check your MAX_TIMESTAMP_LOOKAHEAD (default is 128 char, which doesn't apply in your case) and TIME_PREFIX in props.conf for the selected sourcetype. ... View more

Refer to this answer: https://answers.splunk.com/answers/111161/how-do-i-get-splunk-to-recognise-epoch-time.html ... View more

such a neat solution 🙂 ... View more

earliest=-y@d will give you that will give you dd/mm/(yyyy-1) you can test around further, if you want to go back two years, earliest = -2y@d ... View more

One suggestion: setup distributed searches and add the indexers as search peers is an option. You can restrict index access by roles. Added benefit, license is not consumed by both the teams for the same data. https://docs.splunk.com/Documentation/Splunk/8.0.2/DistSearch/Configuredistributedsearch ... View more

Theres three options: - If Splunk is being used for enterprise purposes, you should reach out to Splunk Sales team - If you're using for dev purposes, see this link https://dev.splunk.com/enterprise/dev_license/ - Lastly, https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/MoreaboutSplunkFree ... View more

Contact the education team and check with them https://answers.splunk.com/answers/508229/how-do-i-contact-splunk-education.html ... View more

@MOHITJOSHI the makeresults command till multikv command is to create dummy data to demonstrate. in the original query, just user index=myindex follow by the below from transaction command onwards. This example is with three events, notice how execution changes as now we need to look at what the first transaction is and what the last transaction is. Also, since the "time" column has more than 2 values, the mvindex above will not apply. So it needs to be modified to meet "n" number of values. | makeresults | eval _raw = "_time, action, transact 2020-03-11 22:29:20, /Logout, Transaction:=InpatUPMC_090_Billing_WorklistLoad 2020-03-11 22:29:10, /other, Transaction:=InpatUPMC_090_Billing_WorklistLoad 2020-03-11 22:29:07, /Login, Transaction:=InpatUPMC_090_Billing_WorklistLoad " | multikv forceheader=1 | transaction transact startswith="action=*Login" endswith="action=*Logout" mvlist=time | eval prev_time=strptime(mvindex(time, 0) , "%Y-%m-%d %H:%M:%S") | eval last_time=strptime(mvindex(time, mvcount(time) - 1), "%Y-%m-%d %H:%M:%S") | eval duration = round(last_time - prev_time,1)."seconds" | table transact action duration ... View more

Here you go, this is from the table command onwards: | table _time, Last_Received, Minutes_Ago, Panel, Status | streamstats count by Panel | where count <= 2 `comment("The above streamstats and where command is so that include only the last two results")` | stats list(Status) as status by Panel | eval status = case(match(mvindex(status,0), "normal") AND match(mvindex(status,1), "normal"), "System status has not changed", match(mvindex(status, 0), "normal"), "System has returned to normal", match(mvindex(status, 0), "degraded"), "System is degraded") | eval system_status = case(match(status, "System is degraded"), 0, match(status, "System status has not changed") OR match(status, "System has returned to normal"), 1) | eventstats sum(system_status) as sum_status count(Panel) as panel_count | eval overall_status = if(sum_status / panel_count != 1, "System status is degraded", "System is running normally") ... View more

@mmccul_fe like this? | makeresults | eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}" | spath | rename foo{}.* as * randstring*.fqdn as randstring* | eval fqdn = "" | foreach randstring* [eval fqdn = fqdn + " " + '<<FIELD>>'] Note: the screenshot is an older image, i've renamed column3 "randstring" to fqdn in my answer Results: ... View more

@pipipipi the _raw line is to demonstrate the example. In your case, you will have the following: | inputlookup test1 | eval date_new=strptime(date,"%y-%m-%d %H:%M:%S.%9N") | eventstats min(date_new) as starttime max(date_new) as endtime count as totalevents | eval avg = round((endtime-starttime) / totalevents,1) ... View more

Something like this: | makeresults | eval _raw = "list item1 item2 item3" | multikv forceheader=1 | eval inList1 = "Y" | appendcols [| makeresults | eval _raw = "list item1 item2 item3 item4 item5" | multikv forceheader=1 | table list] | eval inList2 = if(inList1 = "Y", "N", "Y") | where inList2 = "Y" | table list ... View more

As such: | makeresults | eval _raw = "caseid,date a, 19-01-01 15:54:43.934000000 b, 19-01-01 16:54:43.934000000 c, 19-01-01 17:54:43.934000000 d, 19-01-01 18:54:43.934000000" | multikv forceheader=1 | eval date_new=strptime(date,"%y-%m-%d %H:%M:%S.%9N") | eventstats min(date_new) as starttime max(date_new) as endtime count as totalevents | eval avg = round((endtime-starttime) / totalevents, 1) ... View more

Using the transaction command you will get the following: | makeresults | eval _raw = "_time, action, transact 2020-03-11 22:29:10, /Logout, Transaction:=InpatUPMC_090_Billing_WorklistLoad 2020-03-11 22:29:07, /Login, Transaction:=InpatUPMC_090_Billing_WorklistLoad " | multikv forceheader=1 | transaction transact maxevents=2 mvlist=time | eval prev_time=strptime(mvindex(time, 0) , "%Y-%m-%d %H:%M:%S") | eval last_time=strptime(mvindex(time, 1), "%Y-%m-%d %H:%M:%S") | eval duration = round(last_time - prev_time,1)."seconds" | table transact action duration transact action duration Transaction:=InpatUPMC_090_Billing_WorklistLoad /Login /Logout 3.0seconds ... View more

Hey @sov_gwright I think i got to the bottom of the error. Firstly open up the Audience dashboard and clone it. This is to ensure we are not breaking anything to confirm the issue and changes Let me explain with an example about what I have drilled down for the "Error in 'map': Did not find value for required attribute " message. | makeresults | eval Site="%" | eval Status ="" | map search="|makeresults | eval _raw = \"Site, Status Site1, ON Site2, ON , OFF Site4, ON \" | multikv forceheader=1 | where like(Site, \"%\".$Site$.\"%\") | table Site Status" | table Site Status The above should return Site1, Site2 and Site4. Splunk's Search Parser replaces $Site$ to "SITE_VALUE" If we do the same with $$ | makeresults | eval Site="%" | eval Status ="" | map search="|makeresults | eval _raw = \"Site, Status Site1, ON Site2, ON , OFF Site4, ON \" | multikv forceheader=1 | where like(Site, \"%\".$$Site$$.\"%\") | table Site Status" | table Site Status The Search Parser does something different: SearchParser - PARSING: | where like(Site,(("%" . '"%"') . "%")). So in the cloned dashboard, edit click edit search on the Pageviews panel. Issue: The site and other values contains $$ and is also enclosed in quotes \". Fix: replace \"$$ and $$\" OR "$$ and $$" with $ respectively. ... View more

"Archive files (such as a .tar or .zip file, are decompressed before being indexed." https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#How_Splunk_Enterprise_monitors_archived_files So it is reading the timestamp of the recorded event and not the timestamp of the source file. If you would like to extract the timestamp when the bz2 file is created, use this splunk answer: https://answers.splunk.com/answers/705686/how-do-you-extract-a-timestamp-from-a-filename.html Unless you've a specific use case where the timestamp of the source file is needed, would recommend, using the event time, because all your events will be occurring at 1am. With millions of record to search through, it will quickly turn into a pain point. ... View more

If you must go with the API, then you will need to install it on a HF. so: FW <--- (install TA which uses API) HF ---> Splunk Cloud The syslog option is the best solution: FW ---> Syslog (install UF with Splunk cloud config) --> Splunk Cloud ... View more

can you post a sample of your Json ... View more

@rajveer005 have you looked into this? https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGwCAK ... View more

| rex field=_raw "(\.sessionid=)(?<ABC>(\w*[\-\&]?)+)" ... View more

No issues with how it is currently being done. So stick to the standardised approach where the syslogs are collected to the syslog server and update the document. ... View more

Have a look at this answer https://answers.splunk.com/answers/642929/how-to-lookup-match-on-ip-return-user-value-within.html ... View more