Both stats and rare are transforming commands, meaning only the fields used in or produced by the commands are available to later commands.  So the only fields available after stats are count and SHA256HashData; and the only fields available after rare are SHA256HashData, count, and percent. To get additional fields out of stats, include them in the command.  To work around rare, use sort and tail. index=myindex | stats count, max(_time) as _time by SHA256HashData | sort - SHA256HashData | tail 10   ... View more

Confirm you see the HF's internal logs in Splunk Cloud (search for "index=_internal host=<<your HF name>>").  If you don't then the HF is not connecting to Splunk Cloud (did you install the Universal Forwarder app on the HF?) and that should be fixed first.  If the HF's logs are in the cloud then use them to determine why otel data is not getting in. ... View more

You could just take the last line using tail index="" source="" | fields queryHits | table queryHits | addcoltotals labelfield=total label="queryHits" | tail 1 but there's a better way to get just the total Index="" source="" | stats sum(queryHits) as queryHits   ... View more

I believe you can do that. ... View more

On which instance(s) did you install the TA? With what, specifically, do you need help? ... View more

To get a total number of users, use the stats command again. ... | stats count by IONS | where count >= 10 ``` So far we have one result per user. Count the number of results to get the number of users. ``` | stats count as IONS | rename IONS as "User IDs"   ... View more

The stats command can count the number of disconnects for each user.  Then filter out users with fewer than ten disconnects. index=gbts-vconnection sourcetype=VMWareVDM_debug "onEvent: DISCONNECTED" (host=host2) OR host=Host1) earliest=$time_tok.earliest$ latest=$time_tok.latest$ | rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds | stats count by IONS | where count >= 10 | rename IONS as "User ID"   ... View more

If you already have the search then click the "Save as" drop-down in the top-right corner of the window and choose "Alert".  The trigger condition is set in the lower part of the subsequent form. ... View more

Sure!  Just use the concatenation operator (.) in the eval command. | eval today=strftime(now(), "%m/%d/%Y") . "_Response" ... View more

Have you tried this? | makeresults | eval aa1=1, aa2=2, aa1x=3, aa2x=4, b=5 | fields + aa*x b ... View more

Many others have had the same problem after upgrading.  It seems the alert is too sensitive.  Once you have confirmed the instances are healthy, consider adjusting the alert threshold or disabling it. ... View more

Are Splunk Enterprise and the Universal Forwarder (UF) running on the same server.  If so, it's unnecessary and can lead to problems.  Remove the UF since Splunk Enterprise is fully capable of monitoring files without it. If they are on separate servers then confirm there is no firewall blocking connections between them. Check the logs on the UF (/opt/splunkforwarder/var/log/splunk/splunkd.log) to see if there are any messages that might explain why data is not being sent to Splunk Finally, neither Splunk Enterprise nor Universal Forwarder should run as root because that creates a security risk. ... View more

It's not entirely clear what the expected output should be, but perhaps this helps.  It counts the number of sourcetypes for each endpoint and filters out events where endpoint is in both sourcetypes. sourcetype=A | rex field=_raw "John\s+(?<endpoint>\w+)" | append [| search sourcetype=B "Live" | rex field=_raw "Mike\s+(?<endpoint>\w+)"] | stats count by endpoint | where count = 1 ... View more

Example field extractions in props.conf look like this EXTRACT-action = Action: \[(?<action>[^\]]+)\] EXTRACT-user = User: (?<user>\S+) What follows the = is a regular expression very much like what is used with the rex command.  With these examples and a little experimentation in regex101.com you should be able to extract the remaining fields. If you have troubles, please post the field you're trying to extract and the command you tried. ... View more

Those settings belong in props.conf on the indexers and heavy forwarders. BTW, the TIME_PREFIX setting should describe what comes *before* the timestamp and not the timestamp itself. The inputs.conf file should look a little like this: [monitor:///path/to/file] index = foo sourcetype = mysourcetype ... View more

It would help to know the specifics of each query.  Without them, the best I can do is <<query number 1>> | append [ <<query number 2>> ] | append [ <<query number 3>> ] | stats values(*) as * by id ... View more

Yes, it's easy to do.  See my reply on 24 Oct. ... View more

I cannot do that.  That's a job for Splunk Professional Services. ... View more

It seems like you've successfully integrated Meraki with Splunk.  Interpreting the data is another matter and probably calls for Meraki documentation (perhaps this will get you started https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Meraki_Event_Log). FTR, Splunk recommends NOT using a Splunk instance as a syslog server as data will be lost when the instance restarts.  Splunk recommends using a dedicated syslog server such as syslog-ng, rsyslog, or Splunk Connect for Syslog. ... View more

If the search runs every 15 minutes then there's little reason to search more than 20 minute back.  So, earliest=-20m latest=now.  What is the use case? ... View more

Check out the mvstats for Splunk app in splunkbase (https://splunkbase.splunk.com/app/5198). ... View more