LDAP users which are access to the Splunk will be list down in the rest command. if you want to query the LDAP, Usually organizations will use the some GUI for LDAP / Active Directory, OR you can use the Add-on SA-LDAPSearch . https://splunkbase.splunk.com/app/1151/ https://docs.splunk.com/Documentation/SA-LdapSearch/2.1.4/User/Theldapsearchcommand ... View more

yes, you can filter the duplicate using dedup during the search time. Have you check the source file have duplicate or not? If yes then you can use the dedup other wise try to figure out why the events were duplicated. Any luck with splunk_server and bucket analysis? ... View more

Try the below config, [APP1_INOUT_App2] DATETIME_CONFIG=CURRENT SHOULD_LINEMERGE=true NO_BINARY_CHECK=true CHARSET=UTF-8 INDEXED_EXTRACTIONS=json KV_MODE=none pulldown_type=true ... View more

Hi Duke_Splunk_admins, During each search the list of search peers will be involved in the search action. Since you are aware of one peer is down you can remove from your indexer cluster till the time server backup. Follow the below steps to remove the peer, (Read the notes before perform any, make sure master is in maintenance mode ) https://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Removepeerfrommasterlist Best practice to take the search peer offline, http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Takeapeeroffline Hope this will helps you.... ... View more

it's a splunk search so it doesn't matter windows / linux. Do you have sufficient permission to run the search? ... View more

Hi Wvalente, Usually splunk restart for savedsearch.conf changes is not required, you have to refresh by using , http://<yoursplunkserver>:<your web port, default 8000>/debug/refresh Below link will help you to understand when to restart splunk, https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Configurationfilechangesthatrequirerestart Check your Splunk version and the documents for more information, Hope this will helps you!!! ... View more

Hi Jcorkey, To get the list of users in the system use the below search, | rest /services/authentication/users splunk_server=local | table type, title, roles, realname email * To get only the LDAP users you have to filter the type, where type=LDAP is LDAP user and type=Splunk is Splunk created user, | rest /services/authentication/users splunk_server=local | where type="LDAP" | table type, title, roles, realname email * Hope this helps you !! ... View more

try something like this, source="ABC" sourcetype="csv"|where Level="Lvl3" AND Track="ATL(27)"|rex field=Track mode=sed "s/([^)]*)//"|table "Dom", Track Level ... View more

try something like this, | makeresults | eval input="ATM1,INQ-ATM2,CWD-ATM1,INQ-ATM1,INQ-ATM2,CWD-ATM1,INQ-ATM2,INQ-ATM1,CWD-ATM3,INQ-ATM3,INQ-ATM1,CWD-ATM3,INQ" | makemv delim="-" input | mvexpand input | rex field=input "(?<terminal_id>[^,]+),(?<tran_type>.+)$" | table _time, terminal_id, tran_type | eval raw=terminal_id+"-"+tran_type |sort 0 terminal_id | autoregress raw | eval sameAsNext=if(raw=raw_p1,1,0) | streamstats current=t count(eval(sameAsNext=0)) AS sessionID | eventstats count AS inArowCount BY sessionID | where inArowCount>=3 | table _time, terminal_id, tran_type Actual search will be, your base search ... | eval raw=terminal_id+"-"+tran_type |sort 0 terminal_id | autoregress raw | eval sameAsNext=if(raw=raw_p1,1,0) | streamstats current=t count(eval(sameAsNext=0)) AS sessionID | eventstats count AS inArowCount BY sessionID | where inArowCount>=3 | table _time, terminal_id, tran_type Updating my answer based on this, ... View more

Your extraction have double quotes (") so you have to use double quotes in your lookup or correct the field extraction. Check the extraction | rex .*\\\(?<filename>\S+)\s?\"$ then use defrag.exe in your lookup. ... View more

Try this search, | inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country" | eval Country=case(Country="FRANCE", "France",Country=AUSTRALIA, "Australia" ,1=1,Country) | geom geo_countries featureIdField="Country" ... View more

| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country" | eval Country=case(Country="FRANCE", "France",Country=AUSTRALIA, "Australia" ,1=1,Country) | geom geo_countries featureIdField="Country" I have changed only France and Australia . Try to change the others, ... View more

yes. that's the actual dashboards. isDashboard=1 will gives you the forms & dashboards. forms - dashboards with inputs (filters like timefilter or other custom inputs). other than that isDashboard=0 will gives you the System level views like search and reports, dashboard view (list of dashboards) etc. "eai:data" will gives you the xml. you can validate based on your apps. | rest /servicesNS/-/-/data/ui/views |search isDashboard=1 | table isDashboard eai:acl.owner, label, title, author, id eai:acl.app disabled eai:data ... View more

Hi sheltomt, Below search will gives you all dashboards across applications in your environment | rest /servicesNS/-/-/data/ui/views |search isDashboard=1 | table isDashboard eai:acl.owner, label, title, author, id eai:acl.app disabled Use the below search to identify dashboard counts by application name, | rest /servicesNS/-/-/data/ui/views |search isDashboard=1 | table isDashboard eai:acl.owner, label, title, author, id eai:acl.app disabled | stats dc(id) as count by eai:acl.app | addcoltotals you can filter the required applications along with the isDashboard=1. Hope this will helps you. ... View more

try this, Average, | tstats count where index=* by index _time span=1s | stats avg(count) as avg by _time Overall, | tstats count where index=* by _time span=1s For index wise, | tstats count where index=* groupby index, _time span=1s | xyseries _time, index, count ... View more

Settings - > saved searches and reports -> open your alert -> update the to / cc with commas(email id1, emailid2) check this, http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Alert/Alertexamples http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Alert/Emailnotification ... View more

Hi Bharath, We are talking about two separate environment, I can think of two options, Update the search peers in Splunk 1 - Suggest will not go that route if you are talking about one panel / very few reports. Create a Embedded report and refer in Dashboard 1. you can read the steps from https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Report/Embedscheduledreports https://www.splunk.com/blog/2014/05/08/17682/ Hope this will helps you. ... View more

Try this, Lookup, env_dfn.csv Environment Host DEV host1_dev DEV host2_dev DEV host3_dev TEST t_host1_dev TEST t_ host2_dev TEST t_host3_dev Source: <form> <fieldset submitButton="false" autoRun="true"> <input type="time" token="time_token"> <label>Select Time Range</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> <input type="multiselect" token="env_tkn" searchWhenChanged="true"> <label>Select one or multiple ENV/s</label> <choice value="*">All</choice> <search> <query>| inputlookup env_dfn.csv | dedup Environment | sort Environment</query> </search> <fieldForLabel>Environment</fieldForLabel> <fieldForValue>Environment</fieldForValue> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR Environment=</delimiter> <default>*</default> <initialValue>*</initialValue> </input> <input type="multiselect" token="selected_host" searchWhenChanged="true"> <label>Select one or multiple Host/s</label> <choice value="*">All</choice> <search> <query>| inputlookup env_dfn.csv | table Environment Host | search Environment=$env_tkn$ | dedup Host | table Host | sort Host</query> <earliest>0</earliest> </search> <fieldForLabel>Host</fieldForLabel> <fieldForValue>Host</fieldForValue> <delimiter> OR host=</delimiter> <default>*</default> <initialValue>*</initialValue> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> </input> <input type="multiselect" token="source_type" searchWhenChanged="true"> <label>Select one or multiple Source Type/s</label> <search> <query>index=temptesting_007 [| inputlookup env_dfn.csv | rename Host as host | search Environment=$env_tkn$ (host=$selected_host$) | stats c by host |table host | format]| stats count by sourcetype | sort limit=100 sourcetype</query> <earliest>0</earliest> </search> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <delimiter> OR sourcetype=</delimiter> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="text" token="extra_tkn" searchWhenChanged="true"> <label>Add additional search string (optional)</label> <default>*</default> </input> </fieldset> <row> <panel> <table> <title>Stats by Host and Source Type</title> <search> <query>index=temptesting_007 host=$selected_host$ sourcetype =$source_type$ AND $extra_tkn$ | stats count by host sourcetype</query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> <panel> <table> <title>Timechart by Sourcetype</title> <search> <query>index=temptesting_007 host=$selected_host$ sourcetype =$source_type$ AND $extra_tkn$ | timechart count by sourcetype</query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> ... View more