About bowesmana

bowesmana · ‎02-11-2026

You can use CIDR address ranges to limit the number of IPs, which depending on whether you are filtering IN good addresses or filtering OUT bad addresses may give you more capacity. But probably the best options is to create a CIDR capable lookup (that's just a standard lookup file with a lookup definition with CIDR(ip_address_field_in_lookup) in the advanced settings and use the lookup to check existence.

bowesmana · ‎02-11-2026

bowesmana · ‎02-09-2026

Take a look at the REST API docs for saved searches https://help.splunk.com/en/splunk-cloud-platform/rest-api-reference/10.1.2507/search-endpoints/search-endpoint-descriptions#ariaid-title14 https://<host>:<mPort>/services/saved/searches/{name}/dispatch

bowesmana · ‎02-08-2026

Just to add some clarification, the | where command syntax for using "IN" is | where in(value, "1", "2") so to make it work with where, you'd need to change your prefix to in(value, That said, in this context it is often better to use search if you intend on having wildcard support, because this | where in(value, "*") will NOT match any value, whereas | search value IN ("*") WILL match any value.

bowesmana · ‎02-08-2026

@coreyCLI It looks like there is a div height that forcibly limits the height to 1000 <div data-cid="view88334" version="2" class="shared-reportvisualizer ui-resizable" data-view="views/shared/ReportVisualizer" data-render-time="0" style="width: 100%; height: 1000px; overflow: hidden;"> I had a look through the code and could not find where it forced that limit, but luckily you can override the height using inline CSS in your dashboard. See this example, where the inline CSS sets the height to 1500px (along with the <height> of 1500 and this works. Add the id="xx" to the <viz> element and then limit the CSS to just that id. <dashboard version="1.1" theme="light"> <label>heatmap</label> <row> <panel> <html> <style> #viz_height_1500 .shared-reportvisualizer.ui-resizable { height: 1500px !important; overflow: hidden; } </style> </html> <viz id="viz_height_1500" type="heat-map-viz.heat-map-viz"> <search> <query>| gentimes start=-7 increment=4h | eval "Server Availability"=random()%100, "Customer Satisfaction"=random()%100,"Server Performance"=random()%100, _time=starttime | table _time, "Server Availability","Customer Satisfaction","Server Performance"</query> <earliest>-30m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="heat-map-viz.heat-map-viz.colorCritical">#DC4E41</option> <option name="heat-map-viz.heat-map-viz.colorHigh">#F1813F</option> <option name="heat-map-viz.heat-map-viz.colorLow">#53A051</option> <option name="heat-map-viz.heat-map-viz.colorMedium">#F8BE34</option> <option name="heat-map-viz.heat-map-viz.convertTimeToUTC">false</option> <option name="heat-map-viz.heat-map-viz.enableAnimation">true</option> <option name="heat-map-viz.heat-map-viz.enableShades">true</option> <option name="heat-map-viz.heat-map-viz.hideCellBorders">false</option> <option name="heat-map-viz.heat-map-viz.labelCritical">Critical</option> <option name="heat-map-viz.heat-map-viz.labelFontSize">18</option> <option name="heat-map-viz.heat-map-viz.labelHigh">High</option> <option name="heat-map-viz.heat-map-viz.labelLow">Low</option> <option name="heat-map-viz.heat-map-viz.labelMedium">Medium</option> <option name="heat-map-viz.heat-map-viz.legendPosition">top</option> <option name="heat-map-viz.heat-map-viz.legendText">categories</option> <option name="heat-map-viz.heat-map-viz.reverseNegativeShade">false</option> <option name="heat-map-viz.heat-map-viz.shape">square</option> <option name="heat-map-viz.heat-map-viz.showDateInTooltip">true</option> <option name="heat-map-viz.heat-map-viz.showLegend">true</option> <option name="heat-map-viz.heat-map-viz.showValues">false</option> <option name="heat-map-viz.heat-map-viz.tokenLabel">hm_token_label</option> <option name="heat-map-viz.heat-map-viz.tokenTime">hm_token_time</option> <option name="heat-map-viz.heat-map-viz.tokenValue">hm_token_value</option> <option name="heat-map-viz.heat-map-viz.tooltipDateFormat">auto</option> <option name="heat-map-viz.heat-map-viz.valHigh">75</option> <option name="heat-map-viz.heat-map-viz.valLow">10</option> <option name="heat-map-viz.heat-map-viz.valMedium">40</option> <option name="heat-map-viz.heat-map-viz.xAxisDateFormat">auto</option> <option name="heat-map-viz.heat-map-viz.xAxisRotate">false</option> <option name="heat-map-viz.heat-map-viz.xAxisTickCount">0</option> <option name="heat-map-viz.heat-map-viz.yaxiswidth">auto</option> <option name="heat-map-viz.heat-map-viz.yaxiswidthpx">250</option> <option name="height">1500</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> </row> </dashboard>

bowesmana · ‎02-05-2026

The important point to remember about base searches is that they are limited in volume and sometimes you can make your overall dashboard performance worse. They are not intended as a vast lookup. Given that, yes you can make a somewhat broad search, for example index=abc | stats count by id a b c and then have 4 sub searches that do 1. | stats dc(id) as ids 2. | stats sum(count) as count by a 3. | stats sum(count) as count by b 4. | stats sum(count) as count by c Maybe if you gave a bit more detail and some of the search we could better advise if makes sense.

bowesmana · ‎02-04-2026

I hadn't realised they had switched to a licenced model. The basic idea behind a roll your own technique is to have a lookup file that contains the index and sourcetype and threshold in seconds that you need to see data in - you can create a simple example of all index sourcetype pairs seen in the previous hour and give them a threshold of 10 minutes, e.g. like this | tstats latest(_time) as last_seen count where index=* earliest=-1h@h latest=@h by index sourcetype | sort index sourcetype | table index sourcetype | eval threshold=600 | outputlookup monitor.csv Now you have a control set that you use to look for missing data outside the threshold. Now initialise the results file - makes the SPL easier if all data is present there at the start. | inputlookup monitor.csv | fields - threshold | eval last_seen=now(), missing_data=0 | outputlookup monitor_results.csv Then you can run this as a scheduled alert at the frequency you want - this example you can run every minute. | tstats max(_time) as last_seen count where [ | inputlookup monitor.csv | fields index sourcetype ] earliest=-1m@m latest=@m by index sourcetype ``` We have data so reset missing indicator ``` | eval missing_data = 0 ``` Grab all previous results and combine with what we found ``` | inputlookup monitor_results.csv append=t | fields - threshold | stats first(*) as * by index sourcetype ``` Get the threshold and see if the last seen exceeds the configured threshold ``` | lookup monitor.csv index sourcetype OUTPUT threshold | eval exceeds_threshold = if(now() - last_seen > threshold, 1, 0) ``` Now work out if we need to alert - only alert the first time we exceed the threshold ``` | eval alert=if(exceeds_threshold = 1 AND missing_data = 0, 1, 0) ``` Increment the missing data counter to avoid continual alerts ``` | eval missing_data=if(exceeds_threshold = 1, missing_data + 1, missing_data) ``` Write out these results ``` | outputlookup monitor_results.csv | where alert = 1 The logic for that is Search data in the previous minute for index/sourcetypes you want Add in the results you have collected from previous searches Take the first event by index/sourcetype, i.e. keep all the found results and retain only the previous results where you have no current result. Lookup the threshold configured for this index/sourcetype - in seconds Find out if it was last_seen more than that threshold ago Alert the first time it is exceeded Save all the results back to the results CSV And then retain only those items you want to alert on This will alert the first time an index/sourcetype has not been seen for the given number of threshold seconds. NB: This is a starting point, but gives you the principles of how to manage it. Hope this helps

bowesmana · ‎02-03-2026

The TrackMe app is powerful and would do what you want - requires a bit of investment in time to set it up. https://splunkbase.splunk.com/app/4621 I've rolled my own with a regular saved search that uses tstats to collect index/sourcetype pairs and saves the results to a lookup, calculating the average latency and min/max gaps between events for each. Alerts then run to check current ingestion against those metrics per index/sourcetype. There's an investment in time either way - but TrackMe is a good place to start.

bowesmana · ‎02-02-2026

What sort of data is contained in application and csid sourcetypes that requires an all time search. That implies that it is most likely some sort of incremental data set containing information relating to the application and CsID instances. If that is so, then totally agree with @PickleRick in that you'd be better off building an incremental lookup - if you are only running the micro sourcetype every 11 hours, then you could probably build the lookup from application and csid at the same interval, but slightly earlier so it remains current - that's likely to significantly simplify the search. Note that if you do separate the search you need to make sure that the ending time range of the lookup generation matches the ending time range of the micro search to ensure that you won't get csids in the micro data that was not built into the lookup. Given your values+latest stats commands, what exactly are you trying to achieve here and what is your desired outcome? In addition to not having _time (* does not match _ fields) it may be that you could avoid the whole mvexpand logic entirely.

bowesmana · ‎01-29-2026

NB: This is incorrect where in() syntax | where LanID NOT IN("NAM\\OT00564","NAM\\CHawki5") First parameter to where !in() is fieldname followed by string values.

bowesmana · ‎01-29-2026

As @richgalloway says, "IN" functionality is different between the "search" command and the "where" command. The search is | search username IN ("A","B","C") The where command is | where in(username, "A", "B", "C") and these are both string matches. Note that the search command will interpret \ so you will need to escape \ as \\ but oddly enough, not in the where command. I am not quite sure the purpose of this statement | stats count AS Total_Connections, latest(_time) AS Latest_Timestamp, values(identity) AS Security_Mapping, values(host) AS Connected_Hosts, values(username) as LanID by username because there is no point in doing values(username) as LanID because that will simply contain the same value as username because you are splitting by username. So, you could do this before the stats | where !in(username, "NAM\OT00564", "NAM\CHawki5") OR | search username NOT IN ("NAM\\OT00564", "NAM\\CHawki5") and then you want username to be LanID, so just do | rename username as LanID

bowesmana · ‎01-21-2026

The way to get that final output is to create a composite field of the UserId, first_name, last_name and cost centre and then use xyseries to turn that around having used stats, not chart. ... both data sets feed into this ``` ``` Gets the user info from output.log data ``` | rex "user_name=\"(?<UserId>[^\"]*)\".*first_name=\"(?<first_name>[^\"]*)\".*last_name=\"(?<last_name>[^\"]*)\".*cost_center=\"(?<cost_centre>[^\"]*)\"" ``` Only count the scan.log events ``` | eval is_counted=if(match(source, "scan.log$"), 1, 0) ``` Now use stats to collect all values of these fields ``` | fields UserId first_name last_name cost_center Instance is_counted | stats values(*) as * sum(is_counted) as count by UserId Instance ``` Create the composite key ``` | eval identity=UserId."##".first_name."##".last_name."##".cost_centre ``` Turn the table around like chart ``` | xyseries identity Instance count ``` And now break out that composite field again ``` | rex field=identity "(?<UserId>.*)##(?<first_name>.*)##(?<last_name>.*)##(?<cost_centre>.*)" | fields - identity Hope this helps.

bowesmana · ‎01-21-2026

I have found that there is always some performance improvement in swapping the search around, because it avoids the append subsearch, which creates a separate job and the subsequent joining of the results from the 2 search jobs. Additionally, but not in this case, the subsearches results in the data being on the search head, which if the primary search is more complex, can reduce performance of the primary search.

bowesmana · ‎01-20-2026

Firstly I would recommend swapping the index search and the lookup around - it will be faster. Also you can use a subsearch in the main eventlog search to limit the data to just those you care about, e.g. index=wineventlog EventCode=33205 [ ``` Use a subsearch will limit the data only to the hosts you care about ``` | inputlookup host.csv | rename hostname as host | eval host=lower(host) | fields host ] ``` Now collect what hosts you have data for ``` | eval host=lower(host) | stats max(_time) AS last_ever count by host ``` Now add back in the control hosts you care about ``` | inputlookup append=t host.csv ``` Already have host from above, so simply handle hostname from lookup ``` | eval host=coalesce(host, lower(hostname)) ``` Clear count if empty from lookup ``` | fillnull count ``` Collapse for host and validate count=0 means it only came from the lookup ``` | stats max(count) AS count max(last_ever) AS last_ever by host ``` This just filters out those hosts that have no data ``` | where count=0 ```| eval status=if(isnull(last_ever) OR last_ever < relative_time(now(), "-1h"), "No data in last 1h", "OK")``` ```| where status="No data in last 1h"``` | stats dc(host) AS affected_hosts values(host) AS hosts I'm not sure if you are using this search elsewhere as the status assignment at the end has no purpose. As to why you are not seeing any results when it's scheduled, I would suggest commenting out the code from | where in_lookup=1 and causing the search to run and then see what data that produces. Are there any warnings from the search? Is the user context of the alert one that can see the lookup file hosts.csv?

bowesmana · ‎01-20-2026

😂yes totally right that neither are intuitive - it should be a Catalina thing. I know we had the same issue with a custom Tomcat app that had multiple date formats and we pushed back to get them fixed, which got traction.

bowesmana · ‎01-19-2026

I'm not sure about best practice, but splitting the same stream into multiple sourcetypes just to handle different data format seems non-intuitive. What about using INGEST_EVAL to extract _time with a bunch of eval statements to extract _time, e.g. INGEST_EVAL _time = coalesce(strptime(_raw, "%FT%T"), strptime(_raw, "%d-%b-%Y %H:%M:%S"), strptime(_raw, ...))

bowesmana · ‎01-19-2026

I understood from the OP they were already playing with JellyFisher and that the phonetic matches were just not good enough.

bowesmana · ‎01-18-2026

In theory JellyFisher does phonetic analysis, according to the docs Phonetic encoding algortihms: - American Soundex - Metaphone - NYSIIS (New York State Identification and Intelligence System) - Match Rating Codex but I've not used it - I've used fuzzy matching before, but never phonetic. Do these not give you good results? I note that the JellyFisher app is 2021, so the version of JellyFish library is a little old, but seemingly not so different. If you have python skills you may be able to post fit a Beider-Morse implementation into a custom command that may yield better results.

bowesmana · ‎01-18-2026

Totally agree - I always use max/min with _time - like nails down a blackboard

bowesmana · ‎01-15-2026

There are numerous questions like this, as it's a common need. https://community.splunk.com/t5/Alerting/Splunk-Alert-if-host-on-lookup-stops-sending-data/m-p/666194 https://community.splunk.com/t5/Splunk-Search/Help-with-query-to-notify-when-data-ingestion-is-stopped/m-p/602396 https://community.splunk.com/t5/Getting-Data-In/Notification-when-indexes-stop-receiving-data/m-p/651149 As for your search, it's best to do the | tstats BEFORE handling the lookup as JOIN should never be used - there is always a better way than join. In this case, it's inputlookup+stats, e.g. | tstats latest(_time) as latest_event WHERE index=* by index sourcetype | inputlookup append=t frequency_data.csv | fields index sourcetype frequency | fillnull latest_event | stats max(latest_event) as latest_event values(frequency) as frequency by index sourcetype | eval current_time =now() | eval buffer = if(latest_event="0", "current_time", current_time-latest_event) | eval feed_status= case(latest_event=0, "Feed Stopped", buffer> frequency, "Feed delayed", buffer<frequency, "Feed Healthy") If you are not running your search with a time window > max(frequency) you will not be able to detect those scenarios where data has stopped some time before your time window. So, you generally have to maintain the 'last event' in a more regular search where you store the last event from the index/sourcetype, e.g. in your frequency_data.csv. I've never found metadata a useful command and it's not reliable. You could look at TrackMe - it's pretty good, but needs some setup and management. I have written my own version that runs an hourly search and collects latest time from a monitored set of hosts/index/sourcetypes and stores them so the "missing data" can determine the latest from those longer frequencies.

bowesmana · ‎01-14-2026

If you can get data in Splunk that describes the states of the systems, you can write SPL to determine what is UP and what is down between your reporting tools. However, whatever data you have, if you have one system that says UP and one system that says DOWN, how can you determine which of those is correct if the UP message comes in from system A 10 seconds before the DOWN state from system B and would you generate an alert to say it's down, or do you simply want to alert if both states are DOWN? Anyway, if there is data in Splunk, you can make a decision.

bowesmana · ‎01-13-2026

When you talk about 'systems' is that some field in an index representing that system? It's not clear what you're after, when you say 'if no match, i.e. System A shows DOWN and System B shows UP' - clearly that means there WAS a match. What do you actually want to alert on given the potential states? System A - UP - System B - not found System A - UP - System B - UP System A - UP - System B - DOWN System A - DOWN - System B - not found System A - DOWN - System B - UP System A - DOWN - System B - DOWN and how does System B record it's state for a device. What about if the state of data in System B shows multiple different states for a device, e.g. SYS B:2026-01-13 08:00:00 - Device X DOWN SYS B:2026-01-13 08:01:30 - Device X UP SYS A:2026-01-13 08:00:30 - Device X DOWN and your search runs at 08:02 - what should occur? You can't trigger a search "when the message comes", searches run on a schedule, i.e. at predefined times, so presumably you will need to take time into account, so in the above example when the search runs, A shows DOWN, but B shows a LATER time of UP.

bowesmana · ‎01-12-2026

@wodrog note that @livehybrid solution of using hidden searches is also a good alternative to putting it in a subsearch - both techniques work and, as you can see, use the same principle of | addinfo to get the master time picker search range as an epoch time.

bowesmana · ‎01-11-2026

You can't really use a time picker token like that because it is unlikely to be an epoch, so the trick is to use | addinfo and you will get some info_* fields that will represent the time picker used to control that search, e.g. info_min_time and info_max_time. Then you can use those in the relative_time statement. You could also just do the math and say in your subsearch [ | makeresults | addinfo | eval go_back_days=if(strftime(info_min_time, "%a")="Mon", 3, 1) | eval earliest=info_min_time - (go_back_days * 86400), latest=info_max_time - (go_back_days * 86400) | fields earliest latest ] Note use fields, when you want fields and table if you need to render something, which in this case, you don't.

bowesmana · ‎01-11-2026

I'm not aware that it can be done in DS with a button in the way that XML can do it, but is it possible using a single value display with drilldown that sets a token that the second search that does the CSV updates can use. However, in the XML way, normally you'd manage it is to nullify the token after the update, so it can ru-run, but I'm not sure how to do that in DS.

Posts	3485
Solutions	752
Karma Given	298
Karma Received	1355
Member Since	‎09-05-2011

Online Status	Offline
Date Last Visited	Thursday

Windows TA not extracting key_path as registry_pat...

Why does FIELDALIAS work or doesn't depending on t...

How can I write this regex for rex to extract mult...

How to rename fields in a table without changing c...

Why doesn't drilldown eval token statement work un...

Performance fields/stats/table

Infoblox TA not extracting response code

Is there any way to create CSS that can be dynamic...

How to break up groups of <input> elements onto th...

tokenlinks.js in Splunk 8.24 broken- working dashb...

Re: How do I filter a large number of ip_client ad...

Re: How do I get a list of all my lookups with the...

Re: REST API

Re: where IN ("*") from the token definition

Re: Heap Map Viz panel Sizing

Re: Base Searches

Re: Log Ingestion Failure by Sourcetype

Re: Log Ingestion Failure by Sourcetype

Re: How write qery instead of using Join?

Re: How to search for values not in a listing

Re: How to search for values not in a listing

Re: JOIN two log files from the same source path

Re: Splunk alert returning zero events but my manu...

Re: Splunk alert returning zero events but my manu...

Re: What's the best way to handle multiple differe...

Re: What's the best way to handle multiple differe...

Re: Function to flag phonetically similar words li...

Re: Function to flag phonetically similar words li...

Re: SPL Query Logic - Events stopped Receiving to ...

Re: SPL Query Logic - Events stopped Receiving to ...

Re: Need suggestions or advice to check status of ...

Re: Need suggestions or advice to check status of ...

Re: Dynamic search using global_time token for pre...

Re: Dynamic search using global_time token for pre...

Re: Creating an Interactive Button to run SPL in D...

Join the Conversation