Minor Revisions 😛 | stats earliest(_time) as startTime, latest(_time) as endTime by JobName | eval runTime=(endTime-startTime) | eval time=strftime(runTime, "%H:%M:%S") | table JobName, time ... View more

@kloppm As per app documentation "This application leverages admon collected data using the Splunk Add-on for Microsoft Active Directory TA or using the latest Splunk Addon or Windows" As checked in props.conf on line 99 "LOOKUP-ms_ad_obj_xml_member_dn_computer = AD_Computer_LDAP_list distinguishedName AS member_obj_dn OUTPUT sAMAccountName AS member_obj_id,domain AS member_obj_domain,objectClass AS member_obj_class" I want to suggest you check if you are capturing required logs from source "XmlWinEventLog." If "Not," please disable the lookup (with this you can suppress the error message). ... View more

Try this index="xyz" ((pidId=1 AND value >22) OR (pidId=2 AND value >37)) | stats dc(value) as dc_value by pidId | where dc_value > 3 ... View more

I am not sure if Splunk sends an email alert with the color condition in tabular format (When conditions match). However, you may create a dashboard with the color condition and schedule a report (Schedule pdf Delivery) to emails. ... View more

I referred above-mentioned link, however, no success ... View more

this will perform search time field extraction for untangle logs. ... View more

minor amendments 🙂 index=my_index source=my_source (source_host=remote* OR dest_host=remote*) | multireport [ stats count by source_host] [ stats count by dest_host ] | eval name=coalesce(source_host,dest_host) | fields - *_host | stats sum(count) as count by name ... View more

Try | timechart span=1w count as "INC Tickets Logged" by reported ... View more

If you are using "syslog" mechanism to send logs from untangle to Splunk, I would suggest using below mentioned SPL for field extraction index="untangle" | rex "(?<json>\{.+)" | spath input=json | fields - json | replace /* with * in CClientAddr,CServerAddr,SClientAddr,SServerAddr,localAddr,remoteAddr ... View more

Try as below mentioned (for sending email as an action from ES App" '$field_name$' ... View more

| tstats count where index=* by source (to get the list of source getting index) | tstats count where index=* by source (to get the list of sourcetype getting index) ... View more

Install Avro Tools: wget 'https://archive.apache.org/dist/avro/avro-1.7.5/py/avro-1.7.5.tar.gz' tar xvf avro-1.7.6.tar.gz cd avro-1.7.6 sudo python setup.py install Install Avro Tools using PIP: pip install avro Conversion from Avro to json avro cat "/avro_file_path/*.avro" -- format json >"output_file_path/output.json" Data input >> Files & Directories >> Moniter "output_file_path/output.json" ... View more

ES App added new option called allow_skew. Adding allow_skew will increase the performance. Searches offset by allow_skew always run over their scheduled time ranges. For example, if a search that is scheduled to run over the past 5 minutes every 5 minutes is supposed to run at 2:05 p.m. but is offset such that it actually runs at 2:07 p.m., it will still search over 2:00:00 p.m. to 2:04:59 p.m. Basically what it is saying is that there won't be any data missed, because it will still run in 5 mins interval, expect running at 5 min on the dot it will run after that. So even for critical alerts, it won't miss any data because it is still going over that time period, expect it's just starting a little later. ... View more

Thanks for response. I tried you suggestion, however getting below mentioned error Error in 'eval' command: Typechecking failed. '-' only takes numbers. ... View more

Thanks Soni , | rex field=fieldInFocus mode=sed "s/^([^{]+)(.+)/\2/g" Work as expected 🙂 ... View more

For "Splunk App for Unix and Linux" we have no option to edit Panel directly. As an alternative we can edit app views, please check below mentioned steps: Select "App" from left top, attaching screenshot for reference Click on "Manage App". From app context select "Splunk App for Unix and Linux". Now sort the table with field "Config type" and check for "views". This will result in all default/inbuilt dashboard "xml" code. Now go back to "Splunk App for Unix and Linux" and click on search option. Create a dummy dashboard and replace the dashboard code with required default/inbuilt code (Captured from step 3) Select/add any additional panel and save the result as a dashboard. Hope this will help. ............SS ... View more

Do you want default/inbuilt panel to bring into front dashboard or you want to create a new one ? ... View more