Hi, i tried to use your regex with regex101 and they do not match correctly. What you want, is a regex that captures everything up to the string you want to mask, and everything behind. Then, in the FORMAT field you use the first capture group, set your mask in the middle and use the secodn capture group. Try this: [record-anonymizer] REGEX = (?m)^(.*)record_number\\\=\d+(.*)$ FORMAT = $1record_number=##$2 DEST_KEY = _raw [first-name-anonymizer] REGEX = (?m)^(.*)shipping_first_name\\\=\w+(&.*)$ FORMAT = $1shipping_first_name=##$2 DEST_KEY = _raw [last-name-anonymizer] REGEX = (?m)^(.*)shipping_last_name\\\=\w+(&.*)$ FORMAT = $1shipping_last_name=##$2 DEST_KEY = _raw Greetings Tom ... View more

Hi, not sure what you want to achieve exactly. But for your field, how about this field extraction: your search here | rex max_match=0 "Unregistered the uri\s(?[^\n]+)" This puts the results per event in one multi value field called "new_field". Is this what you wanted to do? Greetings Tom ... View more

Hi, the feature you are searching for is called deployment server and forwarder management. https://docs.splunk.com/Documentation/Splunk/7.2.6/Updating/Aboutdeploymentserver You need to setup the feature once manually (cli, .conf) and you need to add the apps you want to deploy manually to the deployment server. Then you can decide which app will be deployed to specific forwarder and start the deployment, all by using the UI. Greetings Tom ... View more

Hi, there is an app on splunk base that should fit your needs. I havn't used it in a long time and the compatibility at splunk base says it is compatible up to splunk 6.5. Since it is basically a custom splunk search command it should work in current versions. https://splunkbase.splunk.com/app/1645/ If you want to have a more flexible way to compare your historic data against current values, you should try and get a glimpse of the examples in the Splunk MLTK. Greetings Tom ... View more

Hi, of course you can do that. The dashboards presented to you by the app are just build to let the user drilldown to another, more detailled dashboard. But you can create a new one, edit your dashboard (if you have the rights to do so), or copy the dashboard and edit it if you want. What you need to do, is to edit the drilldown feature of the panel. You can decide where the drilldown is going. This can be an other dashboard, the raw data or you can have another panel open up on the same dashboard that shows further information. For more information: https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/DrilldownIntro ... View more

Can you check your browser console (press F12 for most browsers) for errors, so we can exclude client / browser / js problems? ... View more

I had the same issue in a project. In my case the problem was performance. Behind the scene, the results of your search are written to disc and then read again to be indexed. If the delay is high, the machine you are running on might be fully utilizied or has slow IO performance and is just not able to quickly index your data. you should expirience the delay also for other data and indexes. ... View more

Can you show us a screenshot of how the data looks in splunk? is the example you posted one large event in splunk, or are there multiple events? ... View more

Hi, i do not know the exact definition of this field. But for my experience, it says that in your case 80% of your configured summary range is accelerated (for example 32 out of 40 days). If this value is not progressing, you might have to many running searches. The data model acceleration is driven by scheduled searches in the background. Can you check the management console for skipped scheduled searches? Greetings, Tom ... View more

Hi, when i try this with my run everywhere example, everything works as expected. Maybe your xml is not correctly? For example the tags are not closed correctly? Also, the option is called outfield, not output. Here is the example, try your self: | makeresults | eval _raw="<tag1><tag2 name=\"foo\"><tag3>Test 123</tag3></tag2></tag1>" | xpath "//tag1/tag2/tag3" outfield=value ... View more

Hi, you could use this app: https://splunkbase.splunk.com/app/4030/ As far as i can say, it currently works smoother than the build in export function. Greetings, Tom ... View more

Hi, the Answer depends on how exactly your events look like. But in general you can do something with stats to get both fields in one event: your search | | stats list(Success) as l_success by id | eval Success=mvindex(l_success,0) I think to finally answer this question, we need more information about your events. Greetings Tom ... View more

Nice! be aware, sort is quite performance heavy. Therefore, it is limited to 10,000 events by default, which in this case we exceeded with the help of the limit=0 option. But if your search is still fast enough for your use case, you now have a solution 🙂 ... View more

Hi, there was already a similar questions. It has to do with the differences between indextime and searchtime field extraction. More inforomation here: https://answers.splunk.com/answers/411019/whats-the-difference-between-hostabc-and-hostabc.html Greetings Tom ... View more

Ok, got it now. I don't think there is a out of the box solution for this. I think you can append the csv with append and then check if any entry in the holiday csv is today: append [|inputlookup holiday.csv | eval time = strftime(now(),"%d/%m/%Y") | where time == Date] If your search returns something, the append should be empty, because it is not a holiday. If your search returns nothing, the append will result in an entry, because it is a holiday. Only Problem is, you get only one event instead of 3, so you would need 3 times the entry in your holidays.csv. Or you reconfigure your trigger condition. You should be able to use a custom trigger condition where you say trigger if count < 3 AND description = null. But therefore you might need to add a description field to the results of your search. ... View more

Hi, how does your holidays.csv look like? Does it contain timestamps, ranges of dates? There might be many ways to the right answer. You can for example take atheeval command and create a field based on _time that only has year.month.day left. If your holidays.csv file also is just a list of such year.month.day entries for every day that you consider a vacation day, you can just use it as a lookup and filter out every matching event. Greetings, Tom ... View more

Thats strange, i tried it for myself with a transaction search and it worked like i thought it would work. However, you can still do some streamstats and search magic. Append something like this to your search: | sort limit=0 _time | streamstats count by group | search count=1 | sort limit=0 -_time Does this help? ... View more

Hi, there is a field called date_year automatically extracted by splunk if your sourceype is configured correctly. You can use this field with stats. In your case | stats count by date_year Greetings, Tom ... View more

You can not search in the lookup file without specifying a field. A lookup does not run through the indexing pipeline and therefore isnt tokenized and does not have a_raw field for example, therefore you can not search just for text. But if your csv file has timestamps, you can of course just index your csv file, like you would index any other data. ... View more

Hi, you can of course just use the scripted alert action. The custom alert action is just more of a "framework concept". For example, you have better integration in the UI, where you can configure parameters for the script. You can package the script as an app and share it via splunk base or in your environment. Those things just makes it more flexible. If you do not need this flexibility, you might have no need to use a custom alert action. Greetings Tom ... View more

Hi, why is it not recommended to use Universal Forwarders? From my point of view you should use Universal Forwarders. Every instance which already have Splunk installed (SH, Indexers,...) can also act as a forwarder, just add the configuration in the outputs.conf. Alternativly, you could use something like syslog, send all data to a syslog server and collect them from there with a Universal Forwarder. Greetings Tom ... View more

Hi, can you provide a little bit more context? How do you want to search on the lookup? Do you have a search example? You can always use | inputlookup value.csv | search foo=* or you can use the where clause directly in the inputlookup command, which is better for performance: | inputlookup value.csv where foo > 0 You can find more examples in the inputlookup documentation: http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Inputlookup Greetings Tom ... View more