This may only be a partial answer, but your subsearch needs to be changed. It currently results in a field named values(mdn) , which is unlikely to be in your source data. Also, multivalue fields returned from a subsearch aren't that simple, so try splitting them up via mvexpand: [search sourcetype=abc KPI100 earliest=05/11/2017:00:00:00 lastest=now results=completed.jsp | stats values(mdn) AS mdn | mvexpand mdn] Edit: I'm going to attempt to answer the full question since the partial answer didn't work. I would suggest trying to do this all in one search, going back the full 20 days, and reporting based on all of that data. It might look something like: sourcetype=abc KPI100 earliest=-20d latest=now result=completed.jsp | addinfo | eval twenty_days_ago=relative_time(info_max_time, "-20d@d") | eval was_in_last_twenty_days=if(_time >= twenty_days_ago, 1, 0) | eventstats dc(was_in_last_twenty_days) AS dc_was_in_last_twenty_days, count BY mdn | search dc_was_last_twenty_days>1 This should give you the count for mdn values that were seen in both time periods (-20d -> -10d, -10d -> now). This might not be exactly what you want, but it might be enough to get you going. ... View more

Is Splunk not parsing this out correctly at index time? Does your event timestamp not match the string time in the log? ... View more

It's probably possible to do what you want, but I think you'd be better served changing the inputs in some way to make the end result easier to accomplish. Can you (or do you already) get the hostname as part of the source path? That would allow you to do one transform to determine host and filename to act on. ... View more

Oops, good catch! ... View more

Try something like: <base search> | dedup abc | append [inputlookup abclookup] | stats count BY abc | search count=1 Where abclookup has just one column: abc abcvalue1 abcvalue2 Edited as per correction below. ... View more

Splunk uses GET parameters for all of its forms, so if the user selects what he/she wants, and your time period is defined by relative terms (-1d, etc), I would expect the bookmarked link to pull up what the user expects. ... View more

Though the documentation doesn't state this, I wonder if only works for indexed fields. Try setting it to source and see if that gives any results. If that's the issue, you can use a transform and make use of the SOURCE_KEY directive instead to accomplish what you want. ... View more

If the custom field is set on the intermediate forwarder, I have to assume the intermediate forwarder is a heavy forwarder. If that's the case, it's sending cooked data to your indexer. The indexer won't re-cook data (under normal configuration, and best practice), so changing sourcetype/index/etc won't have any affect. For a potential (against best practice) workaround, see this previous answer: Reparsing cooked data coming from a heavy forwarder. Possible? ... View more

You could certainly create a custom search command to do this, and use an existing Python library to do that specific field calculation. A quick googling suggests the netaddr library may do what you need. Short of some form of custom code (search command, maybe a scripted lookup), I'm not sure you can do that in native SPL. ... View more

You could accomplish the key/value extractions with a REPORT- line in props.conf and matching stanza in transforms.conf: props.conf: [<sourcetype_name>] REPORT-keyvalues = keyvalues transforms.conf: [keyvalues] REGEX = \((?<_KEY_1>[^:]+): (?<_VAL_1>[^)]+)\) MV_ADD = true The regexes above haven't actually been tested, but should at least show the concepts. Note the _KEY_1 and _VAL_1 capture group names. These are special cases detailed in the transforms.conf documentation. ... View more

Try using /servicesNS/<username>/<app path>/data/inputs/ as your endpoint. I haven't tried this for modular inputs, but it worked for adding an index in the search app's indexes.conf, so I'd be willing to bet it will work here as well. ... View more

That's your default index, where events go when no other index was defined. One way to characterize the type of data in it would be: | tstats count WHERE index=main BY sourcetype I'm sure there other methods of reporting to actually determine storage size per sourcetype/source/host/whatever, but this may give you a quick enough answer. ... View more

Check out CLEAN_KEYS in transforms.conf: CLEAN_KEYS = [true|false] * NOTE: This attribute is only valid for search-time field extractions. * Optional. Controls whether Splunk "cleans" the keys (field names) it extracts at search time. "Key cleaning" is the practice of replacing any non-alphanumeric characters (characters other than those falling between the a-z, A-Z, or 0-9 ranges) in field names with underscores, as well as the stripping of leading underscores and 0-9 characters from field names. * Add CLEAN_KEYS = false to your transform if you need to extract field names that include non-alphanumeric characters, or which begin with underscores or 0-9 characters. * Defaults to true. But you will have to use transforms.conf to define your extraction, and use a REPORT- line in props.conf to make use of that functionality. Edit: it appears I mis-read the question. Please disregard, but leaving the content in place in case it helps anyone else. ... View more

martin_mueller posted a way to do this using macros, but I used a custom search command to do variable replacement. Oops, I meant to post this as a comment. This is certainly not an answer. ... View more

You can use >= in your search, assuming you have "value" parsed out into a field already: index=(your index) value >= 2000001 ... View more

You can do this with a lookup, making use of match_type (transforms.conf😞 match_type = <string> * A comma and space-delimited list of <match_type>(<field_name>) specification to allow for non-exact matching * The available match_type values are WILDCARD, CIDR, and EXACT. EXACT is the default and does not need to be specified. Only fields that should use WILDCARD or CIDR matching should be specified in this list You probably want your lookup to look like: Domain,AppName,AppType facebook.com,Facebook,Social Media *.facebook.com,Facebook,Social Media office.com,Office 365,Productivity *.office.com,Office 365,Productivity fbcdn.net,Facebook,Social Media *.fbcdn.net,Facebook,Social Media In order to match facebook.com and www.facebook.com, but not fakefacebook.com. ... View more

I think you should try to do everything in one search if at all possible, and in this case I think it is. Here is an attempt at a similar type of counting: index=_internal | timechart span=1d count | streamstats window=30 current=false sum(count) AS last_30_count | timechart span=1w sum(count) AS week_count first(last_30_count) AS last_30_count ... View more

Dashboards use $ to denote fields requiring input, such as $earliest, $latest, etc. It's probably failing to correctly parse that. Try escaping the dollar signs in your search by doubling them up: match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1", match(RelativeURI,"/identity/enhanced-authentication/tasks$$") AND match (HttpMethod,"POST"), "TASK2", match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3", match(RelativeURI,"/identity/enhanced-authentication/tasks$$") AND match (HttpMethod,"GET"), "TASK4", match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5") ... View more

Try giving it another reboot, since it seems there was a stale pidfile that time. However, even if it starts this time, it doesn't mean things are "ok" with splunk not starting on boot due to a stale pidfile. I haven't ever had issues with the FreeBSD UF starting on boot, but that certainly doesn't mean there aren't bugs. ... View more

rc.conf can be empty, so I'd try creating an empty file first. Note: I'm not suggesting this is valid in OPNsense. Please consider all of this at your own risk. ... View more

Ahhh, well, I can't comment on OPNsense. You can use files in rc.conf.d instead of putting things in rc.conf. It probably won't break things to just create rc.conf and let splunk put its "_enable" line in there. ... View more