CIDR matching is defined in transforms.conf per lookup. http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf match_type = <string> * A comma and space-delimited list of <match_type>(<field_name>) specification to allow for non-exact matching * The available match_type values are WILDCARD, CIDR, and EXACT. EXACT is the default and does not need to be specified. Only fields that should use WILDCARD or CIDR matching should be specified in this list In your case you probably want something like this in your transforms.conf: [cidrs] filename = cidrs.csv match_type = CIDR(range1), CIDR(range2) ... View more

Oops, my previous search was garbage based on what you were looking for. Check out the edited version to see if it's better. ... View more

You're looking for a custom search command, it seems. The scope of implementing one can be large (or not so large), but you probably want to start here: http://dev.splunk.com/view/python-sdk/SP-CAAAEU2 ... View more

You can't use XML to define earliest/latest to use in a post-process search, but you could do this in the search string defined in the post-process search: <post-process search string> | eval post_earliest=relative_time(now(), "-4h") | where _time>=post_earliest Edited because the previous version was nonsense. ... View more

I think you should find a way to avoid using map . Not fully understanding what you're looking for, but trying to accomplish similar results I expect your search to yield, this may be a step towards what you're looking for: index=index sourcetype=sourcetype NOT (ip="ip address" OR ip="ip address" OR ip="ip address") NOT (policy="policy1" AND status="Match") | fillnull value="N/A" mac | stats values(status) as status, values(rule) as rule, values(policy) as policy, values(evalfield) as evalfield, count by ip, mac | search policy="policy1" rule="rule1" ... View more

| makeresults | eval alwayspresent="alreadyhere" | fillnull value="nolongernull" wasnull | map search="| makeresults | eval stillpresent=\"$alwayspresent$\", wasnullpassedthrough=\"$wasnull$\"" This should show that the fillnull values make it through to the map command, but there is likely a better search to meet your needs. Your search has index=index sourcetype=sourcetype in both the main search string and the map search string. Do both searches use the same index and sourcetype, or is the map search looking at different data? ... View more

I'm not sure what you mean when you say 'join ip _address filed in index=logs'. ... View more

Try: | where field2=field1 match uses regex, not values from other fields, but where will compare two fields. ... View more

You would have to do multiple lookups to accomplish this. The first would be against range1 | lookup cidrs.csv range1 AS ip_address then another to lookup for range2 | lookup cidrs.csv range2 AS ip_address . Doing successive lookups may end up overwriting previously looked up fields, though, so you should look into the OUTPUT and OUTPUTNEW options and choose the one that best helps you solve your problem. When using the lookup command, if an OUTPUT or OUTPUTNEW clause is not specified, all of the fields in the lookup table that are not the match field are used as output fields. If the OUTPUT clause is specified, the output lookup fields overwrite existing fields. If the OUTPUTNEW clause is specified, the lookup is not performed for events in which the output fields already exist. ... View more

| fillnull value="N/A" mac should do what you're looking for, which you already tested. Can you run the search with that in place, but exclude the map and everything after it, and see what the results for that look like? index=index sourcetype=sourcetype policy="policy1" rule="rule1" | dedup ip | search NOT (ip="ip address" OR ip="ip address" OR ip="ip address") | fillnull value="N/A" mac ... View more

Try cont=false in timechart: base search | eval earliest_time = if(len(replace("-4h@h","\d",""))=0,"-4h@h",relative_time(now(),"-4h@h")) | eval latest_time = if(len(replace("now","\d",""))=0,"now",now()) | eval _time = if(_time <= earliest_time,earliest_time,_time) | eval StartEpoc = if(StartEpoc <= earliest_time,earliest_time,StartEpoc) | eval EndEpoc = if(EndEpoc >= latest_time,latest_time,EndEpoc) | where EndEpoc >= StartEpoc | eval Duration = EndEpoc - StartEpoc | eval 1=1 | timechart bins=2000 max(Duration) BY Activity cont Syntax: cont=<bool> Description: Specifies whether the chart is continuous or not. If set to true, the Search application fills in the time gaps. Default: true ... View more

If the events (missing and present) appear to use the same fields I think you should be good in that regard. Are there missing and present events on the same indexer(s)? Or are the missing ones on different splunk_servers than the present ones? You may also try scheduling an identical search to run for the same time period that you're seeing the issue and see if it always exhibits the same behavior, or if it really does appear to be randomly changing. ... View more

Is the search potentially relying on any extractions that your have available to you but the app running the search does not? You may want to double check where the fields are defined that your search needs to make use of. ... View more

index=_internal source="*/license_usage.log" component=LicenseUsage idx=<your index> | timechart sum(b) AS b BY st In the license usage events idx is the index and st is the sourcetype that the licensing metrics are detailing. ... View more

Do you know that the line with Phonecall defined always immediately precedes the line with cli ? If so you may be able to use: | streamstats window=2 current=t last(cli) AS lastcli | transaction lastcli startswith="Status: Ringing" endswith="Reason: Done" ... View more

It seems likely that your forwarder isn't talking to the deployment server you're expecting. Please verify your forwarder's deployment client configuration by running ./splunk show deploy-poll on the forwarder. And just to be sure, you checked the list of clients by going to Settings -> Forwarder Management on the deployment server , correct? ... View more

This would likely not be a great search if there are a lot of events that meet your criteria (mvexpand can be a memory hog), but this may work well enough for your use case: <your base search> | where field2==field1 | streamstats count AS row | mvexpand field2 | eval matches=if(field2==field1, field1, dummy) | stats list(field2) AS field2, values(field1) AS field1, list(matches) AS matches BY row | table field1 field2 matches ... View more

You definitely can, and the key to that is passing your sessionKey to your custom search command so that it can pass said key back to the Splunk REST API. This answers post lays out the major components you're looking for: https://answers.splunk.com/answers/434017/how-to-get-session-key-in-a-search-script-script-s.html ... View more

Try: | tstats latest(_time) as Last by index | eval one_hour_ago=relative_time(now(), "-1h") | where Last<one_hour_ago | eval Last=strftime(Last,"%H:%M:%S") ... View more

If you're only looking for a single healthCheckUrl this is likely pretty simple, and what you have above should be fine. If you wanted to abstract it out to multiple ns or healthCheckUrl values it would be more involved. ... View more