Hi, I am creating a dashboard where one of the queries is using the rex command. However, in the XML, I am getting the error "Unexpected cloase tage> at the end of the end of the query. The query is as follows: index="ABC" sourcetype=XYZ "Logout User:" | rex field=_raw "Logout User:\s+(?<user>\S+)" | top 10 user I know it is something to do with the rex command but not sure how to correct it .... can you please help?   Many thanks as always, ... View more

Hi, I am doing statistical analysis on a number of indexes for time series forecasting. On reading the following article, its gives a sample SPL query as follows: | gentimes start=”01/01/2018" increment=1h | eval _time=starttime, loc=0, scale=20 | normal loc=loc scale=scale | streamstats count as cnt | eval gen_normal = gen_normal + cnt | table _time, gen_normal | rename gen_normal as “Non-stationary time series (trend)” [Article is this: ]https://towardsdatascience.com/time-series-forecasting-with-splunk-part-i-intro-kalman-filter-46e4bff1abff The "normal" command is a cutom external command and I wanted to ask how and where I can get such statistical functions into Splunk? Many thanks as always, ... View more

Hi, I have the following query: | tstats count where index=dns earliest=-90d latest=now() groupby _time span=1d | fields _time count | rename _time as hour | eval hour=strftime(hour,"%Y-%m-%d %H:%M:%S") | fields hour count | fields - _* | eventstats avg(count) as avg_count | eval k=(pow(avg_count,2))/(var(count)-avg_count) | eval outlier=if(count>(avg_count+k*pow(avg_count,2)),1,0) | eval predicted_outlier=if(outlier=1,"anomaly","normal") | eval actual_outlier=if(day>relative_time(now(),"-7d"), "anomaly", "normal") | eval true_positives=if(predicted_outlier="anomaly" AND actual_outlier="anomaly", 1, 0) | eval false_positives=if(predicted_outlier="anomaly" AND actual_outlier="normal", 1, 0) | eval false_negatives=if(predicted_outlier="normal" AND actual_outlier="anomaly", 1, 0) | eval true_negatives=if(predicted_outlier="normal" AND actual_outlier="normal", 1, 0) | stats sum(true_positives) as TP, sum(false_positives) as FP, sum(false_negatives) as FN, sum(true_negatives) as TN | eval accuracy=(TP+TN)/(TP+FP+FN+TN) | eval precision=TP/(TP+FP) | eval recall=TP/(TP+FN) However, the this statement is not working as the var command does not work without stats and I cannot use stats in a command by itself as I want to apply this k formula for each daily count. Can you please help? Many thanks, ... View more

Hi, I have a query that is searching over 4 different indexes (AIBA, AIBC, AIBP, AIBX) as follows: index=AIB* "Windows" EventCode="*" | stats count as NumOfLogs by dvc_NodeName | sort - NumOfLogs | eval Host = dvc_NodeName | table Host , NumOfLogs, index However, I need one of the fields on the outputted table to be "Index" but nothing is currently outputted in my current query. Can you please help? Thanks as always! ... View more

Hi, I have a query where I am first getting 3 fields from an index ("A", "B", "C") describing tasks to be completed and then adjoining a separate lookup containing employee names. I need to use a random function to randomly assign a task to random employees. So, if there are 10 tasks a 5 employees, each employees would randomly get 2 tasks OR say you have 2 tasks and 5 employees, 2 of these 5 employees would randomly get one of these 2 tasks Here is my current query: index="XYZ" | table "A", "B", "C" | appendcols [| inputlookup "DEF"] | eval rnd = random() Can you please help? ... View more