From that user session try to run the saved search query by passing the account name and see whether its returning data. It may not be permission related, it may be query related. ... View more

what about sorting by index time? This is how you get index time even though your _time is same but indextime will not be same. | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") | sort - indextime ... View more

yes its possible, to ship an index with a app you need to include indexes.conf file with below sample structure, [demo_index] coldPath = $SPLUNK_DB\demo_index\colddb enableDataIntegrityControl = 0 enableTsidxReduction = 0 homePath = $SPLUNK_DB\demo_index\db maxTotalDataSizeMB = 512000 thawedPath = $SPLUNK_DB\demo_index\thaweddb Sid ... View more

your saved search should be like below(same as yours no change) index=main EventCode=4740 Account_Name=$field1$ | eval Account_Name2=mvindex(Account_Name,1), mytime=_time | convert timeformat="%m-%d-%Y %I:%M:%S %p" ctime(mytime) | dedup _time | table Account_Name2, Caller_Computer_Name, mytime | rename Account_Name2 AS "Account Locked Out", Caller_Computer_Name AS "Lockout Location", mytime AS "Date/Time" | sort _time when you call the saved search in dashboard it should be like below, as field1 is the parameter name of teh saved search <search> <query>| savedsearch "DSN Test Report" field1="$form.field1$"</query> <earliest>$field2.earliest$</earliest> <latest>$field2.latest$</latest> </search> ... View more

I think the donut chart you downloaded not compatible with splunk 7. Please have a look at the splunk version there. However I tried in my system and it works. Can you also try the below donut and see. https://splunkbase.splunk.com/app/3150/ Code with your donut chart which is working for me is below. Please see whether you are calling in same way. <dashboard> <label>demo</label> <row> <panel> <viz type="viz_donut_c3.c3donut"> <search> <query>index="_internal" | stats count by source</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </viz> </panel> </row> <row> <panel> <table> <search> <query>index="_internal" | stats count by source</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard> ... View more

May be you can create a custom command which will do the indexing using "data/inputs/oneshot " endpoint. When user make the job force-completed from UI you can call the custom command. Please refer the below link for end point details. https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTinput Sid ... View more

Yes it will work. ... View more

My answer is still going to be the same. Basically the idea is to you need to extract the date from _raw using rex command then convert it to epoch and then sort on the epoch. ... View more

Hi, Here is the run anywhere code, <form> <label>demo</label> <fieldset submitButton="false"> <input type="dropdown" token="field1"> <label>field1</label> <fieldForLabel>date</fieldForLabel> <fieldForValue>date</fieldForValue> <search> <query>| makeresults count=3 | streamstats count as id | eval date = case(id=1,"01-10-2019 00:00:00",id=2,"01-11-2019 00:00:00",id=3,"01-12-2019 00:00:00") | eval date_epoch = strptime(date,"%m-%d-%Y %H:%M:%S") | table date,date_epoch | sort - date_epoch</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset> </form> ... View more

Cool...Have a nice day ☺️ ... View more

ohh yes I forgot to remove the >=0 here is the correct code, (base search) server_name=dfw* earliest=-1h@h | search EventCode="60001" OR EventCode="60002" | transaction server_name| eval EventCode = mvdedup(EventCode) | eval back_to_normal = if(mvfind(EventCode,"60001") > mvfind(EventCode,"60002") ,"true","false") | where back_to_normal = "true" ... View more

can you try something like this below, (base search) server_name=dfw* earliest=-1h@h | search EventCode="60001" OR EventCode="60002" | transaction server_name| eval EventCode = mvdedup(EventCode) | eval back_to_normal = if(mvfind(EventCode,"60001") > mvfind(EventCode,"60002") >=0,"true","false") | where back_to_normal = "true" Sid ... View more

Just add NOT before match function ☺️ ... View more

Even better rex as MAC address going to be hex numbers. ... View more

Cool.yep agree with your rex. Have a nice day. Sid ... View more

there is no "username" field. It needs to be | timechart count(user) span=15m ... View more

Hi, Assuming you are indexing data using log_time field ( means _time and log_time are same) please try the below search, | timechart span=15m count(user) ... View more

Can you try the below setup and see whether it works? The idea is to wrap your script within another python script so that when your script will run it will run using system python not splunk python. I have just given example of two different environments. You can modify the code related to platforms accordingly. import os import subprocess import sys import logging wrapped_script="<your actual script name>" _SPLUNK_HOME=os.environ['SPLUNK_HOME'] _SPLUNK_PYTHON_PATH = os.environ['PYTHONPATH'] os.environ['LD_LIBRARY_PATH']='' #hack to stop splunk libries loading instead of system if sys.platform == "win32": logfilename = 'searchcommand2_app.log' _APP_BIN_HOME=_SPLUNK_HOME + "<your actual script path>" _NEW_PYTHON_PATH = "<your python 3.x path>" os.environ['PYTHONPATH'] = _NEW_PYTHON_PATH my_process = _APP_BIN_HOME + "\\" + wrapped_script elif sys.platform == "darwin" or sys.platform == "linux" or sys.platform == "linux2": logfilename = 'searchcommand2_app.log' _APP_BIN_HOME = _SPLUNK_HOME + "<your actual script path>" _NEW_PYTHON_PATH = "<your python 3.x path>" os.environ['PYTHONPATH'] = _NEW_PYTHON_PATH my_process = _APP_BIN_HOME + "/" + wrapped_script logging.basicConfig(filename=logfilename, level=logging.DEBUG, format='%(asctime)s - %(name)s - %(levelname)s - %(message)s') mylogger = logging.getLogger("ourlogger") mylogger.debug("wrapper: sys.argv=%s" % sys.argv) argstr='' for thing in sys.argv: argstr=argstr + " " + thing p = subprocess.Popen([os.environ['PYTHONPATH'], my_process, _SPLUNK_PYTHON_PATH ] + sys.argv[1:] , stdin=sys.stdin, stdout=sys.stdout, stderr=sys.stderr) ... View more

Welcome. Please accept is as answer when you get time. Have a nice day. ... View more

Hi Richard, Can you use the below search and see whether its working for you. Just change the query portion. Assuming your mac address textbox token name is "macaddress" | makeresults | eval mac_address = $macaddress$ | rex max_match=0 field=mac_address "(?<octates>\d\d)[:|-]?" | eval octet1 = mvindex(octates,0),octet2 = mvindex(octates,1),octet3 = mvindex(octates,2),octet4 = mvindex(octates,3),octet5 = mvindex(octates,4),octet6 = mvindex(octates,5) | table octet1 octet2 octet3 octet4 octet5 octet6 Sid ... View more

Hi, Can you try the below code, | eval source = replace(source,"\\\\","\\\\\\\\") Sid ... View more

no worries. Have a great day 🙂 ... View more