Made tweaks to the search above to fix the lookup error.  For CIDR lookup, you'll need to create a lookup definition and configure advanced settings for match type CIDR(ips) ... View more

The match( ) function is regex pattern matching, it'll match any strings that contain the value specified so you don't need to wildcard with it.  That can be a pain when you want an exact match which is why I provided the second option that uses "^scanner". This checks that the values starts with "scanner", although a better version would be "^scanner$", this would be an exact match.  ^ : Start of string $ : End of string You can see the documentation here: Comparison and Conditional functions - Splunk Documentation And for regex help, try somewhere like regex101: build, test, and debug regex   When you say a combo, do you mean if the src_ip OR the dest_ip is a scanner ?  <your search> | lookup iplookupfile.csv ips as src_ip OUTPUT comments as src_ip_comments | lookup iplookupfile.csv ips as dest_ip OUTPUT comments as dest_ip_comments | where !match(src_ip_comments , "scanner") AND !match(dest_ip_comments , "scanner") ... View more

If the IP field in your data is ip.  If you need to exclude any type of scanner, try:   search index=abc ip=* | lookup iplookupfile.csv ips as ip OUTPUT comments |where !match(comments, "scanner")       If alert scanners/cisa scanner shouldnt be excluded, try:    search index=abc ip=* | lookup iplookupfile.csv ips as ip OUTPUT comments |where !match(comments, "^scanner")       ... View more

You could use wildcard matching on the prefix lookup.  Create your prefix lookup like this :  prefix, match_type *tree*, Tree *town*, Town  Then create a lookup definition for the prefix lookup with the additional settings WILDCARD(prefix) You can then run a search like    |inputlookup hostsfile  | lookup prefix_lookup_definition prefix as Hostname ... View more

Setting output_mode parameter to output_mode=JSON in the API call should return the results in JSON format.  You can see the documentation here: Basic concepts about the Splunk platform REST API - Splunk Documentation ... View more

Thanks Rich. I was thinking along the lines of putting anything in double quotes would be interpreted literally so <<MATCHSTR>> would have ended up in my multivalue field.  Thanks for the detailed explanation.  ... View more

You're a legend KV  ! Thanks a million. Been annoying me all day trying to figure out this.  ... View more

timechart requires the _time field being in the dataset sent to it.  That field doesn't exist once you do : | stats avg(ttt) as avg_ttt   You also cant chart a string value. Your `uptime2String()` macro means you no longer have a value that can be compared in a chart.  ... View more

For public IP address space, Splunk comes with an | iplocation function with data accurate as of the Splunk package being published. iplocation - Splunk Documentation The documentation comes with info on how to update the database.  ... View more

You want to have the column title as a value in the lookup ? ... View more

Ok, you should be able to filter it out in the SQL query by using the below WHERE filter. Just replace <timestamp_field> with the name of the field in your database table. It basically calculates the time at the start of this hour and makes sure that the timestamp is before that.  WHERE <timestamp_field> < dateadd(hour, datediff(hour, 0, getdate()),0)   ... View more

To add to this, make sure to set latest=-0h@h.  That way it disregards everything in the current hour (until the next hour). ... View more

You said your end goal was "I want to have today, last week same day, 2 weeks back same day & 3 week back same day in the same visualization" Is it necessary to have _time accurate ? The search I provided automatically tags them as latest_week, 1week_before, 2weeks_before and 3weeks_before.   andrew_nelson_0-1664272072149.png   If you want _time accurate, then you can remove the timewrap command and you'll get them all on the one graph, but its not gonna be that useful since you're looking at 1 hour per week which means 167 hours are empty. andrew_nelson_1-1664272311999.png   ... View more

The reason you're only getting Sept 26th is because you're rewriting the timestamp in each appended search and setting them to today's date. The timewrap function is what you need. Try this : index=xyz sourctype=abc earliest = -60m@m latest = @m |append [search index=index=xyz sourctype=abc earliest=-60m@m-1w latest=@m-1w] |append [search index=index=xyz sourctype=abc earliest=-60m@m-2w latest=@m-2w] |append [search index=index=xyz sourctype=abc earliest=-60m@m-3w latest=@m-3w] |timechart span = 1m count(index) as Volume |timewrap w ... View more

You can do as many stats calls as you like in a query, but what you need is eventstats. Also timechart can be used to replace the bin and stats. search | timechart span=5m avg(Value) as binAvg | eventstats avg(binAvg) as allAvg ... View more

Have a look at the  | timewrap function. I believe that should cover what you're looking for. timewrap - Splunk Documentation ... View more

Its nowhere near as simple as the new Dashboard Studio dashboards but it is possible.  Have a look at the Splunk Dashboard Examples app.  Splunk Dashboard Examples | Splunkbase It has an example called "Image Overlay with Single Values" that should point you in the right direction. ... View more

I had the closing parenthesis for len() in the wrong place. My bad. I've updated it above. ... View more

Easiest way to get around it is using fillnull in your search after your stats.  | fillnull value="N/A" hw_stat_column ... View more

Ok. Have a look into using rex mode=sed in the documentation above and you should be able to replace any lines that don't end in a number with nothing.  Something like this:  | rex field=_raw mode=sed "s/[\n\r]+.*\D([\n\r]+|$)|$/\n/g"   Checks for any line that doesn't end number and replaces it with a new line character.     ... View more