Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

If you are about to write the dashboard yourself, I would suggest you to take a look at the one of the DataModels in ES ann do it for your own use case. ... View more

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

Hey Have a look at my example (generic, so test it in your env) index=_internal | where NOT ( [| makeresults | eval sourcetype="splunkd" | append [| makeresults | eval sourcetype="eventgen" ] | return 100 sourcetype ]) Using the return you can get the this you want. In your case should be like | datamodel Authentication Authentication search | table Authentication.usr,Authentication.signature_id,Authentication.src,Authentication.dest | where NOT [| inputlookup domain_controllers | fields fqdn | rename fqdn as Authenticatin.src | return 10000 Authenticatin.src ] OR [| inputlookup domain_controllers | fields host | rename host as Authenticatin.src | return 10000 Authenticatin.src] OR [| inputlookup domain_controllers | fields ip | rename ip as Authenticatin.src | return 10000 Authenticatin.src] ... View more

Hopefully not a stupid question at this time but... did you have the | in the ldapsearch? index=winevents | dedup host | stats count as Total | appendcols [ | ldapsearch search="(objectClass=computer)" attrs="cn,operatingSystem,operatingSystemVersion" | lookup dnslookup clienthost AS cn | search (opeartingSystem="Win*") | stats count as WindowsComputers ] | eval Percentage=Total/WindowsComputers ... View more

This returns result? | ldapsearch search="(objectClass=computer)" attrs="cn,operatingSystem,operatingSystemVersion" | lookup dnslookup clienthost AS cn | search (opeartingSystem="Win*") | stats count as WindowsComputers ... View more

Right so have the return to include an arbitrary number of IPs, like shown below index=windows [ | inputlookup Windows_list.csv | return 100000 IP] | stats count(hosts) by sourcetype ... View more

Yes there is the endpoint curl -k -u admin:pass https://localhost:8089/services/deployment/server/serverclasses -d name=sc_apps_ombra https://docs.splunk.com/Documentation/Splunk/7.0.2/RESTREF/RESTdeploy#deployment.2Fserver.2Fclients ... View more

Cool so as I told you, the last append has no knowledge of what the remaining things, mainly because the subsearches are run before the main search! I believe what you need is this index=winevents | dedup host | stats count as Total | appendcols [ldapsearch search="(objectClass=computer)" attrs="cn,operatingSystem,operatingSystemVersion" | lookup dnslookup clienthost AS cn | search (opeartingSystem="Win*") | stats count as WindowsComputers ] | eval Percentage=Total/WindowsComputers ... View more

Can you try this by parts? Is this returning events? index=winevents | dedup host | stats count as Total Is this returning events? index=winevents | dedup host | stats count as Total Is this returning events? ldapsearch search="(objectClass=computer)" attrs="cn,operatingSystem,operatingSystemVersion" | lookup dnslookup clienthost AS cn | search (opeartingSystem="Win*") And finally, have you changed to | append [ makeresults | eval var = Total/WindowsComputers) ] ?? Notice that | append [makeresults [eval var = Total/WindowsComputers)]] will never return results because it is a separate search that has no knowledge of the variables Total or WindowsComputers ... View more

This | inputlookup Windows_list.csv | return IP returns an ORed list of the IPs and is passing them to your index. What is exactly is not working? Does this index=windows [ | inputlookup Windows_list.csv | return IP] is not getting the events you want for the later stats? Can you specify what is not working? ... View more

Are you specifiying one data model? Like | from datamodel:"Network_Traffic"."All_Traffic" ... View more

Can you show us one sample line of your table and tell us exactly what you want to extract please? ... View more

Ok so I believe you can do a SEDCMD to replace what you don't need by nothing https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Anonymizedata#Define_the_sed_script_in_props.conf ... View more

Can you retrieve the search query for one of the non functioning dashboards and paste it here please? ... View more

Hey What about: index=windows [ | inputlookup Windows_list.csv | return IP] | stats count(hosts) by sourcetype ... View more

The data in the ES dashboards is retrieved from the DataModels residing in your indexers. The first thing to test is if you can search anything from ma data model, like *| from datamodel:. *. Let me know if you have results for any of the datamodels you are using ... View more

Hey Follow this guide to discard events and keep others: http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest ... View more

In which cases do you want to have duplicated values of host? I don't know which search are doing there but if you are doing a stats latest(host) by _time, a stats values(host) by _time gives as many values as existing in the field ( instead of having one per host). But I think more clarifications would be frutiful here. ... View more

Are you just searching for tag=value? If so, you are pointing at the default indexes and this may not be what you intend. Specify the indexes you want to search. Let me know if works for you ... View more