Hi Ninjas I struggle with query including several "challenges". I got proxy events like: time="10-27-17 10:00:00" url="www.applepiesamurai.org/get_more_apple_pie" user="arnold.schwarzenegger" response_size=5000000 domain="applepiesamurai.org" url_cat="1,5" time="10-27-17 10:02:00" url="www.applepiesamurai.org/get_more_apple_pie" user="arnold.schwarzenegger" response_size=7000000 domain="applepiesamurai.org" url_cat="1,5" Now i have a csv lookup look like the following: url_cat,category_name 1,"Business" 5,"Cooking" What now wanted to create is a sum of the response_size by domain, day, user and then list the proxy category_name(s) by each domain: Day| user| domain| response_size| category_name 10-27-17|arnold.schwarzenegger|applepiesamurai.org|12000000|Business Cooking Turned out that this isn't quite as easy as i thought. As url_cat can consist of multiple values i created a new field called "cat" as a multivalue field using transforms "MV_ADD=true". In the search, I use mv_expand on cat to do the lookup and get all the category_name's by each event. But using that, the sum of the response size is misscalculated as mv_expand creates x-times events as it has different cat values and therefore multiplies the sum x-times in my stats sum command. After wasting hours with appends and evals I had to pause before I smashed my keyboard. Any ideas ond how i get the correct calculation but showing all the category_names? ... View more

Hi Ninjas I'm dealing with some deeply nested JSON events like: "sendTime":"2017-09-21T17:02:06.583+02:00","runningProcess":[{"Name":"_Total","PercentProcessorTime":"100","WorkingSetPrivate":"1557368"},{"Name":"Bananaservice","PercentProcessorTime":"0","WorkingSetPrivate":"593"},{"Name":"Cherryservice","PercentProcessorTime":"0","WorkingSetPrivate":"7671"},{"Name":"Pineappleservice","PercentProcessorTime":"0","WorkingSetPrivate":"466"},{"Name":"Kiwiservice","PercentProcessorTime":"0","WorkingSetPrivate":"442"},{"Name":"Appleservice","PercentProcessorTime":"0","WorkingSetPrivate":"630"},{"Name":"Peachservice","PercentProcessorTime":"0","WorkingSetPrivate":"1470"} So all i want to do is getting out the avg values over time by each process, something like | stats avg(runningProcess{}.PercentProcessorTime) as CPU by runningProcess{}.Name, _time | stats list(*) as * by _time But without mvexpand and so on, I'm not getting the right data as just takes the value of the first entry of the mv field by each event. As said, I'm aware of doing it with mvexpand etc. but it slows down the search dramatically and i was wondering whether there is a more elegant solution to get the right data here. Thanks ... View more

hi ninjas im currently dealing with some logs beeing forwarded over syslog to a 3rd party system. The question here is wheter there is an option to prevent splunk adding an additonal header to each message before its getting forwarded. So there should be a way to disable the additonal syslog header when using forwarding so the 3rd party system reveives the original raw message. Any ideas? ... View more