index=linux [|inputlookup host.csv | rename host as query | table query | dedup query | format] OR [|inputlookup host.csv | rename ip as query | table query | dedup query | format] ... View more

So, your expected output would have multiple rows? Do you not think this is a fundamental part of your requirement, and should have been clarified from the outset? ... View more

If you have host1 in the data and host1.example.com in the csv, then it wouldn't find it. If it is the other way around, then it should find it. Please clarify your requirement. ... View more

index=linux [|inputlookup nost.csv | rename host as query | table query | dedup query] ... View more

Where does Test.MQ come from? Is this a new requirement that you haven't mentioned before (have you been wasting my time by not clearly specifying what you are trying to do?)? ... View more

I am not really sure what it is you are asking - if you want the variance of the MaxTPS for each day compared to the MaxTPS 7 days prior, try this index=<search string> earliest=-30d@d date_hour>=$timefrom$ AND date_hour<$timeto$ | timechart span=$TotalMinutes $m count(eval(searchmatch("sent"))) as HotCountToday | eval TPS=round(HotCountToday/($TotalMinutes $*60),2) | eval TotalMinutes = ($timeto$ - $timefrom$) * 60 | eval Day=strftime(_time, "%Y-%m-%d") | stats max(TPS) as MaxTPS by Day | autoregress MaxTPS p=7 | eval Variance_TPS_Today=case(MaxTPS_p7 > MaxTPS, round(((MaxTPS_p7 - MaxTPS) / MaxTPS_p7) * 100,2),MaxTPS_p7 < MaxTPS, round(((MaxTPS - MaxTPS_p7) / MaxTPS) * 100,2),MaxTPS_p7 = MaxTPS, round(((MaxTPS_p7 - MaxTPS)) * 100,2)) | eval Date=strftime(_time,"%F") | eval Name="Test" | chart useother=f values(Variance_TPS_Today) as variance by Name Date ... View more

| autoregress MaxTPS p=7 | eval Variance_TPS_Today=case(MaxTPS_p7 > MaxTPS, round(((MaxTPS_p7 - MaxTPS) / MaxTPS_p7) * 100,2),MaxTPS_p7 < MaxTPS, round(((MaxTPS - MaxTPS_p7) / MaxTPS) * 100,2),MaxTPS_p7 = MaxTPS, round(((MaxTPS_p7 - MaxTPS)) * 100,2)) | eval Date=strftime(_time,"%F") | eval Name="Test" | chart useother=f values(Variance_TPS_Today) as variance by Name Date ... View more

The fact that all the lines are in a single event helps. | streamstats count as event | multikv noheader=t | fields _time _raw event | rex field=_raw ".*\[Import Pick Orders\].*ROWS ONLY;@p0 = \'(?<imWho>[\d-]+)\'" | rex field=_raw ".*\[Import Pick Orders\].*- (?<success>Messages processed successfully).*" | stats list(_raw) as _raw values(imWho) as imWho values(success) as success by event | where isnotnull(imWho) AND isnotnull(success) | eval _raw=mvjoin(_raw," ") ... View more

If you have the month on every line, and the percentage is numeric (not a string) then a column chart with stacked option should suffice ... View more

| regex user!="^[a-zA-Z]+$" ... View more

Here's how to do it in SPL: | makeresults | fields - _time | eval _raw=" <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid=' XXXXXXXX -4994-a5ba-3e3b0328c30d}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2023-06-13T10:39:41.797279900Z'/><EventRecordID>12536409</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='15216'/><Channel>Security</Channel><Computer> XXXXXXXX </Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>XXXXXXXX</Data><Data Name='SubjectDomainName'> XXXXXXXX </Data><Data Name='SubjectLogonId'>0 XXXXXXXX 7</Data><Data Name='NewProcessId'>0x2734</Data><Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0x17d4</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>S-1-0-0</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data><Data Name='MandatoryLabel'>XXXXXXXX -16384</Data></EventData></Event>" | rex mode=sed "s/.*(?<eventId><EventID>4688<\/EventID>).*(?<parentProcess><Data Name='ParentProcessName'>C:\\\\Program Files\\\\SplunkUniversalForwarder\\\\bin\\\\splunkd.exe<\/Data>).*/\1\2/g" For SEDCMD, you might need fewer backslashes: s/.*(?<eventId><EventID>4688<\/EventID>).*(?<parentProcess><Data Name='ParentProcessName'>C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe<\/Data>).*/\1\2/g ... View more

| makeresults | eval desc="Frankfurt (123) & Saarbrucken (456), Germany - Primary down / Secondary down" | append [| makeresults | eval desc="Frankfurt (123), Saarbrucken (456), Frankfurt Zeil (789) & Kaiserslautern (012), Germany - Primary up / Secondary up"] | append [| makeresults | eval desc="Test - Creteil - (123) - France - Primary Up // Secondary Up"] | append [| makeresults | eval desc="All devices at 456 London, England are alerting as down and unreachable"] | append [| makeresults | eval desc="Test - 123-Clonmel ( Ireland) - Primary DOWN / Secondary UP/ Switch UP"] | rex max_match=0 field=desc "(?<loc>\d{3})" | eval loc=mvjoin(loc,",") ... View more

This still doesn't appear to have a message field - unless this is the message field? It is often more helpful to share the entire _raw field so we can see what you are dealing with. ... View more

Do you need now()? Doesn't _time hold now? | makeresults count=100 | map maxsearches=100 search="| makeresults count=1 | eval inner_time=_time" ... View more

Does this help? | makeresults | eval process_name="C:\\\\...\\\\...\\\\...\\\\...\\\\..." | eval original_process_name=process_name | rex mode=sed field=process_name "s/\\\\\\\\/\\\\/g" ... View more

Please explain how you are trying to use the throttle option and why writing to a summary index is not appropriate for you? ... View more

There is a mixture of naming here - You can saved a search as a named search which you can execute in another search. Does this satisfy your usecase? ... View more

Where did you add the stats command? ... View more

So each event has one value for IDBC-Hostname, and your owner.csv has only one entry for each hostname? ... View more

I would check what is important to me. What is important to you? ... View more

Try adding one more line at a time to find out which line is producing the duplicates ... View more

Perhaps it is time for you to share some of your events. For example, what do you get after this part of the search? index=standard_tanium source="Prod-CSV" script=read.ps1" |rename field01 as user |rename field02 as login-count |rename CSV-Timestamp as Script_run |rex mode=sed field=user "/[&?].*//g" |table Script_run IDBC-Hostname user login-count ... View more