Hi @Anthonylucian    when you use stats comand you report only the fields reported on your search: try to put state on stats comand like this |stats latest(*) AS * by ip, pluginID,state,Fixed | dedup macAddress, Datacenter | timechart count(state) as Fixed by cve useother=false or you can try like this |stats latest(*) AS * values(state) as state, values(Fixed) as Fixed by ip, pluginID | dedup macAddress, Datacenter | timechart count(state) as Fixed by cve useother=false ... View more

Hi @Engineer_Zen  I don't understand your question, you can define any fields you want on your search alert. also you can define on set options on custom fields. Karma given or solution confirmation appreciated   ... View more

Hi @Mahi4rus , te seaech head is connected  with the indexers?   on the UF is already configured the inputs.conf?   Regards Alessandro ... View more

@Engineer_Zen    in you search you can apply the earliest and latest command Example last 7 days:   Index=myindex sourcetype=mysourcetype ealiest=-7d AND latest=now example last 5 min Index=myindex sourcetype=mysourcetype ealiest=-5m AND latest=now for other example please check the documentation https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/SearchTimeModifiers   ... View more

hi @Engineer_Zen  the timerange in your alert are based on you schedule for example if you schedule one week, the alert run for the last 7 days. However you can manage your tiemrange directly in your search with earliest and latest comand. https://docs.splunk.com/Documentation/Splunk/8.1.3/Search/Specifytimemodifiersinyoursearch ... View more

Hi @chaitali_1994  as for certificates, you should upgrade splunk versions to be able to use unexpired certificates how to use certificates you can follow this link: https://docs.splunk.com/Documentation/Splunk/8.1.3/Security/ConfigureSplunkforwardingtousethedefaultcertificate   and for your kvstore error I suggest to  backup and resync your collection. https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/BackupKVstore https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/BackupKVstore karma point or solution confirmation is appreciated       ... View more

Ciao @simo  la search per collezionare i log dentro l'indice B dovrebbe essere così: the search for collecting logs inside index B should look like this:   index=a OR idex=b | stats dc(index) AS dc_index values(index) AS index BY name, ID | eval Status=if(dc_index=2,"Both",index) | search NOT status="a" |table name ID | collect index=b       ... View more

Ciao Simo,   intendi unire i due indici?   in splunk puoi utilizzare la funzione OR es: index a OR index b oppure utilizzare le funzioni join come in SQL ma perdono di performance Saluti ... View more

epoch is stored on _time field but to works need convertions or blacklist_start/end field or time. Regards ... View more

Hi first you need to convert your timestamp in epoch | eval epoch=strftime(_time, "%s")  after this you can create your if condition, below you find the eval convertion and eval condition | eval epoch=strftime(_time, "%s") | eval blacklist=if(blacklist_start > epoch AND epoch < blacklist_end,"1","0") would be nice if you confirm the solution Regards ... View more

Exactly with this search you can find your UID values on your dataset. I really appreciate if you can confirm the solution   ... View more

sure Basically you must have one field on your data present on the lookup table by hypothesis will be "ID" field. example index = myindex | lookup  mycsvfile ID OUTPUT UID ROLE |  with the association the field you can find the fields present on the lookup table to enrich your data set. would be nice if you can confirm the solution Thanks! ... View more

Hi I don't know your data setI shared the search only to understand the logic. index=sample OR index=sam sourcetype=Sample_1 OR sourcetype=sam_1 Legment="SOFT" OR sev=Y  | makemv delim=";" AID rename Name as AID |fillnull value="" Cos   |stats count(VName) by AID   ... View more

Hi Aaron you can use directly the lookup comand   https://docs.splunk.com/Documentation/SCS/current/SearchReference/LookupCommandExamples   inputlookup works different, you can search inside on your lookup table, with the lookup comand you can enrich your data.   ... View more

Hi please try to understand the logic on this search: index=sample OR index=sam sourcetype=Sample_1 OR sourcetype=sam_1 | makemv delim=";" AID rename Name as AID |fillnull value="" Cos |fields * | search Legment="SOFT"|search sev=Y |stats count(VName) by AID   this is the best way to do a search without a join, Also you can use the where condition.   Regards Alessandro ... View more

Please open a support case on splunk. only the cloud engineer can help you on this. ... View more

Hi after stats comand please create your triggered_time field with eval: | eval TRIGGER_TYPE=if[please here create your condition with e2 fields] https://splunkonbigdata.com/2018/08/26/usage-of-splunk-eval-function-if/ after this order your output with  a table comand or other stats comand     ... View more

In your case you need to use at the end of your search: | sort -a (field)     ... View more

Hi    you can use "Sort" comand to order your output.   In addiction you can use fillnull comand to fill your blank fields  https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull     ... View more

Hi,   try to expand your timerange and if you don't specify the index name splunk automatically puts your data on the index=main.     ... View more

Hello,   Can you share the basic search? do you remember which index you use? Regards Alessandro ... View more

Hi    What is the action associated at this alert?what do you expect after this alert? Example: mail or summaries the event on other index, other actions...   , also try to put a condition on your alert example: | where (conditionexample source=ps)     ... View more

Try this (unfortunately I don't know the tested field name)   |eval Percent=round(sum(CountOf_true)/sum(CountOf_MaAchinesTested)*100,2)|eval "Percent of True Machines Tested"=case(Percent==0,0.00,1=1,Percent) |stats sum(CountOf_MachinesTested) as "Machines Tested" sum(CountOf_True) as True sum(CountOf_False_AssetsTested) as "False by Platform Environment "Tested" Rule Severity "Percent of True Machines Tested" by Platform,Environment,Severity,"Tested Rule" | table Platform Enviroment Severity "Tested Rule" "machines tested" "Percent of True Machines Tested" True False ... View more