Hi, I don't know what to include in your require block but I can show how I'm doing a sleep in my JS function sleep(ms) { return new Promise(resolve => setTimeout(resolve, ms)); } And after creating this function you can use it like this await sleep(1000); Let me know if it helps you ... View more

I'm not 100% sure, but for me, your Heavy Forwarder should be consider more like an indexer than a forwarder, you should upgrade it in the same time that you upgrade your Splunk Enterprise to avoid any problems. ... View more

Hi ! I think this doc will tell you what you want to know : https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/Compatibilitybetweenforwardersandindexers From what I read, it should be good for you, you just can't send metrics 🙂 ... View more

Its maybe a problem with the lookup. Can you add this to your lookup command: | lookup prod product_id output product_name append=true Let me know if it help you ! ... View more

I tried this | makeresults | eval "Time period with no info" = "08:53:07-000" | where 'Time period with no info' = "08:53:07-000" and it seems to work so could you please send us the full search or maybe an example of your data to have more informations ? 🙂 ... View more

Hello, After sorting your data, you can try that : | streamstats count as nb | where nb > 20 This will remove the first 20 rows of your table 🙂 Let me know if it helps you. ... View more

Does your subsearch returns more than 50000 events ? Did you check the job inspector? Sometime your subsearch can also expire. Let me know about that 🙂 ... View more

You can try that | inputlookup host.csv | stats count by host | eval count = if(count > 0, count." machines","Any machines") Let me know 🙂 ... View more

And if you add | where foo != 0 AND bar != 0 at the end ? ... View more

Hello, Your problem here is using chart that will sort your data alphabetically. Try like that : My Base Search | eval date_wday=lower(strftime(_time,"%A")) | eval date_w=strftime(_time,"%d/%m") | where NOT (date_wday = "sunday" OR date_wday = "saturday") | timechart span=1d count(foo) as "foo", count(bar) as "bar" That should work for you, let me know 🙂 ... View more

Ok so something like that I guess: Base search | where NOT match(username,"\d") or with @vnravikumar solution (the regex one) Unfortunately, you can not do it directly in the base search. ... View more

Hi, You can try that: Base search | eval match = case(match(yourField,"^11\d{5}|,11\d{5}"),"YES",1=1,"NO") | where match = "YES" | fields - match Let me know if it works Kail ... View more

This might be a bit faster. Trying to not use distinct count here : | tstats prestats=f count WHERE index=* sourcetype=* by _time, host span=1mon | stats count AS distinct_host_count BY _time ... View more

Ohhhhhh wait i'm so sorry, didn't saw that you forgot to give a name to your field in rex I think that should work index=abc |rex field=_raw "MACHINE\:\s(?<Machine_Name>[^ ]+).*" | eval time = strftime(_time,"%Y/%m/%d %H:%M:%S") , node = host , resource = "Auto" , type = "Alarm" , severity = 1, Machine_Name = if(isnull(Machinecase),"no_machine",Machine_Name), description = "CAUAJM:" .CAUAJM ." STATUS:" . STAT . " JOB:" . JOB_Name . " MACHINE:" .Machine_Name. " with ExitCode:" .EXITCODE. " at:" . time . " Environment:AWP" ) | table node resource type severity CAUAJM job_event JOB_Name Machine_Name time description Hope it will work now... KailA ... View more

Ok but with the snippet of code I give it didn't return you CAUAJM:CAUAJM_I_40245 STATUS:JOBFAILURE JOB:GPW_AFF_PFX_DL MACHINE:No Machine with ExitCode:1 at:2018/11/08 08:04:05 Environment:AWP ?? ... View more

Thats strange, I've just copy/paste you eval for description and add an if() in it. But I think I understand what you wanted to do now, try that : index=abc |rex field=_raw "MACHINE\:\s(?[^ ]+).*" | eval time = strftime(_time,"%Y/%m/%d %H:%M:%S") , node = host , resource = "Auto" , type = "Alarm" , severity = 1, Machine_Name = case(isnull(Machine_Name),"NONE",isnotnull(Machine_Name),Machine_Name,1=1,"unknown"), description = if(isnull(Machine_Name),"CAUAJM:" .CAUAJM ." STATUS:" . STAT . " JOB:" . JOB_Name . " MACHINE:No Machine" . " with ExitCode:" .EXITCODE. " at:" . time . " Environment:AWP","CAUAJM:" .CAUAJM ." STATUS:" . STAT . " JOB:" . JOB_Name . " MACHINE:" .Machine_Name. " with ExitCode:" .EXITCODE. " at:" . time . " Environment:AWP" ) | table node resource type severity CAUAJM job_event JOB_Name Machine_Name time description Let me explain : if your Machine_name field is null, it will return the descrption with MACHINE:No Machine (put whatever you want here), if not, it should return the full description. ... View more

Hi, I think we can use an if to fill your description field like that : index=abc |rex field=_raw "MACHINE\:\s(?[^ ]+).*" | eval time = strftime(_time,"%Y/%m/%d %H:%M:%S") , node = host , resource = "Auto" , type = "Alarm" , severity = 1, Machine_Name = case(isnull(Machine_Name),"NONE",isnotnull(Machine_Name),Machine_Name,1=1,"unknown"), description = if(isnull(Machine_Name),"Write your comment here","CAUAJM:" .CAUAJM ." STATUS:" . STAT . " JOB:" . JOB_Name . " MACHINE:" .Machine_Name. " with ExitCode:" .EXITCODE. " at:" . time . " Environment:AWP" ) | table node resource type severity CAUAJM job_event JOB_Name Machine_Name time description I think that should do the trick 🙂 Let me know KailA ... View more

Hello, I think it's just a little mistake you made in the first search. Should be like this i guess index="web_access" host="mywebhost1" OR host="mywebhost2" | timechart span=15m dc(clientip) That should give you the number of unique IP adress in 15min buckets. Kail ... View more