Did you set ratio to match the search sample ratio? I am guessing you are not using sampling, so set the ratio=1 ... View more

I think ( @priyastalin correct me if wrong) it looks like this is just so you can filter on the groupId? I'm not sure if seeing the contents of the macro would help to understand if its doing a simple filter or if there is something more complex going on to get the set of results. If this is something you run frequently, I think a lookup might be a far simpler (and faster) approach. ... View more

Splunk does not record licence consumption per event but you can make a good guess on this yourself. Build a search which includes your events, and calculate the size in bytes of each event over 24 hours   index=wineventlog sourcetype=winlog EventCode=4688 earliest=-24h latest=now|eval bytes=len(_raw)    Splunk uses UTF-8, so its 8bits, 1 byte per character. Each event will be slightly different with varying hostnames and other parameters etc so calculate an average.   |stats avg(bytes) as avg_bytes     Now you need to know how many events there have been - I presume its a lot - a.) because you are asking, and b.) because 4688 is common and noisy! You could run a |stats count over 30 days, but that may take some time. (Im also working on the assumption you don't have an accelerated datamodel for this) This is a good use case for a sampled search, set a sample rate that matches your dataset. 1:10,000 or 1:100,000 is probably the ballpark. To calculate the volume, you need to multiply the number of events the samples search returns by the avg_bytes and then multiply that by the ratio you choose.   So the complete search would be:   index=wineventlog sourcetype=winlog EventCode=4688 | eval bytes=len(_raw) | stats avg(bytes) as avg_bytes count | eval ratio=10000 | eval consumptionBytes=((avg_bytes*count)*ratio) | eval consumptionKB=((avg_bytes*count)*ratio)/1024 | eval consumptionMB=((avg_bytes*count)*ratio)/1024/1024 | eval consumptionGB=((avg_bytes*count)*ratio)/1024/1024/1024    remember to set "|eval ratio=x" to the sample ratio you use for the search ... View more

It might help if you can also post the contents of the macro last_np_sourcetype() ... View more

I found this list too - IPs of all 365 services: https://endpoints.office.com/endpoints/worldwide?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7 ... View more

What is the format of the hostname? I can see it's euraXXXXXXXX can you give a full example like this: eura0-y34-abc3 AAAAN-ANN-AAAN Where A is a letter, N is a Number and any other character is shown     ... View more

Field values in search are not case sensitive However some other commands like stats, sort  do utilise case sensitivity. Also by default, lookups are also case sensitive (although this is configurable) I can not offer an explanation of why the two very simple examples above would produce different results. Are you able to provide a screenshot demonstrating this? Are you testing with simple queries (like the example) or is this behaviour observed as part of a larger query? ... View more

Try something like this index=sample sourcetype="SAMPLE:DATA" earliest=-90d@d latest=@d | bin _time span=1d | eval timeframe=case(_time<relative_time(now(), "-60d@d"), "90d", _time>relative_time(now(), "-60d@d") AND _time<relative_time(now(), "-30d@d"), "60d", _time>relative_time(now(), "-30d@d"), "30d", 1=1, "Other") | stats dc(workstation_name) as EUD by timeframe, sitename   ... View more

Its not too big a job, let me know if you want to try and i'll see if i can help ... View more

The problem is here:   | eval z = if((meet_start_time >= q AND meet_start_time <= s), 1, 0) | eval meeting_code = case( z == 1, meeting_code, z==0, "N/A")   For any meeting which has multiple events that match both values of Z, you will get duplicates. You could change the last dedup command to:   | dedup organizer_email, start, end   Which may solve your problem in most cases*, but you might be better off using a stats latest command to only bring in a single value to the join as per my suggestion above. * I would expect that meetings in progress would show N/A,  meetings that have completed to show the meeting code ... View more

This is probably because the last join returns more than 1 result for each meeting (presumably multiple events during the meeting) Hence you always have a meeting that falls both Inside and outside of your meeting_code case condition, resulting in two statuses.  Could you use a |stats latest(end) to only bring in the last result of "end"? ...[search index="dpsn_meet" | stats latest(end) as end latest(start) as start latest(date) as date by email| where email== organizer_email]|... ... View more

Take a look in $SPLUNK_HOME/etc/system/local/inputs.conf On initial install this file also gets the original hostname written into it. ... View more

Disclaimer: I am actively working on this project. If you would like to discuss this further send me a private message. https://www.epiuselabs.com/cenoti-connect-sap-with-splunk   ... View more

Yes, you can apply application restrictions (under "Manage Apps") to allow/prevent a role from seeing/accessing an application. You should note that restricting access to an App does nothing to restrict the users access to the data that the application depends on. To manage access to data in Splunk you will also need to modify the roles index permissions. Start here: https://docs.splunk.com/Documentation/Splunk/8.1.1/Security/Aboutusersandroles for details on how Splunk manages RBAC ... View more

Restarting a DS is a safe procedure. It will not affect ingest, there will be no loss of data. You should however note that: If you are publishing a new application (which will be distributed to DS clients) which has the restart splunk flag set, this will cause the client forwarders to restart the Splunk process.  Generally speaking, this is not too much of a concern, however if you have forwarders (affected by the new app you are distributing) which process stateless data (such as TCP/UDP inputs) or run scripted inputs, you should be aware that there will be a disruption to these mechanisms for the few minutes it takes to restart Splunk. ... View more

Put: |search $ckey$ at the end of your search ... View more

Ok, I understand the question and the dashboard requirements (you don't need to keep posting it) but the first thing you need to do is get the basic search to work. If the search returns no results you need to figure out why. Does the first part of the query work? index=abc sourcetype=xyz source="/user.log" process-groups | convert timeformat="%Y-%m-%d" ctime(_time) AS Date |rename count as "Request Counts" |rex field=Request_URL "(?<id>[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})" |stats count by Date ADS_Id Request_Type id ClickHere Request_URL If the first part works, then try adding the lookup:   index=abc sourcetype=xyz source="/user.log" process-groups | convert timeformat="%Y-%m-%d" ctime(_time) AS Date |rename count as "Request Counts" |rex field=Request_URL "(?<id>[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})" |stats count by Date ADS_Id Request_Type id ClickHere Request_URL |lookup parent_chains.csv id Do you now have additional columns added from the lookup - do you now see a column called "parent_chain"? When you have the necessary fields returned in your search you can move on to building the dashboard. ... View more

Is your question: "what should the search string be for the second panel?" or is it: "how do i make a click in one panel affect the contents of another panel?" If you want to know how to make another panel appear and be driven by the click see this answer: https://community.splunk.com/t5/Splunk-Search/Can-you-display-a-panel-only-if-the-user-clicks-on-one-specific/m-p/402712 ... View more