@szheng6699  Try this in a search: | rex "error=\"(?<error>(?:\\\\\"|[^\"])+)" Or in an inline transform: error="(?<error>(?:\\"|[^"])+) ... View more

It helps me to visualize the summary time ranges using earliest and latest. E.g. For a rolling window of three days covering the last three days: 1: earliest=-3d@d latest=-0d@d 2: earliest=-4d@d latest=-1d@d 3: earliest=-5d@d latest=-2d@d -0d@d is equivalent to @d, but using -0d@d keeps the formatting consistent. The base search earliest and latest values are the range (the total span) of the desired earliest and latest values: tag=report tag=vulnerability earliest=-5d@d latest=-0d@d At the end of the search, we'll add a where command to truncate search results to the last three summarized days: | where _time>=relative_time(relative_time(now(), "-0d@d"), "-3d@d") We first summarize the distinct count of dest by day, signature, and severity. (Substitute signature with another fields or fields as needed to uniquely identify a vulnerability.) I.e. We count each occurrence of dest once per day per signature and severity combination: tag=report tag=vulnerability earliest=-5d@d latest=-0d@d | bin _time span=1d | stats dc(dest) as subtotal by _time signature severity We use streamstats to summarize the subtotal by severity over a span of three days: tag=report tag=vulnerability earliest=-5d@d latest=-0d@d | bin _time span=1d | stats dc(dest) as subtotal by _time signature severity | streamstats time_window=3d sum(subtotal) as total by severity I previously used timechart to pivot the results over _time, but you can also use xyseries: tag=report tag=vulnerability earliest=-5d@d latest=-0d@d | bin _time span=1d | stats dc(dest) as subtotal by _time signature severity | streamstats time_window=3d sum(subtotal) as total by severity | xyseries _time severity total Finally, add the where command we prepared earlier: tag=report tag=vulnerability earliest=-5d@d latest=-0d@d | bin _time span=1d | stats dc(dest) as subtotal by _time signature severity | streamstats time_window=3d sum(subtotal) as total by severity | xyseries _time severity total | where _time>=relative_time(relative_time(now(), "-0d@d"), "-3d@d") The result is the distinct count of dest values by signature and severity over _time. If you'd like, you can a SUBTOTAL column for each day and a TOTAL row for all days: tag=report tag=vulnerability earliest=-5d@d latest=-0d@d | bin _time span=1d | stats dc(dest) as subtotal by _time signature severity | streamstats time_window=3d sum(subtotal) as total by severity | xyseries _time severity total | where _time>=relative_time(relative_time(now(), "-0d@d"), "-3d@d") | addtotals fieldname=SUBTOTAL | addcoltotals labelfield=_time label=TOTAL You can also refactor the base search and stats to use the Vulnerabilities data model and tstats. With or without acceleration: | tstats dc(Vulnerabilities.dest) as subtotal from datamodel=Vulnerabilities where earliest=-5d@d latest=-0d@d by _time span=1d Vulnerabilities.signature Vulnerabilities.severity | streamstats time_window=3d sum(subtotal) as total by Vulnerabilities.severity | xyseries _time Vulnerabilities.severity total | where _time>=relative_time(relative_time(now(), "-0d@d"), "-3d@d") | addtotals fieldname=SUBTOTAL | addcoltotals labelfield=_time label=TOTAL With accelerated summaries only: | tstats summariesonly=t dc(Vulnerabilities.dest) as subtotal from datamodel=Vulnerabilities where earliest=-5d@d latest=-0d@d by _time span=1d Vulnerabilities.signature Vulnerabilities.severity | streamstats time_window=3d sum(subtotal) as total by Vulnerabilities.severity | xyseries _time Vulnerabilities.severity total | where _time>=relative_time(relative_time(now(), "-0d@d"), "-3d@d") | addtotals fieldname=SUBTOTAL | addcoltotals labelfield=_time label=TOTAL ... View more

To keep everything up to and including {host n.n.n.n}, try: "s/(.*{host \d+\.\d+\.\d+\.\d+}).*/\1/g" ... View more

@to4kawa  It should be a field alias in recent versions of Splunk_TA_nix. I just verified 8.2.0 and 8.3.0. It's not present in 5.2.4, which is the only other version I have handy. [top] ... FIELDALIAS-cpu_load_percent = pctCPU as cpu_load_percent ... View more

@goncalosilva123  Here's an alternative with similar performance: | inputlookup a_CSV_file.csv | streamstats current=f last(Date_1) as last_Date_1 last(Total) as last_Total by Item_Name | eval Diff_Date="Diff_".substr(last_Date_1, -2)."_".substr(Date_1, -2) | appendpipe [ | stats values(eval((Total - last_Total)." (".Total."-".last_Total.")")) as Diff by Diff_Date Item_Name ] | eval Date_1=coalesce(Date_1, Diff_Date), Total=coalesce(Total, Diff) | xyseries Item_Name Date_1 Total ... View more

The DBA_DATA_FILES, DBA_TEMP_FILES, and DBA_FREE_SPACE views do not contain date columns. If your Oracle DBAs want to track changes to those views over time, a more appropriate solution would be e.g. a daily DB Connect input with the timestamp set to the current time in the input configuration. After the input is in place, you can just search the data in Splunk: index=foo sourcetype=bar | timechart span=1d values(total_size) ... View more