Hi Splunk Azure Team, I am not sure in earlier versions, but Token unset has been introduced in 6.2 details available in this Link Cheers! Vasu ... View more

Hi JD, if you want to display the user field values from multiple lookup table then the below query will helps you, Assuming all your lookup(USECASE1,etc) contains user field named user. |inputlookup USECASE1 | table user |append[|inputlookup USECASE2 | table user] | append[ | inputlookup USECASE3| table user] | stats count by user | table user If you have the different field names in other lookup you can rename it, as like the below search |inputlookup USECASE1 | table user |append[|inputlookup USECASE2 |rename user2 as user | table user] | append[ | inputlookup USECASE3| rename user3 as user | table user] | stats count by user | table user If you are looking for a list of lookup table available across the application and user this will help you. |rest /servicesNS/admin/search/data/lookup-table-files | table title if you want you can retrieve based on required user / app etc.. Hope this will help you. Cheers! ... View more

Cheers !!! ... View more

Cool !!! ... View more

Hi dolfantimmy, Please ensure your search doesn't contains any macro's / eventtypes which is created by the SoS. Most of the SoS application search string contains macro's those are with permission "in app" so probably you need to change the permission to global. I tried locally its working fine. could you please share the exact query what you are cloned from SoS. Cheers! VaSu ... View more

Create a python / shell script to do the backup work and schedule it. If you have Splunk distributed environment then your script should take care of the other search peers as well as forwarders. Cheers! ... View more

try this, your search..... | rename yourfield1 as [subsearch ... | eval fieldname="\"get a unique string to rename\"" | return $fieldname] sample search, |stats count| eval field1="my value" | rename field1 as [|stats count | eval str="\"My Field 1\""|return $str] ... View more

Try this, ..yoursearch| rex field=main "(?s) (?<user>.*) your file is attached" | stats count by user sample search |stats count | eval main="hello Vasanth Kumar your file is attached,hello User One your file is attached,hello User two your file is attached,hello vasanth3 your file is attached" | eval main=split(main,",") | mvexpand main | rex field=main "(?s) (?<user>.*) your file is attached" | table main, user Hope this will help you.... Cheers! ... View more

Try to use joins or based on your requirements use the other answer, http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Join http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html ... View more

Thanks Martin_Muller, actually its my mistake, now changed the question with proper tags,I will give a try and update it. ... View more

Try this,, Dashboard 1: <dashboard> <label>Errors by Severity</label> <description>Errors by Severity,,.....</description> <row> <panel> <table> <searchString>index=_internal | stats count by host | rename host as Level</searchString> <earliestTime>0</earliestTime> <latestTime/> <option name="drilldown">row</option> <drilldown> <link> <![CDATA[ /app/search/newdashboard?Level=$row.Level$ ]]> </link> </drilldown> </table> </panel> </row> </dashboard> Drilldown_Dashboard 2: <dashboard> <label>newdashboard</label> <description/> <row> <panel> <table> <title>Area (filtered by Level $Level$)</title> <searchString>index=_internal | stats count by host</searchString> <earliestTime>0</earliestTime> <latestTime/> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> </table> </panel> </row> </dashboard> ... View more

Add * front and back of your token based on your req like server type inputlookup ccr_serverlookup.csv | where landscape="$landscape$" AND servertype="*$servertype$*" | stats count by hostname | dedup hostname | sort hostname ... View more

Try this ... | chart avg(Value) AS Value by Name | sort -Value | head 10 | eval N=Name | eval Name ="" | xyseries Name N Value | table * ... View more

provide some sample events and expected result If possible provide the search query you are running. ... View more

Hi RomeoG, Since you have already indexed the data in same index, create / update the roles with "Restrict search terms " parameter. This may help you. ... View more

Another way to make epoch time without making new field, same query instead of | eval dateadded_epoch = strptime('Date Added', "%Y-%m-%d %H:%S") use | convert timeformat="%Y-%m-%d %H:%M:%S" mktime("Date Added") Query base search identifying the correct file | convert timeformat="%Y-%m-%d %H:%M:%S" mktime("Date Added") | where "Date Added" >= relative_time(now(), "-7d@d") At end you will get same result 😉 Thanks, Vasu ... View more

Hi chrismok, Its not a bug in splunk, strftime is a function that takes epoch time as first parameter and format human readable format like YYYYDDMM etc, based on your format string in second param. you should use those functions in "eval". As per your requirement this query will help you. sourcetype=abc [|gentimes start=-1 | eval source="*"+strftime(now(),"%Y%m%d")+"*" | return source] Thanks, Vasu ... View more

Try this, index=whatever* (sourcetype=server "_DATE_FROM_IN =*" "*_DATE_TO_IN =*") OR (tms_action="*someaction*") | rex "'(?[^']+)\s*' .*" |REGEX _DATE_TO_IN ="'\d+'" | rex field= "_DATE_FROM_IN (?<_DATE_FROM_IN>.*)"|rex field= "_DATE_TO_IN (?<_DATE_TO_IN>.*)" | table userhandle tms_blob_type _DATE_TO_IN _DATE_FROM_IN | join userhandle [search index=summary source=*Username* | table userhandle user company] ... View more

Try this, index="fxr" fxr_ftpup_filename="DMM02YBRYBRPACEAVAILCOLLAT_04" OR fxr_ftpup_filename="DMM01YBRYBRCOLLATNAV_05" OR fxr_ftpup_filename="DMM10YBRDMMPaceRepoedgeInstruments__02" OR fxr_ftpup_filename="DMM04YBRYBRPACEREPOTRD_04" OR fxr_ftpup_filename="DMM04YBRYBRPACEOTCTRD_04" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time) as FileTransmissionTime | rename fxr_ftpup_filename as FileName,fxr_status as Status| replace "DMM01YBRYBRCOLLATNAV05" with "EXPALGONAV-BNYM TO DMM NAV","DMM02YBRYBRPACEAVAILCOLLAT_04" with "EXPALGOPOF-BNYM TO DMM Free Inventory","DMM10YBRDMMPaceRepoedgeInstruments__02" with "EVNT- PRICE DEMAND 01:30AM","DMM04YBRYBRPACEREPOTRD_04" with "EXPALGOPOR-BNYM TO DMM Repo Transaction","DMM04YBRYBRPACEOTCTRD_04" with "EXPALGOOTC-BNYM TO DMM OTC Transaction" in FileName | timechart span=1m count by FileName | appendcols [ search index=_audit action=alert_fired ss_app=search |convert ctime(trigger_time) as Time | timechart span=1m count(ss_name) by ss_name] ... View more