I think its kinda trickier question to answer . The best way might to understand what each command does and trying them on the example data makes you better . ... View more

Corrected query index=* sourcetype ="access_combined" clientip=* |iplocation clientip |bin _time span=1m |stats count as count1m by _time Country |eventstats sum(count1m) as total by _time ... View more

It would be ideal if you post your props tooo . ... View more

You need to iplocation command for populating country name based on clientip .... Please modify your query as below |makeresults |eval clientip = "136.168.3.2,119.56.76.89"|eval clientip = split(clientip , ",") |mvexpand clientip |iplocation clientip|bin _time span=1m |stats count as count1m by _time Country |eventstats sum(count1m) as total by _time Happy Splunking !! ... View more

Did you count of events in sql side and splunk side match ?? ... View more

In the props.conf specified that SHOULD_LINEMERGE = false needed to specify LINE_BREAKER for breaking the events properly OR specify INDEXED_EXTRACTIONS = CSV INDEXED_EXTRACTIONS = < CSV|W3C|TSV|PSV|JSON> * Tells Splunk the type of file and the extraction and/or parsing method Splunk should use on the file. CSV - Comma separated value format TSV - Tab-separated value format PSV - pipe "|" separated value format W3C - W3C Extended Extended Log File Format JSON - JavaScript Object Notation format * These settings default the values of the remaining settings to the appropriate values for these known formats. * Defaults to unset. ... View more

The reason why the values are not subtracted because of "," in the number make splunk to consider them as string and unable to do the caluclation . For this we need to convert the fields to number so that "," will be removed and then eval diff = p1 - p2 For example |makeresults |eval p1 = "2,000;1,000" |eval p2= "10,00;2,000" | eval p1 = split(p1,";") |eval p2 = split(p2, ";") |mvexpand p1 |mvexpand p2 |convert num(p*) |eval diff = p1-p2 ... View more

Are you seeing the issue when you are running |inputcsv IP1 .? My understanding is that you are seeing the display 1.52E+09 when you download and open in excel . If that is the case please increase the width size of the cell which gives excel enough space to display the value . Thanks ... View more

lastupdate_datetime is the best shot for rising columns . As per the documentation Rising input A rising input has a column that DB Connect uses to keep track of what rows are new from one input execution to the next. When you create a rising input type, you must specify the rising column. You can specify rising column as any column whose value increases or decreases over time, such as a timestamp or sequential ID. For example, you can use columns such as row_id, transaction_id, employee_id, customer_id, last_updated, and so on. ... View more

Answer for your question is below https://answers.splunk.com/answers/298999/splunk-app-for-enterprise-security-how-to-add-addi.html ... View more

Hope this search satisfies your requirement |makeresults | eval event = "1001 abc done on 2018-04-21 00:45:38, 1100 agc done on 2018-04-21 00:55:30, 1200 ybc done on 2018-04-21 01:05:39" |eval event = split(event, ",")|mvexpand event| rex field=event "(?\d+)\s+(?P\w+)\s+(?P\w+)" |delta first as firstcolumndiff ... View more

Can you try re writing the search like this and try sourcetype = *SIPPRD ACTION_NAME IN ("LOGON", "LOGOFF", "LOGOFF BY CLEANUP")||table TIMESTAMP , USERNAME,ACTION_NAME |search NOT [inputlookup Login_Exclusion.csv |fields LOGIN_EXCLUSION] |search NOT [inputlookup Login_Exclusion_OS.csv |fields LOGIN_EXCLUSION_OS] Let know if any this search runs any resultss ... View more

Please have a look at this question https://answers.splunk.com/answers/36932/sourcetytping-and-override-source-name-on-directory-with-multiple-files.html ... View more

Your code should be like the sample code below Selected chart examples <panel> <chart> <title>A line chart</title> <search> <query> index=_internal source="*metrics.log" group=per_sourcetype_thruput | timechart sum(kb) by series </query> <earliest>-1h</earliest> <latest>now</latest> </search> <option name="charting.chart">line</option> </chart> </panel> <panel> <chart> <title>Show all fields except splunk_web_service, splunkd_access, and splunkd</title> <search> <query> index=_internal source="*metrics.log" group=per_sourcetype_thruput | timechart sum(kb) by series <earliest>-1h</earliest> <latest>now</latest> </query> </search> <option name="charting.data.fieldHideList">["splunk_web_service", "splunkd_access", "splunkd"]</option> <option name="charting.chart">line</option> </chart> </panel> <panel> <chart> <title>Show only splunkd_access and splunkd fields</title> <search> <query> index=_internal source="*metrics.log" group=per_sourcetype_thruput | timechart sum(kb) by series </query> <earliest>-1h</earliest> <latest>now</latest> </search> <option name="charting.data.fieldShowList">["splunkd_access", "splunkd"]</option> <option name="charting.chart">line</option> </chart> </panel> ... View more

posting a sample event will help ... View more

I think I misunderstood your question but posted based on what I understood You can drag and adjust and alignment of the panels as required . Or Else you can make the changes to your xml in the source to look like this pattern hello <panel> <chart> <search> <query>index=_* | head 10</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="charting.chart">area</option> <option name="charting.drilldown">none</option> </chart> </panel> #remove this parameter <panel>#remove this parameter <table> <title>testaccel</title> <search ref="testaccel"></search> <option name="drilldown">none</option> </table> </panel> #remove this parameter <panel>#remove this parameter <chart> <title>License Usage Data Cube</title> <search ref="License Usage Data Cube"></search> <option name="charting.chart">area</option> <option name="charting.drilldown">none</option> </chart> </panel> ... View more

Please try this | makeresults |eval "#hello" = "1"|eval "#hola"="2" |rename #* as * ... View more

You can use this in caluclated fields in props.conf by specifying like this EVAL-status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",if(isstr(temp),"yes","no")=="yes" ,temp) ... View more

Thanks for correcting me . ... View more

Indexing the results into summary index might not help because it has too much data . Populate the dashboard by using reports . -->create a report --> accelerate the report and select your summary range . -->schedule the report for smaller time ranges like an hour as per search completion time . -->save it and add it to the dashboard . More info can be found at https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Manageacceleratedsearchsummaries ... View more

This is another work around base search |extract epoch format | convert ctime(epochfield) as pct |bin pct span=1d | stats count by pct ... View more

Try this regex rex field = _raw "\s+\w+\s+(?P.*)\s+\d+" ... View more

Hi , AWS add-on consists of all the inputs configuration of all aws logs which includes kinesis as one among them . AWS kinesis add-on consists of inputs configuration for aws kinesis logs only . I believe Amazon kinesis Firehose add-on is the best way to get the vpc logs because its easy to configure and uses HEC for sending the data . Kinesis is the recommended input type for collecting VPC Flow Logs (source type: aws:cloudwatchlogs:vpcflow). This input type also supports the collection of custom data types through Kinesis streams. ... View more

Hi , The reason might be not adding crcSalt or crcinitlength in inputs.conf . crcSalt = * Use this setting to force the input to consume files that have matching CRCs (cyclic redundancy checks). * (The input only performs CRC checks against, by default, the first 256 bytes of a file. This behavior prevents the input from indexing the same file twice, even though you may have renamed it -- as, for example, with rolling log files. However, because the CRC is based on only the first few lines of the file, it is possible for legitimately different files to have matching CRCs, particularly if they have identical headers.) Can you please add crcSalt = . If the trick doesn't work please share how your inputs.conf looks like ? Thanks ... View more