Try to use this then: | eval sum= case( (day_of_week=="Tuesday" OR day_of_week== "Sunday"), 86400, 1=1, 172800) ... View more

@darioapis In case of unspecified number of columns: Use <your search> | timechart sum(*) ... View more

@louisawang | eval sum= case(day_of_week=="Monday",0, (day_of_week=="Tuesday" OR day_of_week== "Sunday"), 86400, 1=1, 172800) This is setting which is added. So For monday i have set not to change. Can you give me list, like Monday ----> SLA end ----> Sat I will change it accordingly. For SLA based on business hours, you can change it as well. The numbers 86400, 172800 is seconds, which you can change based on your requirement. ... View more

@splunked38 I think we can change limit on mvexpand. The 2nd approach seems good. you can adjust the limit by editing the max_mem_usage_mb setting in the limits.conf file to increase the limit of mvexpand. ... View more

@mishaaaaaaaaaa Can you please explain the requirement again with any snippet if you have? ... View more

@ajitshukla If data is coming to Splunk then you can create a report using search command and outputlookup the result to a csv file. ... View more

Index need to be already in place then only it will work. And also it will just copy what ever events there to new index and yes you can used to report volume. ... View more

@Crashfry Even we have seems alot of issues while upgrading from 2.x to 3.x. But in this case no issues as per now. ... View more

Place this setting on HF or Indexer ... View more

Hello @sunnyb147 I think something like below will work for you: props.conf [host::A|B] TRANSFORMS-datafilter = route_to_correct_index [host::C|D] TRANSFORMS-datafilter = route_to_correct_index2 Transforms.conf [route_to_correct_index] REGEX = . DEST_KEY = _MetaData:Index FORMAT = index_test1 [route_to_correct_index2] REGEX = . DEST_KEY = _MetaData:Index FORMAT = index_test2 ... View more

Updated the correct answer here as well: <form> <label>month&amp;year</label> <fieldset submitButton="false"> <input type="dropdown" token="month_tok"> <label>Month</label> <choice value="Jan">Jan</choice> <choice value="Feb">Feb</choice> <choice value="Mar">March</choice> </input> <input type="dropdown" token="year_tok"> <label>Year</label> <choice value="2017">2017</choice> <choice value="2018">2018</choice> <choice value="2019">2019</choice> </input> </fieldset> <row> <panel> <title>$month_tok$ $year_tok$</title> <table> <search> <query>index="os" sourcetype="Ser" CaseNumber=* status=* assignment_group=* [|makeresults | eval time1="01-".$month_tok|s$."-".$year_tok|s$ | eval time1=strptime(time1,"%d-%b-%Y") | eval time2 = relative_time(time1, "+1mon") | eval latest = relative_time(time2, "-1d") | eval earliest=time1 | return earliest, latest] |dedup _time,CaseNumber,assignment_group| streamstats current=f last(assignment_group) as lg, last(active) as Active by CaseNumber | eval ss=case(assignment_group!=lg AND assignment_group="Sus","Escalated",assignment_group="Sus" AND status="Complete" AND (isnull(Active) OR Active="true"),"Resolved") |stats count by ss</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> ... View more

Great. your welcome 🙂 ... View more

Hello @bobbychanthongphio As per me the best way to do is using collect command: <search to filter events of 10.20.x.y> | collect index=firewall2 source=source sourcetype=sourcetype testmode=false ... View more

@arvinddp yes updating the value is quite possible. you can create a panel for updating like select row_number which need to updated. And based on that you can update the values of different fields. Like | inputlookup Alert_Suppress1.csv | streamstats count(sourcetype) as Row_Number | eval sourcetype=if(Row_Number == 5, $tok_sourcetype|s$ , sourcetype) | outputlookup Alert_Suppress1.csv Even if you have new fields that is also possible in the same way mentioned above. ... View more

Hello @PowerPacked I guess you are talking about TIMESTAMP_FIELDS parameter in props.conf. First of all TIMESTAMP_FIELD is a field in your data which will at the end contribute to _time. Like if you have some structured data where you have multiple time fields so you can specify which field should be _time. So we mention the TIMESTAMP field there. For better understanding, refer this link: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Propsconf I hope this answers your question. ... View more

Hello @aravindp I have created a Splunk form to add entry as well delete entry from csv. Please check this: Alert_Suppress Dashboard to Provide any Suppress Alert info Sourcetype sourcetype sourcetype index=* | stats count by sourcetype -24h@h now Start Time in "DD/MM/YYYY HH:MM:SS" format End Time in "DD/MM/YYYY HH:MM:SS" format </fieldset> <row> <panel> <title>Delete a Row</title> <input type="dropdown" token="row_number_tok" searchWhenChanged="false"> <label>Row_Number</label> <fieldForLabel>Row_Number</fieldForLabel> <fieldForValue>Row_Number</fieldForValue> <search> <query>| inputlookup Alert_Suppress1.csv| streamstats count(sourcetype) as Row_Number</query> <earliest>-24h@h</earliest> <latest>now</latest> <refresh>5s</refresh> </search> </input> <input type="checkbox" token="delete_tok" searchWhenChanged="true"> <label>Delete</label> <fieldForLabel>value</fieldForLabel> <fieldForValue>value</fieldForValue> <search> <query>|makeresults |eval value= "Delete"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <delimiter> </delimiter> </input> <html id="field10"> <body> <a href="/app/search/alert_suppress" style="margin-left:0px">Reset</a> <p /> </body> </html> <table depends="$show_panel2$"> <search> <done> <unset token="show_panel2"></unset> </done> <query>| inputlookup Alert_Suppress1.csv| streamstats count(sourcetype) as Row_Number | eval Row_Number2= if($delete_tok|s$="Delete",$row_number_tok$,NULL) | where Row_Number != Row_Number2 | fields - Row_Number, Row_Number2 | outputlookup Alert_Suppress1.csv</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> <row> <panel depends="$show_panel$"> <title>Suppress Information</title> <table> <search> <query>| inputlookup Alert_Suppress1.csv| append [| makeresults |eval User=admin | eval sourcetype=$sourcetype_tok|s$ | eval START= $start_tok|s$ | eval END= $end_tok|s$ | eval Time=now() | eval Time=strftime(Time, "%d/%m/%Y %T") | eval User = $env:user|s$ | fields - _time] | outputlookup Alert_Suppress1.csv</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <done> <unset token="show_panel"></unset> </done> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> <row> <panel> <title>Suppress Information</title> <table> <search> <query>| inputlookup Alert_Suppress1.csv</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <refresh>5s</refresh> <refreshType>delay</refreshType> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> ... View more

Hello @HenryFitzerald , try something like this: index=universal_alerts_ NOT [| makeresults | eval source= "ALERT1;ALERT2;ALERT3;ALERT4;" | eval source=split(source,";") | mvexpand source | fields - _time] | timechart count by source ... View more

Hello @christiabubedu There is limit of 10000 records or 60 sec on Subsearch. Thats why the events are not able to match for you. So to avoid this situation, the best way is to use dedup or filter you data as per your need. try to use dedup for Ip in subsearch which will help you. index=cesa_paloalto sourcetype="pan:traffic" type=TRAFFIC vendor_action=allow | join src_ip [| inputlookup append=t ipsmalware2.csv fields Ip | dedup Ip | eval src_ip= Ip] | stats values(src_ip) ... View more

@milidna13 You need to place a test of fields before map command always. If you are creating a macro then try to do it like this: eval field1 = if(isnull(field1),"", field1) | eval field2 = if(isnull(field2),"", field2) | eval field3 = if(isnull(field3),"", field3) | eval field4 = if(isnull(field4),"", field4) | map [| eval field1=if(isnull("$field1$"),"","$field1$") | eval field2=if(isnull("$field2$"),"","$field2$") | eval field3=if(isnull("$field3$"),"","$field3$") | eval field4=if(isnull("$field4$"),"","$field4$") ] ... View more

Hello @soundv, I have tried it with my data, are you looking something like this: index=* source="WinEventLog:Security" | stats count by category | eval [ search index=* | stats count | rename count as count2 | return count2] | eval Diff= count2 - count | fields - count, - count2 ... View more

Hello @orvarehn Did you update Splunk recently? ... View more