Edited to take that into consideration. ... View more

Updated to remove the limitation of just Credit events. index=cap host=prod | rex field=URI "^(?<firstsegment>/[^/]+)/" | stats count BY firstsegment ... View more

This absolutely works, multi-values and all. I suggest converting this to an answer so the poster can accept it. ... View more

The field name that starts with the number 7 needs to be in single quotes: | eval Action=if( (MonitoringStatus="Not Monitored") AND ( like(Path,"%Hosting%") AND Location="Varonis" OR '7DayBackUpStatus'="Not Backed Up" ), "Action Required", "No Action Required") I suggest putting parentheses when you mix AND and OR. I'm not sure what your intent might be, but you may consider one of these variants: | eval Action=if( (MonitoringStatus="Not Monitored") AND ( (like(Path,"%Hosting%") AND Location="Varonis") OR '7DayBackUpStatus'="Not Backed Up" ), "Action Required", "No Action Required") | eval Action=if( (MonitoringStatus="Not Monitored") AND ( like(Path,"%Hosting%") AND (Location="Varonis" OR '7DayBackUpStatus'="Not Backed Up") ), "Action Required", "No Action Required") ... View more

See if this recent question helps. In that case it ended up being due to site affinity, with events not being searchable by the search head until the buckets were replicated to the local indexer site. ... View more

For 1): It seems that you have events with both multivalue fields: segment_provider_id and segment_status . What's happening when you search for segment_provider_id=<value> is you probably get some results with segment_provider_id values that aren't what you searched for. There is no internal relationship between the first value of segment_provider_id and the first value of segment_status . If these fields are the same length, and value1 of one is associated with value1 of the other, you may need to make use of mvzip to create a new field that looks like: abc.com:SUCCEEDED , then perform additional logic against that field, perhaps something like: | table mvzipfield | mvexpand mvzipfield | rex field=mvzipfield "(?<segment_provider_id>[^:]+):(?<segment_status>.*)" | search segment_provider_id=abc.com | stats count Having events with multiple multi-value fields that are expected to relate to each other is certainly less than optimal, but sometimes can't be avoided. And it should be stated that mvexpand can be a bad idea when there are a lot of events and/or a lot of field combinations (which is why my example uses | table <one field only> prior to calling mvexpand). ... View more

Splunk enables this type of behavior with the _KEY_1 and _VAL_1 syntax: in transforms.conf: [colon_comma_separated] REGEX = (?<_KEY_1>[^:]+):(?<_VAL_1>[^,]+) in props.conf: [<sourcetype>] REPORT-colon_comma_separated From the transforms.conf doc: * If the REGEX extracts both the field name and its corresponding field value, you can use the following special capturing groups if you want to skip specifying the mapping in FORMAT: _KEY_<string>, _VAL_<string>. * For example, the following are equivalent: * Using FORMAT: * REGEX = ([a-z]+)=([a-z]+) * FORMAT = $1::$2 * Without using FORMAT * REGEX = (?<_KEY_1>[a-z]+)=(?<_VAL_1>[a-z]+) * When using either of the above formats, in a search-time extraction, the regex will continue to match against the source text, extracting as many fields as can be identified in the source text. ... View more

Now with ProductName=1093 goodness: transforms.conf: [kasperskycefcomponents] REGEX = ^CEF:(?<cef_cefVersion>[^|]+)\|(?<cef_vendor>[^|]+)\|(?<cef_product>[^|]+)\|(?<cef_version>[^|]+)\|(?<cef_signature>[^|]+)\|(?<cef_name>[^|]+)\|(?<cef_severity>[^|]+)\|(?<ceffields>.*)$ [kasperskyceffields] SOURCE_KEY = ceffields REGEX = (?<_KEY_1>[^ |=]+)=(?<_VAL_1>[^=]+)( |$) [kasperskeyceffields_combined] SOURCE_KEY = ceffields REGEX = ([^ |=]+)=(?<_VAL_1>[^=]+) (\1Label)=(?<_KEY_1>[^=]+)( |$) props.conf: [<sourcetype>] SHOULD_LINEMERGE = false KV_MODE = none REPORT-kasperskycef = kasperskycefcomponents,kasperskyceffields,kasperskeyceffields_combined In action: And with random spaces thrown into the values/Labels: ... View more

Ahhhh, I misunderstood your requirements. Thanks for taking the time to reply! ... View more

Splunk appears to automatically extract these fields, as they are Key=Value. Does your sourcetype set KV_MODE = none ? ... View more

I'm not sure your search in the example makes sense as-is, but perhaps that's due to it being altered for the question. Assuming it's valid, and you want to only include hours after 9am, try this: <your search> date_hour>=9 | dedup IDEVENT | timechart SPAN=1H COUNT AS IDEVENT | rename IDEVENT AS " PALLET QUANTITY" Splunk parses out the timestamp components (date_month, date_mday, date_hour, etc) for each event, so these fields are available to be a part of your base search. ... View more

If you have tested this method and it works, please accept the answer so that others may more quickly find the solution. If not, please disregard this comment. 🙂 ... View more

Just so I'm not coming across the wrong way, I'm not telling you what to do. 🙂 I just want to make sure it's understood that the limits are in place for a reason, and simply increasing them is likely not a long term solution to the problem at hand. ... View more

Yes, your issue was due to a settings defined in limits.conf, but increasing that value only serves to mask the true root cause, which is that your base search did not use a transforming command. Consider this advice from Splunk's documentation: Best practices Use these best practices to make sure that post-process searches work as expected. Use a transforming base search A base search should be a transforming search that returns results formatted as a statistics table. Non-transforming base search issues Non-transforming base searches can cause the following search result and timeout issues. If you observe these issues in a dashboard, check the base search to make sure that it is a transforming search. Event retention If the base search is a non-transforming search, the Splunk platform retains only the first 500,000 events that it returns. A post-process search does not process events in excess of this 500,000 event limit, silently ignoring them. This can generate incomplete data for the post-process search. This search result retention limit matches the max_count setting in limits.conf. The setting defaults to 500,000. Client timeout If the post-processing operation takes too long, it can exceed the Splunk Web client timeout value of 30 seconds. For more information about transforming searches, see transforming commands and searches in the Search Manual. Avoid referencing fields only in post-process searches In post-process searches, reference fields that are also referenced in the base search. If you are not referencing a particular field in the base search, do not reference it in the post-process search. Fields without a reference in the base search appear null in a post-process search. The post-process search returns no results in this case. Limit base search results and post-process complexity Passing a large number of search results to a post-process search can cause server timeout issues. In this scenario, consider adjusting the base search to reduce the number of results and fields that it returns. You can also consider reducing the complexity of post-process operations on the base search results. ... View more

I’ve seen the same behavior. Wildcards don’t appear to work, but lists do. ... View more

It's also worth noting that datamodel feeds can't contain pipes, so your search above can't be used with datamodels. ... View more

Which datamodel is the field policyRoutes defined in? ... View more

I'm not saying what you want to do is wrong, but it's not inline with working with datamodels. Datamodels, by definition, are a predefined and finite set of fields. ... View more

This recent answers post may help you. It contains a nice detailed example of searching IP address indicators from a lookup file. ... View more

I think you could accomplish this more easily without concatenating the drive and machine name, and without the join. Consider something like: (index=windows host=*nas* source=WMI:Shares) OR (source="otl_varonis_monitoring.csv" host="opspksh01d.options-it.com" sourcetype="csv" type=Production) | eval machine=if(source="WMI:Shares", lower(host), machine) | eval drive=if(source="WMI:Shares", Path, drive) | stats values(source) AS sources BY machine drive | eval MonitoringStatus=if(match(sources, "otl_varonis_monitoring.csv"), "Monitored", "Not Monitored") As a run anywhere example: | makeresults | eval host="host1", Path="a", source="WMI:Shares" | append [|makeresults | eval host="host1", Path="b", source="WMI:Shares"] | append [|makeresults | eval host="host1", Path="c", source="WMI:Shares"] | append [|makeresults | eval host="host2", Path="a", source="WMI:Shares"] | append [|makeresults | eval machine="host1", drive="a", source="otl_varonis_monitoring.csv"] | append [|makeresults | eval machine="host1", drive="b", source="otl_varonis_monitoring.csv"] | append [|makeresults | eval machine="host2", drive="a", source="otl_varonis_monitoring.csv"] | eval machine=if(source="WMI:Shares", lower(host), machine) | eval drive=if(source="WMI:Shares", Path, drive) | stats values(source) AS sources BY machine drive | eval MonitoringStatus=if(match(sources, "otl_varonis_monitoring.csv"), "Monitored", "Not Monitored") ... View more