Hi, I wonder if someone could help me please. I'm creating a scheduled search which will run every day with the following advanced time ranges: Start date = -1d@d Latest date = @d The problem I have is that I want to set the scheduled search to start running on specific date then continue with the schedule. I've been into the "Advanced edit" and changed the "next_scheduled_time" to show the date I'd like it start on i.e. 09 July, but this doesn't change the date when I look at the report in the list. Could anyone perhaps point out where I've gone wrong please? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm trying to create a query which extracts given values using 'spath'. This is what I've come up with so far: | multisearch [ search `cc-frontend_wmf(cCurrentYearIncome)`] [ search `cc-frontend_wmf(pCurrentYearIncome)`] | spath output=claimant path=detail.cCurrentYearIncome | spath output=partner path=detail.pCurrentYearIncome I can create the "claimant" and "partner" fields, but I then need to perform a rename and this is where I have the problem because the fields I need to rename have the same name as shown below. field=claim need to rename currentIncome.employmentIncome as ccurrent field=part need to rename currentIncome.employmentIncome as pcurrent Could someone tell me please is there a way to differentiate the two fields ie. is there a way to rename when I create the spath? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone could help me please. I have the following string, which I'm trying to extract the last 12 characters i.e. A1B-CDEFB-NOT claim-a-token|N5Y-UWLB-NOT I've tried using the following regex /|(?[^\s]+) but unfortunately it extracts the whole string and not just the last 12 characters, and I'm a little unclear why. Could someone perhaps look at this please and offer some guidance on where I've gone wrong. Many thanks Chris ... View more

Hi, I wonder whether someone could help me please. I'm trying to run a search, compare it against fields in a lookup table and then append any non matching values to the table. This is the query I have so far: index="dg_*" | fieldsummary | rename field AS DataField | fields DataField | inputlookup fieldlist2.csv DataField OUTPUT DataField AS exists | where isnull(exists) | fields - exists | fields DataField | outputlookup append=t fieldlist2.csv The problem I have is that when I run the query I receive the following error: Error in 'inputlookup' command: Invalid argument: 'DataField' I just wondered whether someone could look at this please and let me know where I've gone wrong? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone could help me please. The Splunk environment I administer contains sensitive personal data which only those with the relevant clearance can view. To add an extra line of security, my security team have asked me to remove the 'export' function so these personal details can't be downloaded, that is, until the relevant clearance is provided. I can make the changes via the 'authorize.conf' file to the user role, setting the 'export_is_visible' in the 'Parent' role to disabled and then a 'child' role which enables the capability. The problem I have is: I want to restrict this via app, rather than a 'global ' restriction, because in addition to apps with dashboards containing sensitive data, they have access to apps with dashboards which have pure statistical data. In addition, I can't change the role associated with the app, because if I change this, everyone who can just view the statistical dashboards and hence can download the data will also be affected. Could someone tell me please is there another way to achieve this? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone could help me please. I'm trying to create a dynamic drop down where the values of the 'user' drop down menu will be dependent on the time range selected. This is the code I've put together: <form> <label>Analysis of Splunk users activity</label> <fieldset submitButton="false"> <input searchWhenChanged="true" token="timerange" type="time"> <label>Time range:</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="user"> <label>field1</label> <search> <query>(index=_audit action=search) OR (index=_internal) between $timerange.earliest$ and $timerange.latest$ | dedup user | stats count by user | fields user | sort +user</query> </search> <fieldForLabel>user</fieldForLabel> <fieldForValue>user</fieldForValue> <choice value="*">All</choice> </input> </fieldset> </form> But I can't get the drop down menu to populate with the correct users. I just wondered whether someone could look at this please and offer some guidance on how I may go about achieving this and where I've gone wrong? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I've tried for a few days to find a solution online bus so far I've been unsuccessful, but could someone tell me please, is there a query which I could to see who has exported Splunk data? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm using the query below which extracts a column of fields associated with the index and auditSource: (index=main) OR (index=dg_<indexname>) auditSource=<fieldvalue> | fieldsummary | where like(field, "detail.%") | fields field | rename field as data I'm trying to change this so the row values become the 'column' headers. I've tried using the 'transpose' command (below and also the 'chart over', but I can get neither to work (index=main) OR (index=dg_tax-credits-submissions) auditSource=tax-credits-submissions | fieldsummary | where like(field, "detail.%") | fields field | rename field as data | transpose 0 header_field=data I just wondered whether someone may be able to look at this please and let me know where I've gone wrong. Many thanks and kind regards Chris ... View more