Splunk uses C-style escape sequences in strings. Escape the inner quotation marks with a backslash: | eval Name=case(Name == "{\"XXX\":[]}", "NULL", Name == "{\"XXX\":[\"ABC\"]}", "ABC" ) ... View more

Hi, You'll need a source of current URLs to compare against past events, e.g. a lookup named url_lookup with a field named url. With that lookup in hand, you can easily, although slowly, depending on your index configuration, filter the input with a NOT subsearch: | inputlookup url_lookup where NOT [ index=yourindex sourcetype=yoursourcetype earliest=-2mon| dedup url | table url ] Replace the index and sourcetype with the correct values or tags or event types for your environment. (Sorry for the double post. Using mobile.) ... View more

In 3.0.2, entities are stored in the itsi_services KV store collection. I haven't used a later version of ITSI yet. Entities have _type=entity. You can see all objects via REST with e.g.: curl -k -u username:password https://localhost:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_services After you've identified the _key values to delete, you can delete objects with curl -X DELETE -k -u username:password https://localhost:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_services/$id where $id is the _key value. I use jq to parse JSON output and select objects for deletion from a shell. E.g. To write all entity identifiers to a file: curl -s -k -u username:password https://localhost:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_services | jq -r '.[] | select(._type == "entity") | ._key' > entities.txt To delete all entities listed in the file: while read id; do curl -X DELETE -k -u username:password "https://localhost:8089/servicesNS/nobody/SA-ITOA/storage/collections/data/itsi_services/$id"; done < entities.txt ... View more

Services don't normally interact with logged on users. Prior to Windows Vista, services and applications ran in the same session, and a service running as the system account could be configured to interact with the first desktop session. On systems supporting multiple sessions--Citrix WinFrame on Windows NT 3.51, Windows NT 4.0 Terminal Server Edition, Windows 2000 Terminal Services, Windows XP Fast User Switching, and Windows 2003 Terminal Services--services could interact with session 0 but not other sessions without using an alternative interprocess communication mechanism. (There was a free resource kit tool for Windows NT 3.51 that provided multiple local sessions as well, similar to multiple sessions in a *nix environment, but I've long since forgotten its name.) With the introduction of Windows Vista and Windows Server 2008, Microsoft isolated session 0 from user sessions, prohibiting services from interacting directly with user desktops; however, through the Interactive Service Detection service, it is possible for a user to switch to the service desktop to view notifications from services. Interactive services running as the system account and services running as users that create windows on desktops will be visible on the isolated session 0 desktop. You can read more about session 0 isolation here. All that said, you should probably look at the WTSSendMessage function. It works correctly from a service and would allow you to expand your check to support systems with multiple sessions. I.e. After enumerating the active sessions, you could send a message to each session, possibly as multiple asynchronous PowerShell jobs, and record the response from each user. ... View more