Is the list of fields known and static? Then you can use the props.conf setting  FIELD_NAMES = field_1, field_2, field_3 to tell splunk what field names to use, rather than take them from the header row. ... View more

Any specific reason you need this as index-time extractions? Any chance you could manipulate the overall format in which your receive the message? If the rest of the log format would have been valid json (which it almost is), you could have simply used the INDEXED_EXTRACTIONS = json setting in props.conf. ... View more

If it is an on-prem splunk instance where you have configured that HEC token, you can edit it in the respective inputs.conf file. If you're on Splunk Cloud or for some other reason do not have access to the configuration file, you'd probably have to create a new token with the new name and just update the token used at the source side. As there doesn't seem to be an option to rename a HEC input on the GUI or create a new HEC input with a specific token value. ... View more

One way to do that would be to run the search you have, that gives you today's figures, on a daily basis and write the results into a summary index. Then run a timechart over that summary index. But of course, that does require some time to build up data in the summary index before you're able to timechart anything. Creating a query that directly gives you a timechart of active and inactive users by day is a bit more tricky as that activity is based on a 30d window. ... View more

In the second query, the processName field doesn't exist after the stats command, so you can't use that in the condition. I'm not sure why the first query doesn't work. Best to investigate it by removing the eval line and look at the results of the stats command, to see if the data would actually match the condition. To make the 'last_seen' field human readable (for easier investigation if it is within the last 30d), you can do this (at the very bottom of your query, after doing any evals/conditions that need that field): | convert ctime(last_seen) ... View more

Even for existing content it could have impact. Matching settings will be merged in favor of Splunk_TA_nix, but the 2 TAs can vary well have 2 different settings that each affect how for example the src_ip get's extracted and with both TAs active, both REPORT / FIELDALIAS settings get applied in some order (unless they have the exact same name). ... View more

Did some piece of the query go missing where that blank line is? If this is how it actually is in your dashboard, that might explain why the query doesn't work. Also, I think this eval is the wrong way around: | eval Called_Country_ID=_Called_Country_ID Also, not entirely sure why you can't use the <fields> approach here. You can also use the token inside that <fields> definition, right?  ... View more

That's a good question. Had a quick look at my lab environment and there I also see files from years ago, that have long since been deleted, still listed as "open file", but with percent=100 and the file position equal to the file size (others are listed as "finished reading). To some extent I would say this is how the whole 'fishbucket' stuff works, where splunk keeps track of which files it has been reading from and how far it got etc. But why it lists long deleted files still as "open file" is also beyond me... ... View more

You can do that in 2 ways: 1: with something like this:   | eval new_string = case(old_string="ABC","XYZ",old_string="DEF","UVW")   2: You could store the mapping into a lookup and use the lookup command to find the new string that corresponds to the original string. ... View more

It's not very clear to me what you are asking for to be honest. If you want to apply similar filters to your tstats query like you are showing in your second screenshot, take a look at the PREFIX(), CASE() and TERM() directives you can use in the tstats command: https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Tstats#Use_PREFIX.28.29_to_aggregate_or_group_by_raw_tokens_in_indexed_data http://docs.splunk.com/Documentation/Splunk/8.0.5/Search/UseCASEandTERMtomatchphrases Note: PREFIX() is only available since Splunk 8 ... View more

I might help if you share a bit more detail on the search you are running, but it sounds like you're looking for the substr() eval function: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/TextFunctions#substr.28X.2CY.2CZ.29 ... View more

Something like this should work. Run it every 30min over last 60min (instead of your current 30min): index=day sourcetype="mqmon" EventType="QueueDepth" QDepth>0  | eval time = _time | bin time span=30min | stats latest(QDepth) As QueueSize,max(_time) As LastEvent by time,host, QMan, QName | eval _time=time | eventstats earliest(QueueSize) as PrevQueueSize | where QueueSize!=PrevQueueSize | eval LastEvent=strftime(LastEvent,"%d %b %Y %H:%M %p") Note: I've also moved the timestamp to string conversion to the end, otherwise max() will have incorrect results (the timestamp format you use does not sort chronologically). ... View more

Can you perhaps add a screenshot of how you are doing the |delete command? ... View more

Looking at it once more, you can get rid of that whole "appends" approach, by simply removing the 'Debit=...' part from your search. Or replace it by Debit IN(a,b,c) if the data source contains other debit values which you want to ignore. Because the Debit field is the only thing that is different between the various appends bits, and you already do a 'by Debit' in your stats. Then you can do the eval like this: | eval Interval_tolerance = case(Debit=a,x,Debit=b,y,Debit=c,z) ... View more

My first guess would be that this is the magic of floating point numbers at work. If you're having real life issues like the example you shared, you might want to look at using the sigfig() function: https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/MathematicalFunctions#sigfig.28X.29 ... View more

Couple of things that come to mind (possibly not an exhaustive list): check if any data is still coming in check if any searches are ran against it (search for the index name in _audit index) check if any configuration exists that refers to the index (e.g. macros, saved searches, dashboards, inputs) several ways to do this (btool, | rest, simply searching through the files on the server(s)...) ... View more

In addition to @gcusello  his comment, you can also use the '| fieldsummary' command to get a summary of all fields extracted from the events in a certain index. index=your_index | fieldsummary ... View more

The outputlookup command will put the header row in place as well. ... View more

If the search heads are not part of a search head cluster, they will not be aware of each other's knowledge objects (like lookups/ kv-store collections / ...). I can think of a few ways to make the content of a lookup available on another search head: Write the data also to a (summary) index. Run a scheduled search on the other search head to fetch data from the index and populate a local copy of the lookup. Define the same csv file based lookup on both search heads and use some mechanism to sync the underlying csv file between the search heads (e.g. a scheduled rsync job). Similar to option 2, but use a script that talks to the REST interface of both search heads to sync the lookup contents (not an expert on this, but I think this should be possible) But it might also be a good reason to think about moving to a clustered search head setup. ... View more

Not a direct answer to your question, but it might be worth looking at this recently published blog on how to send GSuite logs to HEC (through Google Cloud Platform pub/sub methods): https://www.splunk.com/en_us/blog/partners/google-gsuite-to-splunk-hec-configuration.html ... View more