In the 4.2.0 version of the Common Information Model Add-on Manual, it states clearly the Web object name should be tagged by "web". However, in the actual data model downloaded from splunkbase, the Web root is constrained with sourcetype=iis*. Is this a bug or am I missing something? ... View more

It seems that the lookup table for defining extra fields in datamodel can not be a dblookup (database lookup)? Can someone confirm this is the case and not a bug? The dblookup works fine in standalone search, but I am not able to make it to work in datamodel editor. ... View more

Has anybody used the searchTemplate with searchPostProcess with single element? I simply can't get it to work. It always shows 0. If I run the concatenated search, it works fine. What's wrong? Here is the snippet of the code: <searchTemplate> <![CDATA[ sourcetype=sitescope Capsuletech: host="UHSISMONCPRA*" | regex source="SiteScope\d{4}_\d{2}_\d{2}(?<!v2)\.log" | head 2000 ]]> </searchTemplate> inside the "dashboard" element. Then in a single element, I have <searchPostProcess>search NOT UHCASSPR* | dedup MonitorName sortby -_time | stats count as total</searchPostProcess> <field>total </field> ... View more

Hi, Has anyone actually tried the CORS in splunk? I configured the following in server.conf, but I can't get the splunkjs to access splunk instance on a different machine than a web2py server. Is there anything that I need to change on client/javascript side? [httpServer] crossOriginSharingPolicy = * ... View more

Hi, I have a query that is meant to compare longitudinal count of an event of a given day (e.g. today) with historical longitudinal percentiles. query 1: index=interfaces sourcesession="MICHART_SIU_HL7_INBOUND" [`define_relative_week(1)`] date_wday!=saturday date_wday!=sunday | bin _time span=20m | stats count as count by _time | eval timeofday=tonumber(strftime(_time, "%H"))*3600 + tonumber(strftime(_time,"%M"))*60 | stats perc5(count) as perc5 perc95(count) as perc95 by timeofday | eval timeofday= tostring(timeofday,"duration") | join type=outer timeofday [search index=interfaces sourcesession="MICHART_SIU_HL7_INBOUND" | bin _time span=20m | eval timeofday=tonumber(strftime(_time, "%H"))*3600 + tonumber(strftime(_time,"%M"))*60| eval timeofday= tostring(timeofday,"duration")| stats count by timeofday] |sort timeofday where define_relative_week is a macro: stats count | addinfo | eval earliest=(info_min_time-604800*$n$) | eval earliest=strftime(earliest,"%m/%d/%Y:%H:%M:%S") | eval latest=(info_max_time-86400) | eval latest=strftime(latest,"%m/%d/%Y:%H:%M:%S") | return earliest,latest Basically, this search grabs historical data (previous week) and bins the time, and then compute percentile by binned time. Some of the things that I'm grappling with are: multiple event types. How to generalize this to multiple event types? For example, I have many types of events (e.g. with different sourcesession values). And recomputing the historical percentile for each type of events is going to be too much for computations. Acceleration. Suppose for now, there is only one event of interest. How can I further accelerate this search? I need to set-up an alarm by comparing current count with 5% and 95% percentiles for the same time period, and the saved alarm/search will run every 15 minutes and inspect the previous 15 minutes to see whether there is any anomaly. I tried the following query which filters out irrelevant time ranges. But to my surprise it runs slower than the original query. Any insights why? query 2: | gentimes end=-1 increment=24h [stats count | addinfo | eval start=(info_min_time-604800*2) | eval start=strftime(start,"%m/%d/%y:%H:%M:00")| return start] | rename starttime as earliest | eval latest=earliest+20*60 | sort - earliest | map maxsearches=99999 search="search earliest=$earliest$ latest=$latest$ index=interfaces sourcesession=MICHART_SIU_HL7_INBOUND " | ... ... View more

Here is a simple example: Server restarts at midnight, the anomalies command didn't really catch the drastic drop in event volumes. I can't embed the image so here is the link: i.imgur.com/a0nnbHK.png ... View more