I wonder if it could be as simple as missing a space after the OR on line 15. ... View more

I have no experience with that specific app, but most apps use configuration mechanisms that will find their configurations no matter which app they reside in, which means this specific app may find values in etc/apps/worday/local/api.conf and etc/apps/workday2/local/api.conf and merge the configurations. What you will probably need to do is install the app on two separate splunk instances that each send their outputs to your indexers. ... View more

When you create your client connection, pass your app path in the app parameter. For example: s = client.connect(username="boris", password="natasha", app="yourapp") ... View more

I should have used a timestamp in my example instead of something already in HH:MM:SS format. Are $clicked_earliest$ and $clicked_latest$ already in unix timestamp format? ... View more

Try this: <drilldown> <set token="clicked_earliest">$earliest$</set> <set token="clicked_latest">$latest$</set> <eval token="hetime">strftime("$clicked_earliest$", "%H:%M:%S")</eval> <eval token="hltime">strftime("$clicked_latest$", "%H:%M:%S")</eval> </drilldown> $token_name$ will be inserted literally into your query, so the eval ended up looking like: strftime(1234567890, "%H:%M:%S") instead of strftime("1234567890", "%H:%M:%S") In the former, stftime is looking for a field named 01:23:45 , which isn't going to exist. After editing this to look like actual timestamps, though, stftime should be able to take a timestamp (which is just an integer) without the quotes. ... View more

Specify your selected column names explicitly, like this: | dbxquery connection="<connect>" query="SELECT table1.ID AS table1_ID, table4.NAME AS table4_NAME FROM table1 INNER JOIN table2 ON table1.DEVICE_ID = table2.ID LEFT JOIN table3 ON table2.CLIENT_ID = table3.ID LEFT JOIN table4 ON table3.CLIENTTYPE_ID = table4.ID WHERE table4.NAME = 'ABC' OR table4.NAME = 'DEF'" I just tried this and it resulted in this output: ... View more

Are you going to assume that every IP address belongs to a /24 network? That's not always a valid assumption. ... View more

Can you include your search strings for both the working and non-working searches? ... View more

If you're creating a new lookup file, you need to POST to https://localhost:8089/servicesNS/nobody/SA-cve/data/lookup-table-files and include name in your data. You POST to https://localhost:8089/servicesNS/nobody/SA-cve/data/lookup-table-files/<name>; if you're replacing an existing lookup file. Try POSTing to https://localhost:8089/servicesNS/nobody/SA-cve/data/lookup-table-files and see if that helps. ... View more

The datamodels haven't been summarized, likely due to not having matched events to summarize, so searching with summariesonly=true is expected to return zero results. Have you tried searching the data without summariesonly=true or via datamodel <datamodel name> search to see if it seems like the datamodel actually finds any data? ... View more

You'll need to include more information if you want help with a query. Things like what your events look like for hours, costs, profits, etc., and how you would like them aggregated and calculated. ... View more

Check to see if you have the appropriate tag values for the events with the syslog sourcetype. As long as those are correct, the CIM should be just fine with that data. The CIM doesn't (by default) care about sourcetypes. ... View more

I can't see how the changes you implemented could have resulted in missing data. As for the rex warning, rex needs named capture groups ( (?<name>...) ), but index-time transforms can't use named capture groups, instead using numbered (which are automatically numbered when using parentheses in the regex). After making this change, was new data indexed for you to search on? ... View more

Can you format the code using the code button (the 101010 icon) so that it's easier to read? ... View more

On lines 32 and 41 you're issuing GET requests but did not include the authorization header like you did on line 23. ... View more

| eval seconds_since_open_date=now()-strptime(OPEN_DATE, "%m%d%Y"), days_since_open_date=seconds_since_open_date/86400 It looks like you were using strftime (format) instead of strptime (parse), and you also had commas in your format string, but had none in your sample date string. ... View more

It sounds like this comment contained the solution. You might consider converting it to an answer (or editing your answer to include it), so @TDR57 can accept it. ... View more

Assuming you are running the query at search time (versus configuraing an input that periodically runs the SQL and indexes the resutls) I wouldn't expect running a SQL query to return events, I would only expect it to return statistics. The statistics fully represent the results of your query, and you can run aggregations on the statistics just as you can on events. Is there a reason you also want to see something on the events tab? ... View more

Can you paste your full script? It seems you didn't include the section that prints the search result . I wonder if your call to get the search results is lacking the authentication component, either using the same httplib2 object that you added credentials to, or by passing the session ID from a previous request. ... View more

If you can suffuciently craft a search that finds only the event(s) you want to delete, you can pipe the results of that search to the delete command. Note that none of the default roles have the can_delete capability. You would need to either add this capability to a role temporarily, or create a new user/role just for this purpose. ... View more