About bowesmana

bowesmana · ‎04-08-2026

I recall some info on the Splunk Slack channels referring to the max number supported as 2^53 - 1 - This is IEEE 754 floating point https://en.wikipedia.org/wiki/IEEE_754 and there is a comment here in item 10 https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/9.0/search-commands/eval#10.-rounding-with-values-outside-of-the-range-of-supported-values-0 So, it's very likely your issue. Why is it you need such precision on such large numbers and are the numbers to the right of the DP significant in the context of the payload value itself? I think your solution needs to be a modification of the value in whatever form is practical. The Slack conversation is here https://splunkcommunity.slack.com/archives/CD8B6F65Q/p1660068986075899 and there are some possibly explanations there.

bowesmana · ‎04-08-2026

I suspect it's because the number itself has 15+6 digits and the limit applies to the entire string, not just the right hand side. You can see the effect of the number of digits here in this search | makeresults | eval _raw="{\"id\": \"ABC\", \"name\": \"lukas\", \"timestamp\": 1775567475, \"payload\": 372998479107735.188677, \"status\": \"ok\"}" | spath | eval len=len(payload) | foreach 22 21 20 19 18 17 16 15 14 [ eval payload_<<FIELD>>=substr(payload, len - <<FIELD>> + 1) ] | fields payload_* | transpose 0 column_name=length | where match(length, "payload") | rename "row 1" as payload | foreach 1 10 100 1000 10000 [ eval mul_<<FIELD>>=round(payload * <<FIELD>>, 6) ] This creates a number of substrings of your original and then multiplies them by 1, 10, 100, 1000. You can clearly see that multiply by 1 works when the total string length is 16 or below, but above, you start to see loss of precision

bowesmana · ‎04-06-2026

If you are not getting any results, is that data JSON and are the fields being auto extracted? If you look at your posts you will see you have described the field as cs_uri_stem (with underscores) in one post and then shown cs-uri-stem (with hyphens) in another post. These are different fields, so you must use the correct name for your field.

bowesmana · ‎02-22-2026

I checked the documentation on timestamp handling here https://help.splunk.com/en/splunk-cloud-platform/search/search-reference/9.3.2411/time-format-variables-and-modifiers/time-modifiers and it's wrong in how it describes it. I've submitted feedback, as it implies <=latest. If you are happy with an of the responses, please mark on as a solution.

bowesmana · ‎02-18-2026

@verbal_666 Splunks logic for interpreting earliest and latest is that the range of data returned is >= earliest AND < latest so the behaviour is correct in that it will find all data UP TO, BUT NOT INCLUDING the latest time, so your latest should always be greater than the last event you want to find. As @PickleRick points out, if you use the snap to format you will see that latest time is always 00:00:00 of the next day of the day you are trying to search.

bowesmana · ‎02-18-2026

@corti77 One caveat with using mvfind, which as you rightly point out, uses regex, is that if your search term contains other regex characters, then that can cause false positives and negatives, so I prefer to use EQUALS on the multi value to check for equality. See this example which shows a conflict in equals matching and mvfind | makeresults | eval selCPE = trim(replace("cpe:/a:7-zip:7-zip,xnet_core,anaconda3", "\"", "")) | eval selCPE_mv = if(len(selCPE)=0, null(), split(selCPE, ",")) | eval cpe=".net_core" | eval equals_match=if(cpe=selCPE_mv, "EQUALS_MATCH", "EQUALS_NO_MATCH") | eval cpe="^.net_core$" | eval mvfind_match = if(isnull(mvfind(selCPE_mv, cpe)), "MVFIND_NO_MATCH", "MVFIND_MATCH") i.e. mvfind will get an incorrect match because the search term contains . (dot) Using = on a single to mv equals will perform equality checking on all of the values, but not using regex

bowesmana · ‎02-18-2026

If you have shell access, then that's the simplest option, however, if you have lookup editor installed, then that will also catch any lookups in the lookup file backups folder. You will also not catch any private lookups in the users' folders.

bowesmana · ‎02-12-2026

As PickleRick says, you can't do regex in lookup directly, but I've used his technique through a programatically managed/ordered lookup, where I have ordered the results based on wildcards, so that first hit is counted only. If your rule is sufficiently tight that the wildcards is matching domain segments rather parts of the segment, then you could do post matching on the part counts | makeresults | eval fqdn1="abc.website.com" | eval result="*.website.com" ``` lookup returns ``` | eval fqdn1_count=mvcount(split(fqdn1, ".")), result_count=mvcount(split(result, ".")) | eval match1=if(fqdn1_count=result_count, "HIT", "MISS") | eval fqdn2="def.abc.website.com" | eval result="*.website.com" ``` lookup returns ``` | eval fqdn2_count=mvcount(split(fqdn2, ".")), result_count=mvcount(split(result, ".")) | eval match2=if(fqdn2_count=result_count, "HIT", "MISS") You'd have to do a bit more work to manage multiple results, e.g. if you have *.*.website.com in your lookup, a lookup for def.abc.website.com would get 2 hits.

bowesmana · ‎02-11-2026

You can use CIDR address ranges to limit the number of IPs, which depending on whether you are filtering IN good addresses or filtering OUT bad addresses may give you more capacity. But probably the best options is to create a CIDR capable lookup (that's just a standard lookup file with a lookup definition with CIDR(ip_address_field_in_lookup) in the advanced settings and use the lookup to check existence.

bowesmana · ‎02-11-2026

bowesmana · ‎02-09-2026

Take a look at the REST API docs for saved searches https://help.splunk.com/en/splunk-cloud-platform/rest-api-reference/10.1.2507/search-endpoints/search-endpoint-descriptions#ariaid-title14 https://<host>:<mPort>/services/saved/searches/{name}/dispatch

bowesmana · ‎02-08-2026

Just to add some clarification, the | where command syntax for using "IN" is | where in(value, "1", "2") so to make it work with where, you'd need to change your prefix to in(value, That said, in this context it is often better to use search if you intend on having wildcard support, because this | where in(value, "*") will NOT match any value, whereas | search value IN ("*") WILL match any value.

bowesmana · ‎02-08-2026

@coreyCLI It looks like there is a div height that forcibly limits the height to 1000 <div data-cid="view88334" version="2" class="shared-reportvisualizer ui-resizable" data-view="views/shared/ReportVisualizer" data-render-time="0" style="width: 100%; height: 1000px; overflow: hidden;"> I had a look through the code and could not find where it forced that limit, but luckily you can override the height using inline CSS in your dashboard. See this example, where the inline CSS sets the height to 1500px (along with the <height> of 1500 and this works. Add the id="xx" to the <viz> element and then limit the CSS to just that id. <dashboard version="1.1" theme="light"> <label>heatmap</label> <row> <panel> <html> <style> #viz_height_1500 .shared-reportvisualizer.ui-resizable { height: 1500px !important; overflow: hidden; } </style> </html> <viz id="viz_height_1500" type="heat-map-viz.heat-map-viz"> <search> <query>| gentimes start=-7 increment=4h | eval "Server Availability"=random()%100, "Customer Satisfaction"=random()%100,"Server Performance"=random()%100, _time=starttime | table _time, "Server Availability","Customer Satisfaction","Server Performance"</query> <earliest>-30m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="heat-map-viz.heat-map-viz.colorCritical">#DC4E41</option> <option name="heat-map-viz.heat-map-viz.colorHigh">#F1813F</option> <option name="heat-map-viz.heat-map-viz.colorLow">#53A051</option> <option name="heat-map-viz.heat-map-viz.colorMedium">#F8BE34</option> <option name="heat-map-viz.heat-map-viz.convertTimeToUTC">false</option> <option name="heat-map-viz.heat-map-viz.enableAnimation">true</option> <option name="heat-map-viz.heat-map-viz.enableShades">true</option> <option name="heat-map-viz.heat-map-viz.hideCellBorders">false</option> <option name="heat-map-viz.heat-map-viz.labelCritical">Critical</option> <option name="heat-map-viz.heat-map-viz.labelFontSize">18</option> <option name="heat-map-viz.heat-map-viz.labelHigh">High</option> <option name="heat-map-viz.heat-map-viz.labelLow">Low</option> <option name="heat-map-viz.heat-map-viz.labelMedium">Medium</option> <option name="heat-map-viz.heat-map-viz.legendPosition">top</option> <option name="heat-map-viz.heat-map-viz.legendText">categories</option> <option name="heat-map-viz.heat-map-viz.reverseNegativeShade">false</option> <option name="heat-map-viz.heat-map-viz.shape">square</option> <option name="heat-map-viz.heat-map-viz.showDateInTooltip">true</option> <option name="heat-map-viz.heat-map-viz.showLegend">true</option> <option name="heat-map-viz.heat-map-viz.showValues">false</option> <option name="heat-map-viz.heat-map-viz.tokenLabel">hm_token_label</option> <option name="heat-map-viz.heat-map-viz.tokenTime">hm_token_time</option> <option name="heat-map-viz.heat-map-viz.tokenValue">hm_token_value</option> <option name="heat-map-viz.heat-map-viz.tooltipDateFormat">auto</option> <option name="heat-map-viz.heat-map-viz.valHigh">75</option> <option name="heat-map-viz.heat-map-viz.valLow">10</option> <option name="heat-map-viz.heat-map-viz.valMedium">40</option> <option name="heat-map-viz.heat-map-viz.xAxisDateFormat">auto</option> <option name="heat-map-viz.heat-map-viz.xAxisRotate">false</option> <option name="heat-map-viz.heat-map-viz.xAxisTickCount">0</option> <option name="heat-map-viz.heat-map-viz.yaxiswidth">auto</option> <option name="heat-map-viz.heat-map-viz.yaxiswidthpx">250</option> <option name="height">1500</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> </row> </dashboard>

bowesmana · ‎02-05-2026

The important point to remember about base searches is that they are limited in volume and sometimes you can make your overall dashboard performance worse. They are not intended as a vast lookup. Given that, yes you can make a somewhat broad search, for example index=abc | stats count by id a b c and then have 4 sub searches that do 1. | stats dc(id) as ids 2. | stats sum(count) as count by a 3. | stats sum(count) as count by b 4. | stats sum(count) as count by c Maybe if you gave a bit more detail and some of the search we could better advise if makes sense.

bowesmana · ‎02-04-2026

I hadn't realised they had switched to a licenced model. The basic idea behind a roll your own technique is to have a lookup file that contains the index and sourcetype and threshold in seconds that you need to see data in - you can create a simple example of all index sourcetype pairs seen in the previous hour and give them a threshold of 10 minutes, e.g. like this | tstats latest(_time) as last_seen count where index=* earliest=-1h@h latest=@h by index sourcetype | sort index sourcetype | table index sourcetype | eval threshold=600 | outputlookup monitor.csv Now you have a control set that you use to look for missing data outside the threshold. Now initialise the results file - makes the SPL easier if all data is present there at the start. | inputlookup monitor.csv | fields - threshold | eval last_seen=now(), missing_data=0 | outputlookup monitor_results.csv Then you can run this as a scheduled alert at the frequency you want - this example you can run every minute. | tstats max(_time) as last_seen count where [ | inputlookup monitor.csv | fields index sourcetype ] earliest=-1m@m latest=@m by index sourcetype ``` We have data so reset missing indicator ``` | eval missing_data = 0 ``` Grab all previous results and combine with what we found ``` | inputlookup monitor_results.csv append=t | fields - threshold | stats first(*) as * by index sourcetype ``` Get the threshold and see if the last seen exceeds the configured threshold ``` | lookup monitor.csv index sourcetype OUTPUT threshold | eval exceeds_threshold = if(now() - last_seen > threshold, 1, 0) ``` Now work out if we need to alert - only alert the first time we exceed the threshold ``` | eval alert=if(exceeds_threshold = 1 AND missing_data = 0, 1, 0) ``` Increment the missing data counter to avoid continual alerts ``` | eval missing_data=if(exceeds_threshold = 1, missing_data + 1, missing_data) ``` Write out these results ``` | outputlookup monitor_results.csv | where alert = 1 The logic for that is Search data in the previous minute for index/sourcetypes you want Add in the results you have collected from previous searches Take the first event by index/sourcetype, i.e. keep all the found results and retain only the previous results where you have no current result. Lookup the threshold configured for this index/sourcetype - in seconds Find out if it was last_seen more than that threshold ago Alert the first time it is exceeded Save all the results back to the results CSV And then retain only those items you want to alert on This will alert the first time an index/sourcetype has not been seen for the given number of threshold seconds. NB: This is a starting point, but gives you the principles of how to manage it. Hope this helps

bowesmana · ‎02-03-2026

The TrackMe app is powerful and would do what you want - requires a bit of investment in time to set it up. https://splunkbase.splunk.com/app/4621 I've rolled my own with a regular saved search that uses tstats to collect index/sourcetype pairs and saves the results to a lookup, calculating the average latency and min/max gaps between events for each. Alerts then run to check current ingestion against those metrics per index/sourcetype. There's an investment in time either way - but TrackMe is a good place to start.

bowesmana · ‎02-02-2026

What sort of data is contained in application and csid sourcetypes that requires an all time search. That implies that it is most likely some sort of incremental data set containing information relating to the application and CsID instances. If that is so, then totally agree with @PickleRick in that you'd be better off building an incremental lookup - if you are only running the micro sourcetype every 11 hours, then you could probably build the lookup from application and csid at the same interval, but slightly earlier so it remains current - that's likely to significantly simplify the search. Note that if you do separate the search you need to make sure that the ending time range of the lookup generation matches the ending time range of the micro search to ensure that you won't get csids in the micro data that was not built into the lookup. Given your values+latest stats commands, what exactly are you trying to achieve here and what is your desired outcome? In addition to not having _time (* does not match _ fields) it may be that you could avoid the whole mvexpand logic entirely.

bowesmana · ‎01-29-2026

NB: This is incorrect where in() syntax | where LanID NOT IN("NAM\\OT00564","NAM\\CHawki5") First parameter to where !in() is fieldname followed by string values.

bowesmana · ‎01-29-2026

As @richgalloway says, "IN" functionality is different between the "search" command and the "where" command. The search is | search username IN ("A","B","C") The where command is | where in(username, "A", "B", "C") and these are both string matches. Note that the search command will interpret \ so you will need to escape \ as \\ but oddly enough, not in the where command. I am not quite sure the purpose of this statement | stats count AS Total_Connections, latest(_time) AS Latest_Timestamp, values(identity) AS Security_Mapping, values(host) AS Connected_Hosts, values(username) as LanID by username because there is no point in doing values(username) as LanID because that will simply contain the same value as username because you are splitting by username. So, you could do this before the stats | where !in(username, "NAM\OT00564", "NAM\CHawki5") OR | search username NOT IN ("NAM\\OT00564", "NAM\\CHawki5") and then you want username to be LanID, so just do | rename username as LanID

bowesmana · ‎01-21-2026

The way to get that final output is to create a composite field of the UserId, first_name, last_name and cost centre and then use xyseries to turn that around having used stats, not chart. ... both data sets feed into this ``` ``` Gets the user info from output.log data ``` | rex "user_name=\"(?<UserId>[^\"]*)\".*first_name=\"(?<first_name>[^\"]*)\".*last_name=\"(?<last_name>[^\"]*)\".*cost_center=\"(?<cost_centre>[^\"]*)\"" ``` Only count the scan.log events ``` | eval is_counted=if(match(source, "scan.log$"), 1, 0) ``` Now use stats to collect all values of these fields ``` | fields UserId first_name last_name cost_center Instance is_counted | stats values(*) as * sum(is_counted) as count by UserId Instance ``` Create the composite key ``` | eval identity=UserId."##".first_name."##".last_name."##".cost_centre ``` Turn the table around like chart ``` | xyseries identity Instance count ``` And now break out that composite field again ``` | rex field=identity "(?<UserId>.*)##(?<first_name>.*)##(?<last_name>.*)##(?<cost_centre>.*)" | fields - identity Hope this helps.

bowesmana · ‎01-21-2026

I have found that there is always some performance improvement in swapping the search around, because it avoids the append subsearch, which creates a separate job and the subsequent joining of the results from the 2 search jobs. Additionally, but not in this case, the subsearches results in the data being on the search head, which if the primary search is more complex, can reduce performance of the primary search.

bowesmana · ‎01-20-2026

Firstly I would recommend swapping the index search and the lookup around - it will be faster. Also you can use a subsearch in the main eventlog search to limit the data to just those you care about, e.g. index=wineventlog EventCode=33205 [ ``` Use a subsearch will limit the data only to the hosts you care about ``` | inputlookup host.csv | rename hostname as host | eval host=lower(host) | fields host ] ``` Now collect what hosts you have data for ``` | eval host=lower(host) | stats max(_time) AS last_ever count by host ``` Now add back in the control hosts you care about ``` | inputlookup append=t host.csv ``` Already have host from above, so simply handle hostname from lookup ``` | eval host=coalesce(host, lower(hostname)) ``` Clear count if empty from lookup ``` | fillnull count ``` Collapse for host and validate count=0 means it only came from the lookup ``` | stats max(count) AS count max(last_ever) AS last_ever by host ``` This just filters out those hosts that have no data ``` | where count=0 ```| eval status=if(isnull(last_ever) OR last_ever < relative_time(now(), "-1h"), "No data in last 1h", "OK")``` ```| where status="No data in last 1h"``` | stats dc(host) AS affected_hosts values(host) AS hosts I'm not sure if you are using this search elsewhere as the status assignment at the end has no purpose. As to why you are not seeing any results when it's scheduled, I would suggest commenting out the code from | where in_lookup=1 and causing the search to run and then see what data that produces. Are there any warnings from the search? Is the user context of the alert one that can see the lookup file hosts.csv?

bowesmana · ‎01-20-2026

😂yes totally right that neither are intuitive - it should be a Catalina thing. I know we had the same issue with a custom Tomcat app that had multiple date formats and we pushed back to get them fixed, which got traction.

bowesmana · ‎01-19-2026

I'm not sure about best practice, but splitting the same stream into multiple sourcetypes just to handle different data format seems non-intuitive. What about using INGEST_EVAL to extract _time with a bunch of eval statements to extract _time, e.g. INGEST_EVAL _time = coalesce(strptime(_raw, "%FT%T"), strptime(_raw, "%d-%b-%Y %H:%M:%S"), strptime(_raw, ...))

bowesmana · ‎01-19-2026

I understood from the OP they were already playing with JellyFisher and that the phonetic matches were just not good enough.

Posts	3493
Solutions	752
Karma Given	301
Karma Received	1361
Member Since	‎09-05-2011

Online Status	Offline
Date Last Visited	a week ago

Windows TA not extracting key_path as registry_pat...

Why does FIELDALIAS work or doesn't depending on t...

How can I write this regex for rex to extract mult...

How to rename fields in a table without changing c...

Why doesn't drilldown eval token statement work un...

Performance fields/stats/table

Infoblox TA not extracting response code

Is there any way to create CSS that can be dynamic...

How to break up groups of <input> elements onto th...

tokenlinks.js in Splunk 8.24 broken- working dashb...

Re: Numerical Precision in Metrics

Re: Numerical Precision in Metrics

Re: How to get percent of http 200 codes per file

Re: Earliest... Latest at 23:59:59 skipped!

Re: Earliest... Latest at 23:59:59 skipped!

Re: how to search a exact match inside a multivalu...

Re: How do I get a list of all my lookups with the...

Re: Regex match in a Splunk lookup

Re: How do I filter a large number of ip_client ad...

Re: How do I get a list of all my lookups with the...

Re: REST API

Re: where IN ("*") from the token definition

Re: Heap Map Viz panel Sizing

Re: Base Searches

Re: Log Ingestion Failure by Sourcetype

Re: Log Ingestion Failure by Sourcetype

Re: How write qery instead of using Join?

Re: How to search for values not in a listing

Re: How to search for values not in a listing

Re: JOIN two log files from the same source path

Re: Splunk alert returning zero events but my manu...

Re: Splunk alert returning zero events but my manu...

Re: What's the best way to handle multiple differe...

Re: What's the best way to handle multiple differe...

Re: Function to flag phonetically similar words li...

Join the Conversation