Try this more generic query. (event_status="delivered" OR event_status="in_transit") AND tracking_number=* | eval _time=if(event_status="delivered", strptime(event_time, "%Y-%m-%dT%H:%M:%S.%3N%Z"), _time) | sort - _time | transaction tracking_number startswith=event_status=delivered endswith=event_status=in_transit keepevicted=true | where duration > 3600 | stats sum(eventcount) as eventcount by closed_txn ... View more

To pass results from one panel to another, use a <done> element after the query in the first panel to set tokens  Then reference the tokens in the second panel. ... <panel> <title>Panel 1</title> <search> <query>...</query> <done> <set token="C1">$results.Col1$</set> <set token="C2">$results.Col2$</set> <set token="C3">$results.Col3$</set> </done> </search> </panel> <panel> <title>Panel 2</title> <search> <query>index=* sourcetype=source Col1="$C1$" OR Col2="$C2$" OR Col3="$C3$" | fields + ID, Name | stats count by ID, Name</query> </search> </panel> ... View more

Please share sample events for each policy. ... View more

You will need to create a token for the connector to use.  Go to Settings->Tokens for that. I'm not sure what they expect for SPLUNK_OWNER.  Try it with "nobody" for now. The screenshot doesn't say if props are needed or not.  The default syslog props may be sufficient, but you'll have to onboard some data to find out. ... View more

No script is necessary.  It can be done within your query like this ... | rex "Mem=(?<Field1>\d+)\/(?<Field2>\d+)" | eval ratio=exact(Field2/Field1) | where ratio>0.8 Have the alert trigger when the number of results is not zero. ... View more

When transaction makes that complaint, throw in a sort.  See my updated answer. ... View more

Consider altering the _time field of the "delivered" events so the transaction command uses the desired timestamps.   event_status="delivered" OR event_status="in_transit" | eval _time=if(event_status="delivered", strptime(event_time, "%Y-%m-%dT%H:%M:%S.%3N%Z"), _time) | sort - _time | transaction tracking_number startswith=event_status=delivered endswith=event_status=in_transit keepevicted=true | where duration > 3600 | stats sum(eventcount) as eventcount by closed_txn | eventstats sum(eventcount) as totalcount | where closed_txn == 1``` remaining eventcount only includes complete transactions ``` | eval percentage = eventcount * 100 / totalcount   ... View more

What have you tried so far? See if this helps | rest splunk_server=local /services/search/jobs | fields author eai:acl.app label doneProgress eventCount resultCount | search doneProgress=1.0000 resultCount=0 | table author eai:acl.app label eventCount resultCount ... View more

I'm not saying that.  You may need to configure a sourcetype in props.conf for the data.  With luck, the connector documentation will let you know.  If the connector does not come with a Splunk props.conf file then you'll need to craft one yourself. ... View more

The same script the increments the offset argument also can extract the UUID and send it the https://splunkbase.splunk.com/api/v1/app/<UUID>/release/ endpoint.  ... View more

Still questions not answered ... View more

Does this work any better? | makeresults | eval data="{ \"severity\": \"INFO\", \"message\": \"msg\", \"details\": { \"key1\": \"val1\", \"key2\": \"val2\", \"key3\": \"val3\" } }#{ \"severity\": \"INFOn\", \"message\": \"msgn\", \"details\": { \"key1n\": \"val1\", \"key2n\": \"val2\", \"key3n\": \"val3\" } }" | eval data=split(data,"#") | mvexpand data | eval _raw=data | fields - data ``` Above creates demo data. Ignore IRL" ``` | spath path=details | eval keys=json_keys(details) ``` Strip out JSON array chars ``` | rex mode=sed field=keys "s/[\[\]\\\"]//g" ``` Separate each key into different events ``` | eval keys=split(keys,",") | mvexpand keys ``` Get the unique key names ``` | stats values(keys) as keys ... View more

It would help to know what query you've tried so far.  Perhaps this is something different. | makeresults | eval _raw="{ \"severity\": \"INFO\", \"message\": \"msg\", \"details\": { \"key1\": \"val1\", \"key2\": \"val2\", \"key3\": \"val3\" } }" ``` Above just sets up demo data. Delete IRL ``` | spath path=details | eval keys=json_keys(details) ... View more

To change Splunk to run as user 'splunk' follow these steps. 1) Stop Splunk 2) Edit the init.d or splunk.service file to set the user to be 'splunk' For init.d, use command like these: USER=splunk ... splunk_start() { echo Starting Splunk... su - ${USER} -c '"/opt/splunk/bin/splunk" start --no-prompt --answer-yes' RETVAL=$? [ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk } 3) Change the ownership of all files in $SPLUNK_HOME to 'splunk' chown -r splunk:splunk /opt/splunk 4) Start Splunk ... View more

A bit of Googling and searching the OpenCTI web site turned up this connector: https://github.com/OpenCTI-Platform/connectors/tree/master/stream/splunk   ... View more

This is a new one to me.  If the domain is always 3 parts you can split the domain then use foreach to put the pieces back together in reverse order as in this run-anywhere example. | makeresults | eval domain="www.microsoft.com" ``` Above just creates demo data ``` ``` Break the domain at each dot ``` | eval foo=split(domain,".") ``` Iterate over the segments in reverse order and put them together ``` | foreach 2 1 0 [ eval rev_domain=mvjoin(mvappend(rev_domain,mvindex(foo,<<FIELD>>)),".")] | table domain rev_domain ... View more

I suspect the title is set before any searches run so there are no results from which to pull a field value. OTOH, if the value for the title comes from a drop-down then you should use a form token instead of a results token. $form._unit_used$ ... View more

Queues fill up when they can't send events to the next part of the pipeline.  In the case of the output queue, it happens when data can't be sent to the indexer(s).  That may be because the indexer is down or there's a network problem or perhaps other reasons.  The problem may have fixed itself because the indexer came back up or the network was fixed. ... View more

What does your data look like?  Are the fields already extracted?  What do the numbers in the "Time" field represent?  What goes in the "Server*" fields? If your supervisor handed you that table and said "create a query that produces this table" then what would you need to know to accomplish that task?  Well, we need to know that, too. ... View more

According to splunkbase, that add-on is not compatible with Splunk Cloud.  It's possible the add-on just hasn't been validated for Splunk Cloud so you may want to consider submitting a Support request to have them install it.  They will confirm if the add-on can be installed in Splunk Cloud. If the add-on cannot be installed in Splunk Cloud then you can install it on an on-prem heavy forwarder that sends the collected data to Cloud indexers. ... View more

Please explain what you mean by "not working".  What results do you expect and what results do you get? The sample event does not contain valid JSON in the result_json field.  Specifically, it's missing a closing brace and bracket.  Splunk's JSON functions don't handle invalid JSON. ... View more

The API endpoint https://splunkbase.splunk.com/api/v1/app/ will return 25 apps by default.  Wrap it in a script to specify successive values for the ?offset parameter to collect all apps. https://splunkbase.splunk.com/api/v1/app/?offset=25&limit=100 ... View more

Cell is the smallest clickable unit (in a table).  There's no way to determine *where* in the cell it was clicked because Splunk just knows the cell itself was clicked. ... View more