This seems overly complex to me and you are comparing times after they have been converted to strings which is unlikely to work. I would use the dedup command that only returns the first (latest) event by a field. index="activedir" (objectCategory="CN=Person*" AND userAccountControl!=514) | dedup displayName | eval DateLastChanged=pwdLastSet/10000000-11644473600 | where DateLastChanged < relative_time(now(),"-25d@d") | table DateLastChanged displayName | convert timeformat="%Y-%m-%d %H:%M:%S" DateLastChanged ... View more

The easiest option for you is to set up a different lookup for each sourcetype. They can still be based on the same csv table but with different input fields. If they were the same sourcetype the best option would be to use the fillnull command index=x sourcetype=y dst_ip=* | fillnull value="Unknown" dst_hostname | where AAA=123 but for this to work, you would need lines in your lookup table that match your filled value. ... View more

There are a couple of problems with this. First the regex in setparsing is wrong. You should start the list of numbers with an open brace and don't need the terminating .* REGEX = (?msi)^EventCode=(552|538|576|528|529) Next, you have your regex in setnull to match everything. This will send it all to the null queue. Then you pull back (if the regex is fixed) the ones you want. This is inefficient so you want to create a regex to catch only what you want to throw away. I would do this as follows:- On the indexer props.conf [WinEventLog:Security] TRANSFORMS-set= setnull transforms.conf [setnull] REGEX = (?msi)^EventCode=(?!(552|538|576|528|529)\b) DEST_KEY = queue FORMAT = nullQueue The ?! in this regex is sayng NOT what is in this bracket and the \b is making sure it doesn't match 5221, 5385 etc. By the way, the FORMAT = indexQueue is telling splunk to put the event back in the indexing queue and it will use whatever index was defined in inputs.conf Bob ... View more

You can add the following to the end of your searches | where date_hour >2 or you can schedule the search to only run during the hours you are interested using cron. for example if you wanted a search to run every 5 minutes but not between 2 and 4 am. */5 0-1,4-23 * * * ... View more

You can use bucket to create a date field and then convert to format it as M/D/Y index=_internal sourcetype=splunkd Metrics "group=per_host_thruput"| bucket _time span=1d as date| stats sum(kb) AS Totalkb by date | Eval GB=round(Totalkb/1048576,2) |convert timeformat="%m/%d/%Y" ctime(date) | TABLE date GB ... View more

You have two choices both using the where command and depending on what you want your user to see. If you add it to your search string as below, you would only get an event if it was above 0.25. You can then set it to alert if the number of events is > 0 source="perfmon:physical disk latency" counter="avg. disk sec/read" host="servername" instance=* | where Value>0.25 Or you can leave it out of your search and add it in as a "custom condition" in the alert. The user will then only get an alert if one or more have a Value over 0.25 but will get all events in the results. I would tend to display it as a table and use the timepicker to restrict the time. source="perfmon:physical disk latency" counter="avg. disk sec/read" host="servername" instance=*| table _time host object instance counter Value Then click on " Create an Alert ", Give it a search name , Share it if required, and click Next. Change "Condition" to " If custom condition is met " and in the "conditional search string" box type where Value > 0.25 set the schedule, throttling, Expiration and severity to what you want. Then set it up to send you an email or whatever your preferred alert type is. You will then get an alert whenever any value is over 0.25 and when you look at the results, you will see all the scans in your time range. ... View more

CRCSALT is used to make files look different to splunk. Without it, splunk loads the first and last 256 bytes and uses that to create a hash which it then compares with other files. If you define CRCSALT, its value is added before the hash is calculated so the file looks different. What you have done is add a fixed string "defprof" as the CRCSALT. This will make the file look different once. The next time a similar file arrives, it will be ignored again. If you use " CRCSALT = <SOURCE> " including <> and capitalisation, splunk will use the source file and folder name which will change for every file. Therefore each file looks diferent. From inputs.conf.spec crcSalt = <string> * Use this setting to force Splunk to consume files that have matching CRCs (cyclic redundancy checks). (Splunk only performs CRC checks against the first few lines of a file. This behavior prevents Splunk from indexing the same file twice, even though you may have renamed it -- as, for example, with rolling log files. However, because the CRC is based on only the first few lines of the file, it is possible for legitimately different files to have matching CRCs, particularly if they have identical headers.) * If set, <string> is added to the CRC. * If set to the literal string <SOURCE> (including the angle brackets), the full directory path to the source file is added to the CRC. This ensures that each file being monitored has a unique CRC. When crcSalt is invoked, it is usually set to <SOURCE>. * Be cautious about using this attribute with rolling log files; it could lead to the log file being re-indexed after it has rolled. * Defaults to empty. ... View more