This worked!! THANK YOU ... View more

Hi Renjith, Is it possible to use "eval" instead? Less complicated vs regex. The above one is giving syntax error. | rex field=Issue "^(?P\w+\s+\w+\s+\w+)" What I really need is to just pick up the A CPU bottleneck, skip the rest and get a top 10 count. Thanks. ... View more

I just checked and it looks like the folks who have configured all indexes, have each index set at max of 500GB which is total cap in development environment on this SH. Odd. Also noticed via UI that Current size shows 1MB and MAX shows 500GB, EventCount 0. I am scratching my head. Thanks in -advance for your responses though! 😉 ... View more

df -l shows me that /opt is 100% and /var is 81%. Which manual cleanups can be done to free some space quick? and offcourse the resizing and retention will be checked shortly. ... View more

Addendum: Just checked and /opt is allocated @ 500GB and it is 99.4% full. Seems like this is the issue that artifacts that are created etc. when a search is triggered can't be created due to storage running out? Cleaning up old dispatch jobs helped temporarily and searches were running but not anymore now. Awaiting response. Thanks, ... View more

WIth slight adjustment as per my need, first option worked. THANKS nikenilay!!!! 🙂 ... View more

You mean the Splunk version? It is 6.6.5 and 6.6.6 in two different enviros. The server fields name in indexed events is (os_name) ... View more

hi nikenilay, here it is: <input type="dropdown" token="os"> <label>Select Operating System</label> <choice value="*Linux*">Linux</choice> <choice value="Solaris*">Solaris</choice> <choice value="Sun*">SunOS</choice> <choice value="Windows Server*">Windows Server</choice> **<choice value="=Windows* AND !=Windows Server*">Windows Misc</choice>** <default>*Linux*</default> <initialValue>*Linux*</initialValue> <search> <query /> </search> </input> ... View more

THANK YOU!! ... View more

Thanks Adonio, is there a way to populate them in a clean list from events. I see my own name in that event and I never started it! ... View more

Thanks nikenilay, I got a little confused actually because I have thousands of hosts and can't put each in lets say | makerresults piece for instance. Here is my complete source code for one of the dashboards, pls guide me what is up with this to make it faster and post processing. It runs perfectly fine, just is slow. Adjust as you suggest it should be. <form> <label>Sample</label> <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="boundary"> <label>Select a Boundary</label> <fieldForLabel>Boundary</fieldForLabel> <fieldForValue>Boundary</fieldForValue> <search> <query>| inputlookup boundary_servers_simple.csv | fields Boundary | dedup Boundary</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="*">All</choice> <default>*</default> </input> <input type="dropdown" token="server" searchWhenChanged="true"> <label>Host in Boundary</label> <fieldForLabel>FQDN</fieldForLabel> <fieldForValue>FQDN</fieldForValue> <search> <query>| inputlookup boundary_servers_simple.csv where Boundary="$boundary$" | fields FQDN | dedup FQDN | sort by FQDN Asc</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="*">All</choice> <default>*</default> </input> <input type="dropdown" token="eventcode" searchWhenChanged="true"> <label>Event Code</label> <fieldForLabel>EventCode</fieldForLabel> <fieldForValue>EventCode</fieldForValue> <search> <query>| inputlookup Windows2008andAbove_EventCode_AllSources.csv | fields EventCode | dedup EventCode | sort EventCode Asc</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <default>4624</default> </input> <input type="dropdown" token="description" searchWhenChanged="true"> <label>EventType</label> <fieldForLabel>EventCodeDescription</fieldForLabel> <fieldForValue>EventCodeDescription</fieldForValue> <search> <query>| inputlookup Windows2008andAbove_EventCode_AllSources.csv | where EventCode="$eventcode$" | fields EventCodeDescription</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <default>An account was successfully logged on</default> </input> <input type="time" token="time" searchWhenChanged="true"> <label>Time Picker</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Results for Boundary=($boundary$), Server=($server$)</title> <table> <title>Event Code ($eventcode$) - $description$</title> <search> <query>index=wineventlog sourcetype="WinEventLog:Security" EventCode="$eventcode$" Account_Name!="*$" Account_Name!="SYSTEM" Account_Name!="LOCAL ACCOUNT" Account_Name!="HealthMail*" Account_Name!="Symantec*" Account_Name!="SMP*" Account_Name!="*POOL" Account_Name!="APPPOOL*" Account_Name!="NETWORK SERVICE" [| inputlookup boundary_servers_simple.csv WHERE Boundary="$boundary$" AND FQDN="$server$" | fields FQDN | dedup FQDN | rename FQDN as host | eval Account_Name=mvindex(Account_Name, 1)] | eval Account_Domain=mvindex(Account_Domain, 1) | stats count by host, Account_Domain, Account_Name, EventCode, EventCodeDescription, _time | where NOT LIKE(LOWER(Account_Name),"-") | fieldformat _time=strftime('_time', "%m/%d/%Y %T") | dedup Account_Name</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="drilldown">row</option> </table> </panel> </row> <row> <panel> <chart> <title>Top LogIn Failures Destinations @ $boundary$ Boundary</title> <search> <query>index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625 [| inputlookup boundary_servers_simple.csv WHERE Boundary="$boundary$" AND FQDN="$server$" | fields FQDN | dedup FQDN | rename FQDN as host] | stats count by host | top host showperc=f</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">pie</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.drilldown">none</option> <option name="height">302</option> </chart> </panel> <panel> <chart> <title>Top LogIn Failures by User @ $boundary$ Boundary</title> <search> <query>index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625 Account_Name!="*$" Account_Name!="SYSTEM" Account_Name!="LOCAL ACCOUNT" Account_Name!="HealthMail*" Account_Name!="Symantec*" Account_Name!="SMP*" Account_Name!="*POOL" Account_Name!="APPPOOL*" Account_Name!="NETWORK SERVICE" Account_Name!="GAdminAD" Account_Name!="GadminAD" Account_Name!="LOCAL SERVICE" [| inputlookup boundary_servers_simple.csv WHERE Boundary="$boundary$" AND FQDN="$server$" | fields FQDN | dedup FQDN | rename FQDN as host] | where NOT LIKE(LOWER(Account_Name),"%svc") | top Account_Name showperc=f</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">pie</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.drilldown">none</option> <option name="height">299</option> </chart> </panel> <panel> <chart> <title>Top LogIn Failures Explicit by User @ $boundary$ Boundary</title> <search> <query>index=wineventlog sourcetype="WinEventLog:Security" EventCode=4648 Account_Name!="*$" Account_Name!="SYSTEM" Account_Name!="LOCAL ACCOUNT" Account_Name!="HealthMail*" Account_Name!="Symantec*" Account_Name!="SMP*" Account_Name!="*POOL" Account_Name!="APPPOOL*" Account_Name!="NETWORK SERVICE" Account_Name!="GAdminAD" Account_Name!="GadminAD" Account_Name!="LOCAL SERVICE" [| inputlookup boundary_servers_simple.csv WHERE Boundary="$boundary$" AND FQDN="$server$" | fields FQDN | dedup FQDN | rename FQDN as host] | where NOT LIKE(LOWER(Account_Name),"%svc") | top Account_Name showperc=f</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">pie</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.drilldown">none</option> <option name="height">300</option> </chart> </panel> <panel> <chart> <title>Top LogIn Failures SVC Account/s @ $boundary$ Boundary</title> <search> <query>index=wineventlog sourcetype="WinEventLog:Security" EventCode=4625 Account_Name!="*$" Account_Name!="SYSTEM" Account_Name!="LOCAL ACCOUNT" Account_Name!="HealthMail*" Account_Name!="Symantec*" Account_Name!="SMP*" Account_Name!="*POOL" Account_Name!="APPPOOL*" Account_Name!="NETWORK SERVICE" Account_Name!="GAdminAD" Account_Name!="GadminAD" Account_Name!="LOCAL SERVICE" [| inputlookup boundary_servers_simple.csv WHERE Boundary="$boundary$" AND FQDN="$server$" | fields FQDN | dedup FQDN | rename FQDN as host] | where LIKE(LOWER(Account_Name),"%svc") | top Account_Name showperc=f</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">pie</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.drilldown">none</option> <option name="height">300</option> </chart> </panel> </row> </form> ... View more

We have Splunk 6.6.5 and 6.6.6 in different environments. I actually meant to say Host="$projectserver$", this is what happens at half past 12 midnight! 🙂 while typing. Stats table query is: index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 [| inputlookup boundary_servers_simple.csv WHERE Boundary="$boundary$" AND Host="$projectserver$" | fields Host| dedup Host| rename Host as host] | stats count by host, Account_Name, EventCode, EventCodeDescription, _time | fieldformat _time=strftime('_time', "%m/%d/%Y %T") ... View more

one correction, actually for both pie chart for top host and stats table panel both are taking very long. ... View more

Hi nikenilay, Good news, this new query worked with the Host="*" tweak. Bad news, I also used this with slight adjustment for statistical table panel and its taking a very long time! How to tweak it for that pls. ... View more

Hi niketnilay, The issue with ALL remains. I have even tried your sample above and did adjustments as needed but still, ALL does not work. Niether for Project NOR for Project Servers. I can not use servers manually within the code as you suggested because I have them in thousands and I have to use lookup. Didn't attempt to do TOP piece because the ALL piece does not work. What to do next? Any manual adjustments in the source code to be precise pls? ... View more

thanks again as well. the sourcecode and queries posted above. ... View more

It was a duplicate so I am posting it here and deleted the other one. Appreciate everyone's assistance here. The queries I am using with in the dynamic option is actually two lookup tables. Drop down 1: | inputlookup project_info.csv | fields project | dedup project Drop down 2: | inputlookup project_servers.csv | search project=$project$ | fields Host | dedup Host This queries are also slow including the drop downs as well as in the last snippet for Top LogIn Failure Hosts first of all but does produce the listing I need BUT problem is same above, the All="*" is outputs all hosts in indexes instead of just the ones with in a selected project from drop down 1 of All projects from drop down one. I will need faster queries as well pls. code below and rest of the panels follow. enter code here Sample <input type="dropdown" token="project"> <label>Select Project</label> <fieldForLabel>Project</fieldForLabel> <fieldForValue>Project</fieldForValue> <search> <query>| inputlookup project_servers_simple.csv | fields Project | dedup Project</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="*">All</choice> <default>*</default> </input> <input type="dropdown" token="projectserver"> <label>Select Server</label> <fieldForLabel>Host</fieldForLabel> <fieldForValue>Host</fieldForValue> <search> <query>| inputlookup boundary_servers_simple.csv | search Project="$project$" | fields Host | dedup Host</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="*">All</choice> <default>*</default> </input> <input type="time" token="time" searchWhenChanged="true"> <label>Time Picker</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <panel> <title>Top 10 LogIn Failures Hosts</title> <chart> <search> <query>index=wineventlog sourcetype="WinEventLog:Security" host="$projectserver$" | search EventCode=4624 host=* | top host -24h@h now pie none ... View more