It indeed helped. Happily Accepted and upvoted . ... View more

|eval var=_time ... View more

Try this run anywhere search: |makeresults|eval person="x", no="20"|append[|makeresults|eval person="y", no="30"]|append[|makeresults|eval person="z", no="50"]|table person no|stats values(no) as no by person|eventstats sum(no) as total|eval percentage=((no/total)*100)."%" ... View more

@gts_ame_tfo_cty please share your query for Table A and Table B. Also make sure you use the Code Button 101010 on Splunk Answers while posting your queries so that special characters in them do not escape. PS: Adding four spaces before each line of code will also format the entire content as code. ... View more

yes, this was already in mind. Just thinking instead of creating 3 separate model inputs, if it is possible to do using whitelist/blacklist in single input that would be great. ... View more

Hi FrankVI thanks for your support, I have created a new post with the regex requirement. https://answers.splunk.com/answers/618695/need-a-help-in-regex-to-over-ride-the-host-value-w.html?minQuestionBodyLength=80 Kindly guide me on the regex. ... View more

One issue I am having is my search is with an enterprise that has over 400000 users so I am only running it for Last 7 Days, to gain an idea who is spending time on the internet rather than their normal duties. The results i am getting just like the events and are not downloadable, in other words I am just getting events not statistics even with the table command. I will try the eventstats command, but am not sure where it goes: does this look correct? sourcetype="access:file", index="proxytraffic" earliest=@mon latest=now | eventstats count(uri) as TotalURLsVisited by user | search TotalURLsVisited>10000| table date_month _time user method status uri ... View more

You can leave out those startswith and endswith parts if needed. PS: you might want to change your 'answer' to a comment and if my answer (or the answer of @niketnilay below) works for you, appreciated if you mark it as accepted, such that it is clear this question was answered 🙂 ... View more

I've tried both options with two different indexes (incoming tasks and out coming ones) and here you have the results: For the in ones, I've added KV_MODE=none It is working now! I can see all the fields with calculations filled with results and the events only contain one line. created_at 1516970893.18886 cti CTI-EU-00000085 customer GLASS-EU:5701 In the out ones, I've deleted INDEXED_EXTRACTIONS = json And the events are empty, they are just these characters "},{" So, the right one is to include both, KV_Mode=none INDEXED_EXTRACTIONS = json Can you give more information or explain me a little more about the KV_MODE? Why was it happening? So if I find the problem again I will understand it better. Also, post an anwser so I can click as right answer an upvote it! Thank you a lot! ... View more

Thanks Yannk,i will look into lookups and maybe field aliases ... View more

Is the filename in the source field (as usual)? Then you could do something like: ...base search... | eval validFileName=(if(match(source,"<validation regex>"),"Yes", "No")) ... View more

Thanks for coming back and sharing what the actual solution was. Please don't forget to click accept on your answer. ... View more

index= source=source1 OR source=source2 | stats dc(source) as source_count by | where source_count=2 | stats count by ... Thanks. ... View more

Yes, they want to be able to see only their data most of the time, but want to be able to see all of the data on occasion. We used roles to implement the restrictions because of the fact they can create their own dashboards. It's a sucky situation for sure and yes, I do understand your point about the accounts, but we don't have much of a choice at this time. ... View more

If its a one time thing, you can do it in one go. It will however lead to a violation. Search will stop at the third violation. To understand more about license violations: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutlicenseviolations ... View more

You can of course simply add _time to the by-clause of that tstats command, and then do some sorting and deduplication to filter out the oldest timestamp for each sourcetype. ... View more

Yes, I understand if there are duplicates that this also counts towards the daily volume usage. I just checked and the file size is now -> 1.1MB while my daily usage is over 10MB. How can I configure Splunk monitoring in such a way that he only needs to care about the newly added date from this file? Or how can I configure Splunk monitoring to only check this file every 20 minutes and index the data that has been added? ... View more

Good catch, let me adjust that in my answer. ... View more

What does your serverclass.conf look like? ... View more

Yes i did the same but no luck 🙂 ... View more

Splunk support said that the amount of license usage will change depending on SEDMCD too. Thank you for answering. ... View more

Your regex contains just 1 capturing group, so how can you refer to $4 and $8? Yes, this regex matches all the bits separated by spaces, but this is not how you extract fields from an event like this. Approaches that would work: REGEX = (".*?"|\S+)\s(".*?"|\S+)\s(".*?"|\S+)\s etc. FORMAT = field1::$1 field2::$2 field3::$3 etc. Which uses a regex that matches the event as a whole and extracts each field into a capture group and then assigns those capture groups to the relevant fieldname. Or: REGEX = (?:(?:".*?"|\S+)\s){10}(".*?"|\S+) FORMAT = ip::$1 Which skips over X (10 in this example) fields and then extracts a single piece to assign to a specific field. ... View more