If the extraction is ok,can you provide a sample table of all your extracted fields ?so we can easily help.... ... View more

I think there is a difference between a NULL value and EMPTY value. May be we have empty values instead of NULL. So try to use another test on perc different from isnull( ), may be isnum(...) can go. ... View more

Hi if you need a list of all source ip's and dest ip's that have the same dest port try something like: ......|eval src_dest_ip=coalesce(dest_ip,src_ip)|stats values (src_dest_ip)|where ......condition on ip's.... ... View more

try this: .....|eval seizureTraffic = coalesce(c84163237 , c84163338)|timechart span =1 h sum( seizureTraffic ) by LABEL ... View more

HI luckymaddy, 1-write your request that gives you the failed login as you want. it depends on your data.it may be something like: source=security_log_file failed login earliest=10| timechart count by user|where count> 5 2-execute it in search and click SAVE AS ALERT. 3-on the first window put the title and chose what you want..... 4- on the 2nd window click SEND E-MAIL and fill the required informations. you can even customize the message to send by including a token value. 5-click save. see all the details here: docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Alertexamples ... View more

There are splunk Apps that can help you do that: https://splunkbase.splunk.com/app/1214/ https://m.youtube.com/watch?v=pgJ4dtIn5wo ... View more

Can you provide a sample data,I'm sure with that we can understand you better ..... You up there that you need project names for a given period. If the request was working then just add a time picker and tokenize it. ... View more

Hi If you can provide a sample data it will be very easy to help you. your search can look like this: a-assuming you have a security file. source=security_log_file failed login ted Answer | timecart span = 30d limit =10 ....... b. assuming you want to have it directly from splunk: index = _audit action = failure earliest=-30d | stats values(user) AS Users, values(action) |top limit =10 action OR index = _audit action = failure earliest =-30d|top limit=10 action 2.Average number of user check outs by region. if you have a field in which you keep number of user( may be per month, day, ..........), do something like this: .........|stats avg(your_field) by region NOTE: your search depends on you data so please take time to post your sample data next time. see docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Whatsinthismanual ... View more

take a look on In page drilldown xml code in splunk dashboard 6...examples. Or see contextual drilldown elements here: docs.splunk.com/Documentation/Splunk/6.2.2/Viz/Understandbasictableandchartdrilldownactions ... View more

Hi, once data get into splunk: 1-in search and reporting, when you click on SUMMARY INDEX, you have your new source and/or sourtype populated there.You can click on it to launch a search to see your events an your fields. 2- Immediately after adding data,splunk proposes you to start search on that. 3- if you know the index OR the source Or the sourcetype where you put your data, to see your eventdata your can type in search: index=…… OR source=… OR sourcetype=… 4- if you don't know all the previous, you can type only * in search an you will see all eventdata ,all fields from all indexes and sources. docs.splunk.com/Documentation/Splunk/6.2.2/Search/Whatsinthismanual ... View more

HI try this: 1.this is for all project names in the two index. index=xyz OR index=yxz sourcetype=aaa ..... |eval project_name=coalesce(proj_n,project_n)| chart count(host) as hostnames by project_name Now if you want it for a chosen index,assuming that you are doing it in a dashboard: a-create a dropdown, populate it with your different Indexes. b-the query will look like this: index=$index_token$ source=..... OR sourcetype=.......|eval project_name=if( "$index_token$"=xyz, "project_n","proj_n")| chart count(host) as hostnames by project_name NOTE: you can have nested if(...) if you have more than 2 index or you can use case(...) hope this will help.... ... View more

I'm not sure we can use regex, the error you have ,was is not the goal( to hinder a user to do such a search?) If the usage of wildcard * is more global than wath you want, try to list precise search terms.Read the note under the text box of SEARCH TERMS RESTRICTION. ... View more

You can updated savedsearches.conf (where entry for these scheduled reports are present) to add multiple email addresses (comma separated). See this http://docs.splunk.com/Documentation/ Splunk/6.0.2/Report/Schedulereports action.email.from = The email address that is used as the sender's address. Default is splunk@$LOCALHOST (or whatever is set for from in alert_actions.conf ). ... View more

docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Sendemail Syntax sendemail to= [from=] [cc=] [bcc=] [format= (html|raw|text|csv)] [inline= (true|false)] [sendresults=(true|false)] [sendpdf=(true|false)] [priority= (highest| high|normal|low|lowest)] [server=] [width_sort_columns= (true|false)] [graceful=(true|false)] [sendresults=] [sendpdf=] from Syntax: from= Description: Email address from line. Defaults to "splunk@". ... View more

Hi, it is simple,just create a role for these users and make a restriction on these search terms (index =........). to do it in splunk web: setting > access control > roles >add new under search restrictions, put what you want to be restricted (index= index=test OR index=*test) Do not forget to specify to whom the role should be apply. ... View more

Yes it is possible. From results, you use the " result.token " to access the first value of a specified field in search results. This token is available from the following contexts: Alert actions Scheduled reports Token Description $result.fieldname$ Returns the first value for the specified field name from the first result in the search. The field name must be present in the search. see this: docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Setupalertactions ... View more

Hi, Haven't deleted that info, but I think it would get replicated again...since bundle won't get overwritten when Splunk is upgraded. you can reduce the size of the bundle by means of the [replicationWhitelist] or [replicationBlacklist] stanza in distsearch.conf . See "Modify the knowledge bundle" in the deployment manual. docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/Limittheknowledgebundlesize ... View more

simply ....... ... View more

Hi, Try using mvlist=t mvlist =< bool > | Description: Flag controlling whether the multivalued fields of the transaction are (mvlist = t) a list of the original events ordered in arrival order or (mvlist = f ) a set of unique field values ordered lexigraphically . If a comma / space delimited list of fields is provided only those fields are rendered as lists . Defaults to f . http://docs.splunk.com/Documentation/Splunk/latest/ SearchReference/Transaction ... View more

Hi try to do something like this: 1-if you are using splunk 6.2..... 0</ earliest> now . . . . <search> <query> here goes your query </query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> 2- if you are unsing a version prior to 6.2...... 0</ earliestTime> now . . . . here goes your query</ searchString> $time.earliest $ $time.latest$</ latestTime> 3-and remove the first timestamp (earliesti=.. latest=....)in you savedsearch. ... View more

CHECK IF THE SOURCE OR THE FILE HAVE NOT BEEN BLACKLISTED. docs.splunk.com/Documentation/Splunk/6.2.2/Data/Whitelistorblacklistspecificincomingdata ... View more