The distinct_count (dc) function will give the unique values of a field. ErrorCode=4624 user!="*$" | timechart span=1d dc(user) as "Unique Users"     ... View more

Nothing "happens".  It's legitimate for a sourcetype to be present in more than one index.  It may complicate your query, though. ... View more

You can't retrieve the index from the log if it isn't there, which is the case for these events.  You'll have to search for the index by sourcetype. | tstats count where index=* sourcetype=data_sourcetype | fields - count ... View more

There are a couple of ways to get the desired field from the ID. | rex field=ID "-(?<Delimited_ID>[^-]+)" ``` OR ``` | eval tmp = split(ID, "-") | eval Delimited_ID = mvindex(tmp,1) Use the new field in a stats command just as you would any other field. | stats count as Count by Delimited_ID, HTTP_responsecode   ... View more

To have different cron schedules you have to clone the alert and set a separate schedule for each copy. ... View more

You can specify the exact hours you want the alert to run. 0 0,6,12 * * * ... View more

How big are the events?  Splunk default to 200 field extractions, IIRC.  Also, what type of data is it?  I've seen problems extracting JSON data, especially nested JSON. ... View more

We need more information. Are you trying to extract at search time or index time?  Are you trying keep the XML or discard it?  Please share a sanitized sample event or two. ... View more

Since the vt4splunk app uses the VirusTotal API, it will not work off-line. ... View more

Make sure you're running the search in Verbose mode.  In Smart mode, Splunk only extracts fields explicitly referenced in the query. ... View more

Thanks.  I don't have a lot of experience with the JSON functions, but I think this should help. index=index1 sourcetype=sourcetype1 hostname=* software != "" | eval software=mvexpand(json_array_to_mv(software) | rex field=software "cpe:\/a:(?<Vendor>[^:]+):(?<Product>[^:]+):(?<Version>.*)" | table hostname, Vendor, Product, Version | dedup hostname, Vendor, Product, Version  The idea is to convert the software field from a JSON array into a multi-value field so it can be split into separate events using mvexpand. ... View more

There is no one API that will return all of the KOs owned by a given user.  You will have to combine multiple API results to get the full list. | rest /services/saved/searches ``` Searches, reports, alerts ``` | rest /services/data/ui/views ``` Dashboards ``` | rest /services/data/macros ``` Macros ``` | rest /services/data/lookup-table-files ``` Lookup files ``` | rest /services/saved/eventtypes ``` Eventtypes ``` Those are some of the more common ones.  See other available API endpoints using | rest /services/data or | rest /services/saved ... View more

Either the data in the summary index is incorrect or it's being used incorrectly.  Was the data written using an si* (sistats, sichart, sitimechart, etc.) command?  If so, then it must be read using the same query and the non-si (stats, chart, timechart, etc.) command. Tell more about the two queries and we may be able to be more specific. ... View more

So, mvexpand may work, but it depends on how you got into this position to begin with.  What's the query? ... View more

Check out the filldown command. ... View more

Use the relative_time function to calculate time offsets. | eval new_time = relative_time(now(), "+1d@d+10h") The format string breaks down as follows: "+1" : this time tomorrow "@d": round off the time to 0:00 "+10h": add ten hours   ... View more

It's possible Splunk doesn't like the \b metacharacter.  Try this alternative. SEDCMD-redact_ssn = s/(\D)\d{3}-?\d{2}-?\d{4}(\D)/\1XXXXXXXXX\2/g I also modified the regex to preserve the characters before and after the SSN and to make the hyphens optional.   ... View more

Use the frozenTimePeriodInSecs setting in indexes.conf to control how long data lives in the index. [myindex] frozenTimePeriodInSecs = 604800   ... View more

If you're new to Splunk, I strongly recommend you NOT install multiple instances of Splunk on the same server.  Doing so is a tricky practice that requires more than just separate subdirectories.  You must also ensure each instance uses different ports and that those ports are configured on other instances correctly. If you install instance per server then you can keep the home directory as the default /opt/splunk and avoid the problem you are having. I suspect the problem stems from the home directory assigned to the user running Splunk.  Try changing that directory to /opt/splunk_sh. ... View more