@smudge797 I am getting email notifications that you are replying, but nothing is displaying on the page here. Are you seeing the same thing? ... View more

What is the name of your custom sourcetype? Have you tried setting it for a test to _json and see if it works? ... View more

Yes, but just in the way you tell Splunk how to break events. So right now it is breaking them on the opening of an array [ so we need to tell it not to. As a test, have you tried sending an event using the sourcetype _json to see if that performs as expected? If it does, you might try adding this to your custom sourcetype stanza: BREAK_ONLY_BEFORE = ^{ DATETIME_CONFIG = CURRENT ... View more

Are these being written to a file or being ingested another way? ... View more

If each event is not on a single line, you will need to work on your line breaking configuration so it breaks where you expect. How is this data coming into Splunk? ... View more

Ok, if you want to keep your custom sourcetype name, then you'll need to add a props.conf entry for it. You can add it to $SPLUNK_HOME/etc/system/local/props.conf , but be sure it isn't going to conflict with an existing sourcetype: [your_custom_sourcetype_name] INDEXED_EXTRACTIONS = json KV_MODE = none Restart Splunk after adding it, and you should be good to go. ... View more

If you want Splunk to understand how to work with it, the best option is to mark it with the correct sourcetype. Are you wanting to configure your own sourcetype to automatically extract these fields? Or do you want to do something manually at search time? ... View more

That looks like JSON format. What is your sourcetype set to? Setting it to _json seems like it would do the trick. You can test this with a sample of the data using Settings > Add Data and uploading a sample. You don't have to go through the entire process, but it will show you how the extraction would look when the sourcetype is set to _json. ... View more

Splunk interprets the latest by giving a timestamp to every event that is ingested. By default when you search, Splunk returns the events in descending order (most recent events on top). If you have your search set for earliest=-24h but it is still returning events from April, it sounds like Splunk isn't understanding your timestamp correctly when it is being ingested. When looking at your events, does the _time field/column match the date you see in the event? ... View more

So the difference being the brackets? Slight modification: index=* | regex _raw!="^\[?\d{4}-\d{2}-\d{2}" ... View more

Unless I'm misunderstanding your question, if you just want the latest event you can use the head command: host=servername source=/usr/sync.log TERM(No space left on device) earliest=-24h | head 1 ... View more

You could try making a small addition to the stats command: (index=symantec_sep sourcetype="symantec:ep:scan:file") OR (index=os_windows Workstation_Name="*") | eval host_name = coalesce(dest, Workstation_Name) | stats dc(index) as occurrence, values(index) as indexes by host_name | where occurrence < 2 This should give you the name of the index it was found in. ... View more

That explains it. Looking at the differences in the docs, tt looks like it was added in 6.3.0. I'll have to keep that in mind when suggesting queries. Thanks! ... View more

Odd! Are you running an older version of Splunk? It must not like combining the eval statements. ... View more

This one is a little tricky because you need to search a month of data in order to get the average, but still process daily results as well. Here was my stab at it, searching over the "Last 30 Days": index=os_linux NOT root tag=authentication NOT tag=failure | bucket _time span=1d | stats count(eval(_time=relative_time(now(),"@d"))) as count, count as total by host, user, eventtype, src_ip | search eventtype=*authentication* | eval dest_count=host+":"+src_ip+"("+count+")", average=total/30 | stats values(dest_count) as Daily, values(average) as Average by user, eventtype By bucketing the _time in 1 day increments, we can grab just the count of today's events and the total count. Will this do the trick for you? ... View more

If I understand your question correctly, both of these fields are in the same event, so 'Delta' is not the right option for you here. You should be able to use a simple Eval to create a new field in each event: | eval TimeDifference = DisconnectTime - ConnectTime Then you can add a simple WHERE statement to limit your events to the ones under two seconds: | WHERE TimeDifference < 2 This will require that your ConnectTime and DisconnetTime be in epoch format, but if they are simple date strings your can convert them to epoch using strptime(). ... View more

You bet. Does that accomplish what you were trying to do? ... View more

No problem, I'll explain what I was thinking and see if it matches up with what you wanted to accomplish. First: | bucket _time span=1m This takes all of your events and essentially rounds their timestamps down to the current minute. This allows you to have a common field _time for all of your events that occurred within the same minute Next: | stats dc(internal_ip) as connected_ips by _time, external_ip The stats command allows you to perform operations on your data like count, average, or in this case: Distinct count. Basically I'm telling it to give you a count of the unique internal IP addresses, using as to give it a new field name called connected_ips. Using by we tell the results to grouped by _time (which is now grouped into one minute intervals) and external_ip. The comma separating the two by fields is optional, I just like to use it for readability. Finally: | search connected_ips >= 100 Now we tell Splunk to take the previous data and only show the results that talked to 100+ internal IPs. You should now have a result that lists the _time, external_ip, and the number of internal IPs that they connected to. Does that match with what you were shooting for? ... View more