I'm assuming that since you said you have a blank dashboard and not a message that no artifacts were found, that all of the permissions are set up correctly. One of the pitfalls of using a scheduled search (with loadjob ) is that the time picker is applied to jobs themselves and not the results of the job. So if your dashboard is looking for data from the previous month and the scheduled search results are from an hour ago, that will not be in the range of the time picker. There is a workaround though. In your dashboard XML, add these lines to your time picker: <change> <eval token="time.earliest_epoch">if(isnum('earliest'),'earliest',relative_time(now(),'earliest')</eval> <eval token="time.latest_epoch">if(isnum('latest'),'latest',relative_time(now(),'latest')</eval> </change> Then add something like this to your panel searches, after invoking loadjob : | search _time>=$time.earliest_epoch$ AND _time<$time.latest_epoch$ ... View more

Some sample events and your desired outcome would be helpful. ... View more

| transaction unique_session will tell you how many events there are and how long the session lasted. ... View more

Have you tried transaction ? Try adding | transaction startswith="Create Relationship started" endswith="Create Relationship call executed" to your search. There will be a field called duration that will tell you how much time elapsed. ... View more

haha, I was overthinking. @niketnilay's answer is much better! This would be more useful if you needed to replace a pattern, not a particular character. ... View more

Does this job only run once per day? ... View more

You need rex command in sed mode. Assuming your field with both slot and port is SlotAndPort: ... your search ... | rex field=SlotAndPort mode=sed "s/ //g" https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Rex has more details. ... View more

You can use the append command, especially since they all have the same fields: search1 | append [search2] | append [search3] Note that the subsearches are limited to 10k each when used with append . ... View more

I think you could create two new fields, one to indicate whether an event is a failure, and one to indicate whether it is a success. Then you can count both of those columns and eliminate the MAC addresses that only had failures. index=blah sourcetype=blahblah earliest="04/10/2019:00:00:00" | eval failure=if(match(_raw,".*500 Internal Error.*"), 1, 0), success=if(failure=1, 0, 1) | stats sum(failure) as failure, sum(success) as success by Device_Mac | search failure>0 AND success =0 This also eliminates the potential problem of your results exceeding subsearch limits. ... View more

Try this regular expression, assuming that the characters between the first two pairs of / are either letters or "-": ... | rex field=url "(?<url_group>\/[\w-]+\/[\w-]+\/).*" | eval url_group=url_group+"fetchGroup" ... View more

In my query, the max_15m means the largest number of seconds in the last 15 minutes where there were no events for that host. Max_24h is the longest pause (in seconds) in the last 24 hours. It occurs to me that there will often be values higher than the average in the last 24 hours, and never be anything higher than the max, so maybe a percentile value would be good? If you want to count the number of times where the pause was greater than the 95th percentile in the last 24 hours, you could do something like this: index=_audit earliest=-15m latest=now | delta _time AS pause | eval pause=-pause | join host [ search index=_audit earliest=-24h latest=now | delta _time AS pause | eval pause=-pause | stats avg(pause) as avg_24h max(pause) as max_24h perc95(pause) as ptile_24h BY host] | eval countme=if(pause>ptile_24h, 1, 0) | stats sum(countme) by host I'm using the _audit index because it will run anywhere, but maybe you can generalize this. ... View more

What is the significance to putting the index search first? ... View more

Like this: index=_audit earliest=-15m latest=now | delta _time AS pause | eval pause=-pause | stats avg(pause) as avg_15m max(pause) as max_15m BY host | join host [ search index=_audit earliest=-24h latest=now | delta _time AS pause | eval pause=-pause | stats avg(pause) as avg_24h max(pause) as max_24h BY host] | where avg_15m > avg_24h ... View more

This is awesome. Would you recommend joining this as a subsearch to the OP's 15-minute search so that the alert is only triggered when the 15-minute result satisfies some condition when compared to the 24h search? ... View more

What do you get when you run this entire search? Do you get records from your lookup table and nothing from the index? ... View more

What sourcetype are you using? ... View more

Give this a try: ... | rex field=mydata "^.*>(?<Process>.*)$" This will run anywhere: | makeresults | eval mydata="'ProcessName'>C:\Windows\System32\lsass.exe" | rex field=mydata "^.*>(?<Process>.*)$" The regular expression will pull out any characters after the ">" and before the end of the string as the Process field. ... View more

This is awesome! Thank you. ... View more

It's not the schema that is changing, it's the data. Updates and deletes are not Splunk-friendly. If I've already indexed an event related to entity X and then something about X changes, I need to index a new event for entity X. The old one isn't relevant anymore for most purposes. That means that either users have to search for the latest version of that event, or I need to find a way to delete the old version that is out of date. Sometimes I use lookup tables instead of indexes. I've also looked at using scheduled searches to do the heavy lifting of finding the latest version of each entity and then having dashboards use loadjob. But end users trying to use the traditional "index=foo" in the search box can easily come up with incorrect conclusions. ... View more

The export button will not work if you are using a post-processing search, so if you are trying to enable it and it's not working that might be why. See https://answers.splunk.com/answers/550070/why-export-button-is-grayed-out-in-some-of-my-pane.html. ... View more

This x1000. Needs to be changed by Splunk. ... View more