@jhamot23  Did you know there's a top command? (it defaults to top 10, but this is configurable if you want) See if this gets you in the neighborhood:   index=firewall | top src_ip BY url   ... View more

@Srubhi  In your query, go to the statistics view, click the little paintbrush next to the column and follow the items I show in this screenshot. This should be able to do what you want. Good luck! ... View more

@Digvijay  It's a matter of customizing the regular expression as you need. There's a lot of pros and cons to using regular expressions, so make sure all your use cases and negative use cases work with your query. Try this:   source="http:product_inv_rest" | spath message | regex message="\/product\s(?!123456)(?<TheseAreTheNumbersIWant>\d+)" | search TheseAreTheNumbersIWant=*   Now all the results following this line will have a number in the message and that number isn't 123456. ... View more

Ciao @gcusello  ! Thanks for reaching out! I can't seem to edit the code in the original answer, maybe it's too old. The error you're seeing was a paste/conversion problem with Community. The answer I gave contains... background-image: url(data&colon;image/png;base64 However, the &colon; should be highlighted as the problem. It needs to be an actual colon. This symbol : If you make that edit, it works. ... View more

@bhaskar5428  A web resource a lot of people use, is https://crontab.guru/. I'm not affiliated in any way with the tool, but for years, it's not steered anyone wrong. What's cool about it is it can help you understand the plain-English of the cron expression @ITWhisperer gave you. Check here to see the expression pre-populated: https://crontab.guru/#0_18_*_*_1-5 ... View more

There's a lot of troubleshoot there. The following documentation sounds like what you're looking to do. https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Monitorfilesanddirectories ... View more

@david_blanco  Does this article help? https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-or-REST-command-to-stop-running-searches/m-p/121652 Ultimately you'd need to submit the .net equivalent of the following (the job id here is for example, and you would need to know the job id): curl -k -u admin:<pwd> --request DELETE https://localhost:8089/services/search/jobs/1416293763.77   ... View more

Check lookup definition in both places, csv in both places, permissions on both - in both places. Then run the exact same query in both places. ... View more

@indeed_2000It looks like the solution you posted and accepted uses the code from the page I linked to. Glad it helped you. It looks like you've found that lines of SPL code may be useful for multiple use cases. If the pointer I provided was helpful, a karma thumbs up is appreciated. Happy Splunking! ... View more

Hi @indeed_2000 ! It's often a good idea to search the community for answers before asking the question. In this case, I found exactly an answer in only one search: https://community.splunk.com/t5/Splunk-Search/How-to-get-the-percentage-of-each-HTTP-status-code/td-p/420708 If this resolves your problem, please accept this answer. ... View more

@prachijain1288  Try to search for your answer in the community to see if the question has already been asked. As ITWhisperer indicates, this comes up. A lot. Also, you want to try to tell us what you've tried, what the result was, why the result doesn't meet your expectations, and what your expectations were. This helps us figure out what a possible solution might be. To give you one possible lead to your question, try reading this and if that doesn't help, use the link ITWhisperer created. https://community.splunk.com/t5/Splunk-Search/Display-hosts-with-no-data/m-p/293342   ... View more

@kumarnis45Check the dashboard settings by going into edit view, and check the query and the visualization are set to meet your expectations. I might guess the query is not exactly the same, or there are other things going on in the dashboard. You are correct, that with the right configuration, the search and the dashboard should output the same data and the same visualization. ... View more

I don't think too many people have tried to do what you're trying to do, but I'll help as much as I can. It may be a difference between browsers, but also the configuration your company ships with each. It may or may not be something you can control. It may or may not be iframes either. Each browser comes with its own security and ways to deal with cookies. Then each browser you're using may have extensions/add-ons that further influence how the browser is dealing with Splunk. Start with company-issued default un-customized browsers and test. Then open the browsers' developer tools, reload the page, see what errors appear, and try to go from there. Hopefully that helps you enough to get somewhere with it. ... View more

@StefanieConsent or notification banners/messages range between companies, government agencies, etc.. Depending on your requirements, the Splunk Admins have access to a one-line banner, which can be made into a hyperlink. There is limited customization, but does serve most purposes. Logged in as an Admin... go to Settings » Server settings  » Customize global banner. From there, you can put in your message, make it a hyperlink (example "Logging in acknowledges your consent to the policies linked here."), color the background, and it will appear at the top of the Splunk log in screen. For more info: https://www.splunk.com/en_us/blog/devops/display-a-persistent-banner-message-with-the-new-global-banner.html ... View more

This may be possible, if you create the table yourself inside an HTML panel, and make the results appear within the panel. However, that's an extraordinary level of work, only to create a table that combines headers without explaining both columns beneath it. This would be a negative practice from a visualization standpoint. I wouldn't recommend it. If I may, perhaps what you are really doing in that table header is: operation | Germany - distinct | Germany total | Spain - distinct | Spain total | London - distinct | London total If you want to save horizontal header cell space, you could abbreviate the countries maybe. operation | DE - distinct | DE total | ES - distinct | ES total | GB - distinct | GB total ... View more

I would have guessed CSP, but if you're saying that's not it, then I'm not sure. However, I'm not sure this is a great way to go. Why not style a dashboard as you need, using CSS (and javascript if wanted). Or create a series of reports and embed each of them as iframes in your webpage, which is already styled as you want? Those are native ways to somewhat accomplish what you are looking for. ... View more

YMMV. Your cases aren't my cases, which is why I recommended not only the one I'm most familiar with, but the others that come up often. I do recommend you install and play with all of it in your dev environment, and figure out what meets your needs and wants. Then get rid of the rest. I recommend that you do not install things into your prod environment that you don't need. And to not seem evasive, I am satisfied between the services my admins (great people) provide and the solution dmarling and I presented. Our CYA solution scratches my exact itch, and has done so for years now. It also works in more than one Splunk product. Good luck on your journey! ... View more

There's several angles to consider as an admin on backing up and restoring an enterprise environment. How to do it, how to restore it, how often to test, how often to snap, etc. Beyond that, the investment of time and energy of even one critical dashboard, macro, or query, may justify looking into other ways to protect yourself. Several of us in the community have come up with ways to help with this too. @dmarling& I presented a solution at Splunk .Conf19 called Cover Your Assets. Presentation with walk-through and slide deck: https://conf.splunk.com/watch/conf-online.html?search=FN1315#/ Files at Github: https://github.com/paychex/Splunk.Conf19 There's also an app by gjanders called VersionControl For Splunk: https://splunkbase.splunk.com/app/4355/ And @chrisyounger has Git Version Control for Splunk: https://splunkbase.splunk.com/app/4182/ Check all of these things out to figure out how best to accomplish your goals. Good luck! ... View more

@nikhilnsr1998I only have some little info for you. The username and password shouldn't be what you use to log into Splunk. At least it isn't in my environment. I don't supply anything there. When I access that URL you provided in a web browser, I am told I didn't supply an API key. If the API key you have is specific to you, then consider not doing that, because your searches will show up in the audit log. Lastly, I also put the URI in double quotes. YMMV ... View more

@manur  I know this is an old question, but in case people come across this, here's a potential answer: After the basesearch's </query> tag, try adding <earliest>-1d@d</earliest> <latest>now</latest> Giving props where props are due: https://community.splunk.com/t5/Dashboards-Visualizations/Using-base-search-in-drop-down-list/m-p/508041 ... View more

@kirruskDid you get a zero at the end of your query? Or are you still trying to do that? If you do have a "0" at the end of your query, then it is as easy as modifying your last line to   | appendpipe [ stats count | where count=0 | eval count="No data, Please check later"] I tested this and it will display in a single value viz. So you won't need any of the custom xml, because the logic is in the query itself.   ... View more

How do you know the host and port are correct, if you can't get a response? Or perhaps they are correct, and you have a firewall between you and the host? We can't help you with the firewall scenario, but if you are certain it's correct, try a basic curl command, so you can test connectivity. If you can't connect, you can send the basic command and the result, to your network/firewall admins. From this page: https://docs.splunk.com/Documentation/Splunk/8.2.1/RESTUM/RESTusing Try this curl command, see if you get through, and if so, what the response is. curl -k https://localhost:8089/services/auth/login --data-urlencode username=admin --data-urlencode password=pass   ... View more

@sujamaskey2019Thank you for reaching out, and for @ mentioning us. So weird that we didn't receive a notification for this question. I found it today by accident. Sorry for the late response. We aren't familiar with Okta, but in reading up, there's some key items you'll need to discuss with your admins, regarding how you would get a token and rights to use the REST API in your environment. For reference on what's needed token-wise, here's a link to Splunk Docs to discuss with your admin on the Splunk side of it: https://docs.splunk.com/Documentation/Splunk/Latest/Security/CreateAuthTokens Best of luck! ... View more