You need to include your app path in the URL. In curl it might look like: curl -k -u admin https://localhost:8089/servicesNS/<your user>/<your app>/search/jobs/ -d search="| tstats count FROM datamodel=<your datamodel>" Where <your app> is the app path as shown in the URL bar of your browser while using that app. ... View more

You need duration or end time in addition to start time to consider doing this. It's also going to be difficult to do this in a "normal" Splunk search. I did something somewhat similar with mail logs. Specifically I had to write a custom search command that followed tree-like data, which is what your use case really needs. ... View more

Can you paste the full _raw of the event in question? Sometimes there are multiple instances of timestamps on one message, which can confuse Splunk. ... View more

Can you include the payload of the message sent (full _raw ) that gets indexed as the wrong host? It's very possible the firewall is sending logs with with the IP address in the payload instead of the hostname now. ... View more

Slight variation to your 2nd rex : | rex max_match=0 field=shared_with "(^|, )(?<name>[^@ ]+)@(?<domain>[^,]+)(,|$)" Prevents getting , as a prefix to name . ... View more

I didn't know about the in function! I knew about new IN operator in SPL, but not in terms of eval . ... View more

If you use search=" syntax you have to escape any " in your search, like this: |inputlookup My_Test_Extraction_Lookups |table stanza |map search="| rest splunk_server=local /servicesNS/-/-/data/ui/views | rex field=eai:data \"(sourcetype=)+(?<sourcetype>\w+)\s\" max_match=0 | rename eai:data as code eai:acl.owner as owner eai:acl.app as app |stats values(*) as * by sourcetype |search sourcetype=$stanza$ | table sourcetype title owner app" And | map [<search>] is indeed valid. ... View more

Nice! I was unaware of the where in functionality in timechart. ... View more

I think you may need to include some additional information about the problem you're running into. Is the search giving you an error, incomplete results, or incorrect results? ... View more

If you're going to search for "what's not there", you have to include in your search some default values of what should be there, so that you aren't just missing rows for the missing data. This run anywhere search shows how you can do this: index=_internal sourcetype=mongod OR sourcetype=splunkd OR sourcetype=splunkd_conf OR sourcetype=madeup | stats count BY sourcetype | append [| makeresults | eval sourcetype="mongod,splunkd,splunkd_conf,madeup" | makemv delim="," sourcetype | table sourcetype | mvexpand sourcetype | eval count=0] | stats sum(count) AS count BY sourcetype | search count=0 The append line could use inputlookup to fetch the list of expected sourcetypes, or you could hardcode them into the search as shown here. It creates a row for each expected sourcetype with count=0, then performs another stats afterwards to sum them so you can see which events created via append didn't have any additional count from before. ... View more

I can't seem to get the dependent dropdown to clear its value, but this does show the dependent search having a cleared value from the dependent dropdown until a new value is selected: <form> <label>States</label> <search id="states"> <query>| makeresults | eval state="Alabama,Alaska,Arizona,Arkansas,California,Colorado,Connecticut,Delaware,Florida,Georgia,Hawaii,Idaho,Illinois,Indiana,Iowa,Kansas,Kentucky,Louisiana,Maine,Maryland,Massachusetts,Michigan,Minnesota,Mississippi,Missouri,Montana,Nebraska,Nevada,NewHampshire,NewJersey,NewMexico,NewYork,NorthCarolina,NorthDakota,Ohio,Oklahoma,Oregon,Pennsylvania,RhodeIsland,SouthCarolina,SouthDakota,Tennessee,Texas,Utah,Vermont,Virginia,Washington,WestVirginia,Wisconsin,Wyoming" | makemv delim="," state | table state | mvexpand state</query> </search> <fieldset submitButton="false"> <input type="dropdown" token="letter" searchWhenChanged="true"> <label>Letter</label> <fieldForLabel>letter</fieldForLabel> <fieldForValue>letter</fieldForValue> <search base="states"> <query> <![CDATA[rex field=state "^(?<letter>.)" | stats count BY letter]]> </query> </search> <change> <unset token="state" /> </change> </input> <input type="dropdown" token="state" searchWhenChanged="true"> <label>State</label> <fieldForLabel>state</fieldForLabel> <fieldForValue>state</fieldForValue> <search base="states"> <query> <![CDATA[rex field=state "^(?<letter>.)" | search letter=$letter$]]> </query> </search> </input> </fieldset> <row> <panel> <title>You picked</title> <single> <search base="states"> <query>search state=$state$ | table state</query> </search> <option name="drilldown">none</option> </single> </panel> </row> </form> ... View more

Wait, that says slave-apps/local is higher than system/local. I had assumed your indexes app was using master-apps/app/default/indexes.conf, which you could override with apps/app/local on the indexer. So that may be an option. Move your indexes.conf on your CM to master-apps/app/default/indexes.conf. ... View more

What if you configure the CM to push indexes.conf using $SPLUNK_DB, and configure that appropriately on each indexer via splunk-launch.conf? I would probably shy away from manually placing things in slave-apps. I apologize for the incorrect answer, and the above is certainly just a “maybe try this” instead of an actual answer. ... View more

This will give an average of averages, which is probably not really what you want. ... View more

Unless I’m just unfamiliar with some of these terms, I think you may need to expand on what you’re asking for. ... View more

The document you referred to is the official and authoritative document for this process. Considering that, I would consider the interaction with the deployment server and license master to be a non-issue in terms of the upgrade process. Of course, as with any production environment, I strongly suggest testing your upgrade path prior to performing it in production. In this case it should be easy enough to test your specific version requirements regarding interaction with the deployment server and license master. ... View more

There are multiple options. The first of which is timechart , as @mayurr98 posted above. The other, which you seem to have specifically asked about, is to do stats BY _time , where you have previously performed bin against _time: sourcetype="pan:traffic" | eval Byte_IN=bytes_in/1024/1024/1024 | eval Byte_OUT=bytes_out/1024/1024/1024 |eval SumByte=bytes/1024/1024/1024 | bin span=1min _time | stats sum(Byte_IN) AS GB_IN ,sum(Byte_OUT) AS GB_OUT ,sum(SumByte) AS Sum_GB BY _time Which of these is most appropriate depends on your specific use case, pick the style that gives you the type of results that work best for you. ... View more

You need to either: A: define master-apps/app/default/indexes.conf in an app named appropriately so that it takes precedence over these other apps. Maybe prefix them with A_ or 1_ B: define master-apps/app/local/indexes.conf, which will take precedence over any default/indexes.conf. Consult the Configuration file precedence documentation to see the full explanation of which app/config takes precedence. In my opinion it's wrong for 3rd party apps to configure index paths without making use of the environment variable. ... View more

I believe you’re looking for streamstats. Perhaps something like: | timechart span=1mon count(AppAv) AS count, sum(AppAv) as sum_month | streamstats sum(count) as cumulative_count, sum(sum_month) as cumulative_sum | eval cumulative_average=cumulative_sum/cumulative_count ... View more

Are you having trouble getting a regex to match, or are you having issues creating a new indexed field (like host, source, etc)? ... View more

Do you mean like: | timechart span=1w sum(incident_duration) as Weekly_Inc_duration BY AppID ... View more

You're right. I edited my search to use bin and stats instead. That's what I get for trying to type out a search without actually running it like I usually do. Good catch! ... View more

If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open. ... View more

This doesn't look like it would drill down to raw events, rather it would open an external URL based on a single value that was clicked on. ... View more