You can use the timewrap command to do this, e.g. index=_internal earliest=-4h | timechart span=1m count | timewrap 1h and it will generate 4 series, one for each hour on the same chart overlayed on top with the x-axis showing the last hour ... View more

This happens when you save the dashboard from editing in UI mode - if you want comments to stay, you need to edit in source mode, but I've found that there's always the one save you forget to do and all the comments move... If you want SPL code comments, then the best option is to create a simple eval based macro that returns "" and use `c("This is a comment")` where c is the macro Don't think there is a way to prevent the move otherwise. I use the comment all the time in searches, both in dashboards and saved searches, it provides a really good way to document the search and, in particular, the usage of tokens in the search, how they are set and their scope. My understanding is that there is no real cost implication in using this type of eval macro. ... View more

transaction command may be limited by memory constraints - you have maxspan, but depending on your transaction length - you are using a long transaction time - and whether you have many open events still, you could be hitting memory limits. This is often a cause for somewhat confusing, non-repeatable behaviour. If you have access to limits.conf, you could play around with the settings to see if that is a possibility. ... View more

Kudos @murakoshi Nice technique. I was just trying to work out how to do this and came across this post. Thanks ... View more

Did you resolve this? We have a similar issue with KV store and REST API. ... View more

We cloned the Notable event data model and added event_id as a field in the data model. Then in the Phantom app for Splunk, used that data model to select events and passed the event id across to Phantom. ... View more

I expect you could use a couple of streamstats commands with two different time windows to generate aggregations without losing the data as you would with timechart, stats or bin. Not sure what your 5 minute grouping is expected to look like though, as I don't understand your group example above. ... View more

We changed the CIM that pushes the event to Phantom to add event_id, then in Phantom, the event id is available. ... View more

I guess you need to express what the percentage is that you wish to see ... View more

The use of match and nomv rather then mvfind, is an indicator that the field was not multivalue or was hitting some MV field limit. In principle mvfind should work as a general rule. ... View more

cron with sed -i if running on unix? May not be what you're after and may not be responsive enough, but would also need to know what 'new' means in that context. (timestamp vs xx number) ... View more

Are your example numbers what you want? Between Jan and Feb 300 is 50% more than 200 (b > a) 200 is 33.3% less than 300 (a < b) by between Feb and Mar 300 is 200% more than 100 (a > b) 100 is 66% less than 200 (b < a) so in your example are you looking to show, a) when negative, what % the smaller value is of the larger value b) when positive, what % the difference between the values is of the larger value or something else. Note that the sort -Month will sort in reverse chronological order, so with the %Y-%m your order will be March,Feb,Jan. Naturally if you then use delta, that will give different results. So you could use | eval Month=strftime(_time,"%Y-%m") | stats count by Month | sort Month | eval diff=0 | delta count as diff | eval percentage=round(diff/count*100,0) Note that if you change the sort order the delta values are different. In the ascending sort, then change from 300 to 100 shows -200%. So it sort of depends if Feb in your example is needed to show a) Feb is a 50% growth over Jan b) Jan was 33% lower than Feb but to give you your example, you would have to do | sort Month | eval diff=0 | delta count as diff | eval percentage=round(if(diff>0,diff/count*100,diff/(count-diff)*100),0) NB: Ascending sort Run anywhere example | makeresults | rename COMMENT as "Setting up data to show example" | eval f="2019-01,200#2019-02,300#2019-03,100" | makemv delim="#" f | mvexpand f | rex field=f "(?<Month>[^,]*),(?<count>.*)" | fields - f, _time | sort Month | eval diff=0 | delta count as diff | eval percentage=round(if(diff>0,diff/count*100,diff/(count-diff)*100),0) ... View more

and if you want to get hold of all your other fields in the data, then you probably need to look at eventstats rather than stats. Stats will aggregate and remove the non aggregated data, whereas eventstats will perform the same aggregations as stats, but will add those aggregations back into the original event data, leaving all the original fields there to play with as you like. ... View more

@johann2017 so you want to count by account name, irrespective of the source/target host, so this should work | eval Login=src_ip."-->".host | stats values(Login) as Logins count as Total by Account_Name | where Total > 9 This is then generating a new field with the source/target pair called 'Login' and then counting all pairs by the account name and filtering less=9. Here's a full example | makeresults | rename COMMENT as "Setting up data to show example" | eval f="Admin1,10.10.16.86,server1#Admin2,10.10.16.87,server2#Admin1,10.10.16.88,server3#Admin2,10.10.16.89,server4#Admin1,10.10.16.90,server5#Admin2,10.10.16.85,server6#Admin1,10.10.16.84,server7#Admin2,10.10.16.83,server8#Admin1,10.10.16.82,server9#Admin2,10.10.16.81,server10#Admin1,10.10.16.80,server11#Admin3,10.10.17.86,server12#Admin1,10.10.18.86,server13#Admin3,10.10.19.86,server14#Admin1,10.10.15.86,server15#Admin3,10.10.14.86,server16" | makemv delim="#" f | mvexpand f | rex field=f "(?<Account_Name>[^,]*),(?<src_ip>[^,]*),(?<host>.*)" | eval d=15 | accum d | eval _time=_time+d | rename COMMENT as "This is what you should do" | eval Login=src_ip.":".host | stats values(Login) as Logins count as Total by Account_Name | where Total > 4 Note here I use (4) to demonstrate, but this will give you a row per user with the values as a multi value field. If you want a row per login then you will have to split back out the values, like | mvexpand Logins | eval tmp=split(Logins, ":") | eval src_ip=mvindex(tmp,0,0) | eval host=mvindex(tmp,1,1) | fields Account_Name, src_ip, host, Total Hope this helps ... View more

Stats will only preserve fields in the stats statement, so if you want to preserve host and Account_Name, then you might want to do | stats values(Account_Name) as Account_Name values(host) as Destination_Host count as Total by src_ip | where Total > 9 | table Account_Name, src_ip, , Destination_HostTotal | rename src_ip AS "Source IP Performing Remote Login Attempts" However that may not be exactly what you are after in that there may be several account names and hosts all coming from the same IP address ... View more

JSON auto extraction will only extract, I believe, the first 5000 bytes. You need to use spath on the elements of the data you need. ... View more

This is the relevant line that does the work eval Type=if(mvfind(Type_call,"web") > 0, mvappend(Type,"webtrc"),Type) The rest is setup. The mvfind is looking for the string 'web' in the Type_call and if found (>0) the it adds the webtrc field to the existing multivalue Type field ... View more

@renjith.nair My point was that using the fields XML statement allows you to control what values are SHOWN in the table, regardless of what fields are in the SPL. You can have any number of fields in the results, but only show a subset of these. All fields in the results are then available to tokens. ... View more

Making elements conditional uses the <xxx depends="$token$"> where xxx can generally be one of the XML elements in your dashboard. You can use this on html panels too, so I have often used buttons in with depends=. Then when a button is pressed, it sets/clears tokens as necessary. See the Splunk dashboard examples app, which has some very simple guidelines on how to do just what you want - and it's quite simple. See the example called "Custom Token Links". ... View more

Yes See this | makeresults | eval a="WIN95", b="WIN 95", c="Win95", d="Win 95", e="WINDOWS 95", f="Windows 95", g="Unknown", h="Random" | fields - _time | transpose | rename "row 1" as os_description | fields os_description | eval OS_Grouped=if(match(os_description, "(?i)win.*95"), "Windows_95", "Unknown") | table os_description, OS_Grouped ... View more