I may be over-simplifying, but it looks like you really just need to replace the existing lookup with the search results. <<your search>> | outputlookup sample_test key_field=foo ... View more

I've had the best results by putting the trigger criteria in the search and then have the alert trigger when the number of results is not zero. <<your search>> | where (DCOEtransfercount=1 AND NDNCopycount=1) It's also possible your current settings would work by changing "and" to "AND" in the trigger condition. ... View more

What have you tried so far?  How did those efforts not fulfill your requirementss? Please review the sample events and output as they appear to be unrelated.  The table contains timestamps and application IDs that are not in the events.  ... View more

I'm not sure how that could happen.  The value of network_config is set by the eval command to either "port 80 blocked" or the original value.  Therefore, if network_config is null after the eval then it must have been null before the eval. Please share the full query to better help us understand the problem. ... View more

Yes, appendpipe can work with tstats.  Use caution, however, with field names in appendpipe's subsearch.  If the main search already has a 'count' field then use a different name in the subsearch. | tstats count where ... | appendpipe [ stats count as Count | eval message="Nothing to see here" | where Count=0 | fields - Count ] | <<table or stats command, etc.>>   ... View more

Create a report that uses REST to collect and present the desired information.  Set the report to Run As Owner then allow RoleA to read it. ... View more

Add an appendpipe command to the panel's search query. <<your query>> | appendpipe [ stats count | eval message="Nothing to see here" | where count=0 | fields - count ] | <<table or stats command, etc.>> The exact placement and content of the appendpipe depends on your query.   ... View more

See if this works better.  The sample event is not quite JSON so the JSON SPL commands won't work. That means parsing the event manually. | makeresults | eval _raw="[ {\"protocol\":\"value\",\"port\":\"value\",\"destIP\":value} {\"protocol\":\"value\",\"port\":\"value\",\"destIP\":value} {\"protocol\":\"value\",\"port\":\"value\",\"destIP\":value} ]" ``` Above creates test data. Remove IRL ``` ``` Strip off brackets and break at newlines ``` | eval data=split(trim(_raw,"][ ")," ") ``` Put each line in a different event ``` | mvexpand data ``` Extract fields ``` | rex field=data "protocol\":\"?(?<protocol>[^,\"}]+)" | rex field=data "port\":\"?(?<Port>[^,\"}]+)" | rex field=data "destIP\":\"?(?<destIP>[^,\"}]+)" | rename destIP as "Dest IP" | table protocol Port "Dest IP"    ... View more

I suspect one or more of the following apply. 1) The customer activated too many correlation searches.  They should disable the CSs for conditions they aren't interested in. 2) The CSs they do care about have thresholds that are too low.  The CSs should be modified so they are less sensitive. 3) The CSs are running too frequently.  Change their schedules so they run less often. 4) The CSs are not throttling.  Throttling prevents repeated notables for a condition that continues to occur and allows the analyst time to remediate the condition before another notable arrives.  See https://docs.splunk.com/Documentation/ES/7.1.1/Admin/Configurecorrelationsearches#Throttle_the_number_of_response_actions_generated_by_a_correlation_search ... View more

By default, the chart command shows only the top 10 values.  To see more than that, use the limit option.  limit=0 shows all values index=notable | search_name = *abc-xyz* | eval date=strftime(_time, "%y-%m-%d) | stats count by date, search_name | chart limit=0 sum(count) over date by search_name   ... View more

I would be interested in finding out how the value changed, but to change it back, use an eval command with if. | eval network_config = if(network_config="port 80 not allowed","port 80 blocked", network_config)   ... View more

Unfortunately, poorly-onboarded data stays that way forever.  That's why it's important to test the onboarding process before accepting new data.  I hope you've had a chat with the application team about that. There is the split SPL function that can be used in conjunction with mvexpand to break a field into multiple events.  That function separates the field based on a single character rather than a string so it won't work in this case. ... View more

Try putting this in one of your props.conf files [mysourcetype] LINE_BREAKER = ()\{"_cls ... View more

Using earliest=@d+7h latest =@d+18h restricts the search to events that happened during work hours.  The alert still runs 24 hours a day so, depending on what triggers the alert, you may still receive an alert after hours. To prevent an after-hours alert, change the cron schedule to run the alert only from 700-1800. 1-59/5 7-17 * * * Notice how the last hour is 17 so the last alert runs at 17:56 rather than 18:56. ... View more

By default, intermediate forwarders (IFs) are invisible.  There is nothing that says which IF an event passed through (or even *if* an IF was involved at all). To work around that, you will have to add configs to your IFs to have them add a field to every event.  That field would identify which IF processed the event.  One way to do it is to add _meta = forwarder::foo to the IF's inputs.conf file.  This line assigns the value "foo" to the field "forwarder".  You can change "forwarder" to any field you wish.  Of course, you must change "foo" to the actual name of the forwarder. ... View more

If "protocol":udp" contains an extra quotation mark before the colon then this SPL should do the job.  Otherwise, we may have to resort to rex commands. <<your dhxquery command>> | extract pairdelim=",\"", kvdelim=":" | rename protocol as Protocol, port as Port, dest_IP as "Dest IP", direction as Direction | table Protocol Port "Dest IP" Direction ... View more

Have you tried escaping the quotation mark?  Just a guess. | dbxquery connection = visibility query = "select name, content from TestDB where content like '%number\":123%'"   ... View more

Thanks for that information.  This query may work better.  It converts check_date into an integer before computing the max value. <<your current search for events>> | eval i_check_date = strptime(check_date, "%d/%m/%Y") | eventstats latest(i_check_date) as max_check_date by src_name | where i_check_date=max_check_date | fields - max_check_date i_check_date ... View more

I suspect you were too literal in applying my answer.  Try this index = xyz sourcetype =abc | eval Status=case(Statistic=0,"Green" , Statistic=2,"Red", Statistic=1,"Blue", 1==1, " " ) | appendpipe [ stats count | eval Status="Black" | where count=0 | fields - count] | stats latest(Status) ... View more

Use the appendpipe command to add values when none are returned by your query. <<your search>> | appendpipe [ stats count | eval colour="black" | where count = 0 | fields - count]   ... View more

There are a few reasons for data to disappear from a lookup. 1) Someone restored an old backup/export. 2) Someone modified the lookup using the Lookup File Editor app or a CLI editor. 3) Someone ran a search that overwrote the lookup with old data. There may be other explanations, but none I can think of would be Splunk's doing. ... View more

It is not possible.  The format command (either implicit or explicit) is not that flexible. ... View more