I certainly don't understand what your data looks like, which may be impacting my ability to come up with a solution. A run-anywhere example of the concept is: index=_internal date_hour>=9 | timechart span=1h count AS IDEVENT | rename IDEVENT AS "PALLET QUANTITY" ... View more

What was the search you ran? I'm assuming you substituted where I indicated <search> ? ... View more

From the other question you posted about this: <your search> date_hour>=9 | timechart span=1h count Splunk parses out the timestamp components (date_month, date_mday, date_hour, etc) for each event, so these fields are available to be a part of your base search. Or if you want the total count per day: <your search> date_hour>=9 | timechart span=1d count ... View more

Try: index=web (sourcetype=a OR sourcetype=b) [search index=web sourcetype=a apage=MAINPAGE | stats values(aIP) AS aIP | eval search="aIP=".mvjoin(aIP, " OR aIP=")." OR bIP=".mvjoin(aIP, " OR bIP=")] When a subsearch returns a field named search , that field's value will be dropped inline into your search. This results in a search that looks like: index=web (sourcetype=a OR sourcetype=b) aIP=1.2.3.4 OR aIP=4.3.2.1 OR bIP=1.2.3.4 OR bIP=4.3.2.1 Or maybe: index=web [search index=web sourcetype=a apage=MAINPAGE | stats values(aIP) AS aIP | eval search="(sourcetype=a (aIP=".mvjoin(aIP, " OR aIP=").")) OR (sourcetype=b (bIP=".mvjoin(aIP, " OR bIP=")."))"] Which results in a search like: index=web (sourcetype=a (aIP=1.2.3.4 OR aIP=4.3.2.1)) OR (sourcetype=b (bIP=1.2.3.4 OR bIP=4.3.2.1)) Which might be a tad more efficient. ... View more

That configuration tells Splunk where to send the data (in this case by syslog to my.destination.com). That is uninvolved in the parsing of the data. Can you include props.conf (from the search head, not the forwarder) for the sourcetype in question? ... View more

REGEX = . isn't capturing names at all. It's not capturing anything, and it matches anything. I think you're looking at the wrong transform. ... View more

I'm not seeing any glaring issues in your search. Is your search time the same? What method of verification did you use to assert that the value should be different than what is shown? ... View more

Can you find any events that should have been tagged as pan:config ? This search might help: index=pan_logs | rex "^[^,]+,[^,]+,[^,]+,(?<palo_config>CONFIG)," | search palo_config=* ... View more

Looking at the contents of TA-meraki, I don't see anything that should have extracted that field in that way. Can you paste your search string that gave those results? ... View more

Which sourcetype is set in inputs.conf ? The Palo Alto TA expects events to come in initially as pan:log , and then it adjusts the sourcetype to be more specific per event. I'm just hoping to validate that's what's actually happening. ... View more

transforms.conf: [pipe_key_equals_value] REGEX = (?<_KEY_1>[^|=]+)=(?<_VAL_1>[^|]+) props.conf: [<sourcetype>] REPORT-pipe_key_equals_value = pipe_key_equals_value To see this in action: https://regex101.com/r/otQuZ6/1 Note: When _KEY_1 and _VAL_1 are used, splunk will use the value of _KEY_1 as the field name, and the value of _VAL_1 as the value of that field. ... View more

This document is regarding streamfwd, but it details the default configuration of the universal forwarder's default output thruput limit, and how it can be tuned: By default, the Splunk universal forwarder sends a maximum of 256 Kbps of data to indexers. Depending on your streamfwd configuration, your deployment might generate more data than this. To modify or remove the default universal forwarder limit: 1. Edit $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/local/limits.conf. 2. Modify the [thruput] stanza. For example: [thruput] maxKBps = 0 ... View more

[search <your search that creates start/end fields> | rename start AS earliest, end AS latest | table earliest latest] <your new search> As a run-anywhere example: [| makeresults | eval start=relative_time(now(), "-10min"), end=relative_time(now(), "-5min") | rename start AS earliest, end AS latest | table earliest latest] index=_internal Note the run-anywhere example doesn't have search in the subsearch (between the [] ). This is because makeresults is a generating command. I'm assuming your initial search that calculates start/end will use an indexed search, and the search command that would be assumed in your main search string must be explicitly included inside a subsearch. ... View more

I think you just need to not filter for just the Credit events. I've updated my answer to reflect this. ... View more

If you know that your message field is followed by the uniquely_named_field field, you could do: message="(.*)", uniquely_named_field= ... View more

The class name of the transforms setting should not matter. ... View more

Does your input set sourcetype=pan:traffic , or does it set sourcetype=pan:log , which is then changed to pan:traffic via a TRANSFORM in the Palo Alto TA? I'm guessing the latter, which means that the transforms you define for the pan:traffic sourcetype will not be run. When an event traverses is indexed it will do so for the sourcetype defined when it enters the indexing queue, and changing the sourcetype via a transform will not result in the new sourcetype's transforms being run. ... View more

When you run your search that returns no results, open up the search.log (Job -> Inspect Job -> click search.log link) and look for a line that displays the expanded search that was run. When I ran it, for instance, I see this in my search.log: 01-06-2018 02:19:54.063 INFO UnifiedSearch - Expanded index search = (EventCode=4781 (Old_Account_Name="*\\Group1" OR Old_Account_Name="*\\Group2" OR Old_Account_Name="*\\Group3")) ... View more

I can't see any flaws in your search, and I just tested created test data and lookup file to match your question and it works exactly as you have it in your question. Can you check "silly" things like your time period for the search that works and the search that doesn't? I'm also assuming your Groups.csv file isn't exactly what you have included in the question (due to privacy reasons). If the CSV file has more than one field in it you would need to limit the output of your subsearch to just the field you care about, like: (EventCode=4781) [inputlookup Groups.csv | rename Security_ID AS Old_Account_Name | table Old_Account_Name] ... View more

Are your events being properly divvied up to the other sourcetypes ( pan:threat , pan:traffic , etc)? What are the results of: | tstats values(sourcetype) WHERE index=pan_logs ... View more

I've updated my answer to also take into consideration two alternate searches (grouped AND/OR with parentheses to make it more clear) that may correct your logic issue as well. ... View more