Great to know that we found out the solution !!! as you are new member to this forum, you can accept this as an answer (and you can upvote as well 😉 ) ... View more

try this - sourcetype=uniqueidd | rex field=_raw "version=(?<version_number>[^,]+)" | eventstats max(version_number) as current_version min(version_number) as older_version by id | where like(current_version,"%1.10%") OR like(current_version,"%1.11%") OR like(current_version,"%1.12%") AND current_version=older_version | table current_version older_version _raw ... View more

I need to column of source,Host,lasttime and duration. // Finding source and host together may not be a good method I think. For example, if a host has not sent an event means, all sources/sourcetype s from that host also has not an event. A source/sourcetype which is sending events properly from one host may not be sending any events from another host. So finding source/sourcetype may not be useful I think. Or, do you have other reasons for looking source/sourcetype? ... View more

You can run the following search to detect forwarders that have been up in the last 24 hours but not in the last 2 minutes. It uses the forwarder heartbeat, which is a feature of Splunk versions 3.2 and later. index=_internal sourcetype="fwd-hb" starthoursago=24 | dedup host | eval age = strftime("%s","now") - _time | search age > 120 age < 86000 You can set this search up as an alert every several minutes so that Splunk will let you know if any of your active forwarders have not responded in the last 2 minutes. If you're running a version of Splunk that is later than 3.3', the heartbeat message is not longer sent. Use the following search instead: index=_internal "group=tcpin_connections" | stats max(_time) as latest by sourceHost | eventstats max(latest) as latest_all | eval lag = latest_all - latest | where lag > 120 | fields sourceHost lag ... View more

Please check this.. just did a reordering. You will need to add that table command in the last.. |metadata index!=network* index=win* index=lin* type=hosts | stats max(lastTime) as lastTime by host | eval diff = now()-lastTime | where diff > 3600|sort - diff | eval lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S") |eval Duration=tostring(diff,"duration") | table host sourcetype lastTime ... View more

Hi SamDavies, may we know 1) you have only two versions or more than two. 2). Can you give us the sample version numbers please. ... View more

Actually you explained the issue very clearly and nicely. Ok, let's try this ... If we use Uniq command, it will get us only "a".. index=my_index id=a | | uniq|table id ... View more

Try "latest=now" More on time modifiers... https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Specifytimemodifiersinyoursearch ... View more

not this comment.. this whole reply, you can "Accept this as answer".. also the upvote button(^) ... View more

Yes Please 😉 .. an upvote and/or accept as answer would be Great ! ... View more

i am not sure if i understand your task correctly, but, lets check this - | inputlookup mylookup | search mylookup_column_name=$keyword$ ... View more

try this - | inputlookup mylookup | search keyword="value" i have a mapZipcode lookup configured on my system and to look for Florida, and this works fine - | inputlookup mapZipCode | search city="Florida" ... View more

Server tokens Common tokens that provide details available from the Splunk platform server. Token Description $server.build$ Build number of the Splunk platform instance. $server.serverName$ Server name hosting the Splunk platform instance. $server.version$ Version number of the Splunk platform instance. ... View more

Simply when you search for sourcetype=my:sourcetype what it returns ... View more

Maybe, add double quotes around source type. index=my_index sourcetype="my:sourcetype" ... View more

regarding that timechart, you can check this one.. | tstats count WHERE index=main by _time host sourcetype span=30m | timechart span=30m sum(count) by sourcetype if the issue is resolved, can you accept this answer. ... View more

Good learnings, Sundaresh Sir. ... View more

i uploaded these sample events - A is running b is running c is running A is running b is failed c is running i ran this query - sourcetype=runningrex | rex field=_raw "(?<first>\w)\sis\s(?<status>\w+)" | table first status _raw and i get this result - first status _raw c running c is running b failed b is failed A running A is running c running c is running b running b is running A running A is running ... View more

the "status" is the variable i am using the extract the word "running". ... View more

your search | rex field=_raw "(?<first>\w)\sis\s(?<status>\w+)" | table first status first column will have only one letter (a or b or .. ) or it can have a few letters (host1, etc ) status will have only "running" or what other values it can have (running, not running, failed, etc..) ... View more

http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Managesummaryindexgapsandoverlaps Use the backfill script to add other data or fill summary index gaps The fill_summary_index.py script backfills gaps in summary index collection by running the saved searches that populate the summary index as they would have been executed at their regularly scheduled times for a given time range. check this one as well.. FYI - This document refers to 3.x versions of Splunk. http://wiki.splunk.com/Community:Summary_Indexing_Back_Fill ... View more

we are trying to create the rex query with just our own understanding of your issue. could you please update us an event, and your current query, please. ... View more