HI, I wonder whether someone may be able to help me please. I'm trying to put together a query which looks for two specific patterns of auditSource and auditType for given "SessionID". I've put together the query below but it is slow to run and suffers from the data row limit, so is not returning all of the events. index=main auditSource=auth-frontend auditType=Login | rename tags.X-Session-ID as sessionID | join sessionID [search index=main auditSource=per-frontend auditType=RequestReceived | rename tags.X-Session-ID as sessionID | table sessionID] | stats dc(detail.User) In know from help already received and form research I've undertaken that you can use the 'Stats' command in the place of Join, but despite spending quite sometime on this now, I'm unable to get this to work. I just wondered whether someone may be able to look at this please and offer some guidance on how I may overcome this. Many thanks and kind regards Chris ... View more

Hi, I wonder whether you may be able to help me please. Through the use of 'Roles' and 'Permissions' I'm able to restrict whether a user can view the 'search bar' and hence create their own searches, reports and dashboards, but a number of users have a found a'back door' by using the 'Create Dashboard' button so they can create their own dashboards. Could someone tell me please, is there a way to remove the 'Create Dashboard' button for as given role. Many thanks and kind Regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. As an administrator, I am looking to provide functionality for users so they can create their own apps. However, I do not want to give them 'Admin' access. Could someone tell me please, is there a way that I may be able to do this? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I have the following two searches: index=main auditSource="agent-f" auditType=ServiceSentResponse detail.referrer="*deletion*" "detail.Location"="/agent/verification-list" |rex field="tags.X-Session-ID" "session\-(?<SessionID>[\S]+)" |stats count(SessionID) as "Number of Clients Deleted" by SessionID And index=main auditSource="agent-p" auditType=MetricGetClientListTotal | rex field="tags.X-Session-ID" "session\-(?<SessionID>[\S]+)" | stats count by SessionID detail.agent-code What I'm trying to do is join them using the SessionID, and then create a table at the end which displays the fields detail.agent-code and Number of Clients Deleted. I have used join before, but never where regex events have had to be written i.e using 'explicit' rather than 'implicit' events. I just wonder whether someone may be able to look at this please and offer some guidance on how I may be able to do this. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm using the search below to extract a field call MatchID index=main auditSource=authenticator auditType=ServiceReceivedRequest detail.input="Request to /authenticator/verify" | rex field="detail.requestBody" "matchId\":\"(?<MatchID>[^\"]+)" | table MatchID Could you tell me please how I would search for a specific MatchID. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. Through the 'Save as Alert' process I have created a report which I want to run at a given time and email the results. The problem I have is that I am not receiving the email containing the results. I have only just taken over the 'admin' role within Splunk, so it's a 'steep learning curve' at the moment, but I'm told my predecessor disabled the email functionality because from a security aspect, they didn't want people to be able to email 'Raw Data'. I have looked at the Splunk documentation and I think I've followed the 'Alert' process correctly, but could someone tell me please: How do I re-enable the email functionality Is it possible to limit the type of information that can be emailed, i.e. non Raw Event information. Any help would be gratefully received. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm trying to implement functionality on one of my dashboard panels which allows the user to select the 'refresh'. I ran a search and found a post here and so implemented the code as below: <panel> <input type="dropdown" token="refresh_interval" searchWhenChanged="true"> <label>Panel Refresh Override</label> <choice value="60">1 Minute</choice> <choice value="180">3 Minutes</choice> <choice value="300">5 Minutes</choice> <default>300</default> </input> <table> <title>Partially Completed Submissions With Expiry Date of......</title> <search> <query>index=main auditSource=for-frontend auditType=FormSaved | rename generatedAt As "submissiondate" | eval submissiondate=strptime(submissiondate, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y" ctime(submissiondate) | eval testtime=relative_time(now(), "-1d@d" ) | eval c_time=strftime(testtime,"%d/%b/%Y") | where c_time=submissiondate | head 1 | search NOT[search index=main auditSource=for-frontend auditType=FormSubmission | table detail.referenceNumber] | rename detail.referenceNumber As "refno" | rename detail.name As "fullname" | rename detail.90DayExpirationDate As "expirydate" | eval expirydate=strptime(expirydate, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y" ctime(expirydate) | eval Full_Details= "Ref No: ".refno.", Fullname: ".fullname.", Date of submission: ".submissiondate.", Expiry Date: ".expirydate | makemv delim=", " Full_Details | table Full_Details</query> <earliest>0</earliest> <latest></latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="drilldown">cell</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> <option name="refresh.auto.interval">$refresh_interval$</option> </table> </panel> The problem is, no matter the selection made on the drop-down menu, the panel does not refresh. I just wonder whether someone could look at this please and let me know where I've gone wrong. Many thanks and kind regards Chris ... View more