The person who created the object (alert/dashboard) can edit it using the edit functionality in the top right corner of the dashboard/alert to change the permissions to app and by role. Additionally, if the person isn't with the company or can't do this themselves, an admin can go into Settings (top right corner of the Splunk UI) -> All Configurations (bottom of the "Knowledge" list in the dropdown) -> Search for the name of the object -> change the permissions to be not private under the "Sharing" section. Did this answer your question? Sorry if I misunderstood! ... View more

Hi - I think you can leverage the match command (https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/ConditionalFunctions#match.28SUBJECT.2C_.22REGEX.22.29) to achieve your desired outcome: | makeresults count=1 | streamstats count | eval field=case(count=1, "INTPAY\\TD_EFT\\") | eval field2=case(match(field, "TD_EFT"), "1") You can improve upon the regex outside of my suggestion if you'd like. Hope this helps! Please accept the answer/upvote if it does. ... View more

I would suggest checking out the subsearch to make sure the results are actually there. This should work if you have the syntax correct and the subsearch is returning anything. You can also experiment by not pulling in the csv and just using the | makeresults count=1 command to generate test data before you append on the other information. Another option you can try is to use the append=t parameteron your search so you don't have to do a subsearch. This is a better option performance wise as subsearches are not particularly performant. Basically, format the search to be what you want (has the right columns) and then just use the | outputlookup newlookupfile.csv append=t command to add a new row. Let me know if this helps! ... View more

Use a second token? Create a new variable with an eval statement and have the where clause be something like this? | where earliestTime < lt AND lt < latestTime I don't know what best practices are for reposting...this is tiny enough that I think it's fine, but always happy to get more karma points if you want a more full answer/see if other people have different thoughts. I typically go with the two token input model though. ... View more

Hmm...you could do an extraction at index time but that might be even more expensive and is outside my expertise, but could be worth a different question. Glad I could help! Please accept the answer if you get a chance. ... View more

You're right that it will pull events in based on their actual timestamp, that being said, you can have a longer alert window (however long the difference is b/w timestamp and indextime) and then alert with a filter. For example, something like a 2 hour lookback, but still run the alert every 5, 10 or whatever timeframe you want, and filter down to that timeframe: search from above... | where _time>relative_time(now(), "-5m@m") This will just alert you on when index time occurred in the past 5 minutes, regardless of what logs you pulled in. There isn't a great solution otherwise if you're running into an issue where index time and log time are very different that I know of. Does this make sense? ... View more

Are you certain the alert should have been triggered? (i.e. you ran the search over the time frame of an alert and it had a value greater than .8?) If so, you can look in the _internal logs to see why the alert (search index=_internal {nameOfAlert} ("error" OR "fail") ) wasn't working. Otherwise, could you clarify what you're asking? ... View more

If you have access to your monitoring console https://docs.splunk.com/Documentation/Splunk/7.3.2/DMC/DMCoverview (under Settings -> Monitoring Console [lower left panel]) and can drill down into the Search dropdown (Search -> Search Activity: Instance) there are a number of searches that are pre-written that give information on who ran what searches when. This has the "Provenance" field, which can be a dashboard, and the search looks like it uses the _introspection index. I would suggest starting here as this will likely offer you more information than anything a single answer here can provide, I use the console a ton and have learned a lot about our deployment and usage from it. Hope this helps! ... View more

Hi - so I have a few thoughts here, but I like the following one if you're willing to sacrifice a bit of performance. Basically, you will split the results into 5 bins, and then send the alert "for each result" as opposed to once as the trigger option: | makeresults count=200 | eval field="hello" | streamstats count | bin count bins=5 | stats list(field) by count This example creates 200 results, gives them all a field value, counts each row, bins the count into 5 bins, takes the list (you probably want values if it's non-unique list of records) to compress the results into 5 distinct sets of results in a multivalue field. Then, you can select the trigger to be for each result instead of just once, and this should solve a simple use case for you. You might want to do some work with mvzip to tie multiple fields together if you're trying to just create one mvfield to send the info through. Hope this helps! ... View more

Can you write out some example data? I'm having a hard time coming up with a catch all answer for a few different cases I can think of that you might be talking about, and don't want to lead you down the wrong path! ... View more

I think you're on the right track with wanting to do eval and if/where clauses, but first you need to parse that JSON field. The best command for that is spath https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Spath#Basic_examples, so the syntax could be something like index=whatever... | spath field1 output=name | spath field2 output=pricePerOne | eval pricePerOne=case(name="Item1", pricePerOne*5, name="Item2", pricePerOne*3) This should handle extraction and more neatly multiplying the pricePerOne field if you want it to always be multiplied by a constant. Since I don't know the exact structure of your JSON you might need to play around a bit with the spath command before you get the output how you want it, but I think this is a path that might work for you. Let me know if this helps! ... View more

I don't see a screenshot - can you give a sanitized version of the result up to where you're happy with the output to that point? (i.e. what is the result before you're trying your spath command) ... View more

What would you want the range to be? I would imagine you either want to take the min, max, or average in a stats command, or you would want to separate each of these into their own rows with an mvexpand command. I don't know if applying a single value range over a multivalue field makes sense to Splunk ... View more

Can you add a sort on the _time field before you run streamstats? This should persist through: | sort _time asc The params you can play around with for sort are +/-, asc/desc, and the limit on how many fields to sort: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/sort#Syntax ... View more

I came up with this as a solution, but there are likely quite a few: index=whatever earliest=-3m | timechart count span=1m | eventstats max(count) as maxCountOverTime This doesn't take into account any of your evals, but effectively I got 3 buckets and then the eventstats took the highest one and slapped it on all the row's values for maxCountOverTime. eventstats basically does what stats does (does aggregation by buckets) but instead of filtering down to just that result set, it goes back to the previous one and adds the newly aggregated data where applicable. Docs can be found here https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Eventstats. Let me know if this helps! ... View more

I don't fully grasp which of the 4 values in label should go into which of the 3 buckets, but for LOC_ID you can use rex like anthony suggested or used substr if you know that it's always 16 digits https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/TextFunctions#substr.28X.2CY.2CZ.29. The syntax is as follows: |eval Country=substr(LOC_ID, 1, 4) and this would take the first 4 digits of LOC_ID and create a new field called Country. You can do this for the other 3 as well. I like substr because it gives you a lot of string flexibility without the complexity of regex. If you clarify the LABEL question I had I might be able to help there as well. ... View more

I have a couple thoughts here, none of which actually natively tie together the two result ids and send them combined in one email. That being said, here are some alternatives I can think of: 1) If the datasets are compatible, have a longer search that displays both sets of results. You can use the fillnull command to fill any whitespace in a table if it's bothering you that an entire column is null, for example. 2) Export both search results to csvs ( outputlookup command) and pull those in as part of one search that sends an email of both contents combined ( inputlookup command). This is similar to 1 but if the searches are hard to combine, this is likely a better option than an ugly join or append . 3) Assuming they have read access to whatever app the content will live in, you could save the scheduled searches to a dashboard and link the dashboard as part of the alert. I do that pretty often. 4) Write a custom alert action to pull in multiple data sources and does some custom action/js/html on it (this one is likely an add one to 1 or 2) Personally, I like 3 if your consumers have the access/knowledge, because they can most easily play around with any results from Splunk than from an email. If not, 1 or 2 should get the job done if you can deal with likely empty overlapping information. ... View more