Hi, I wonder whether someone could help me please. I have a number of teams who have Splunk apps which contain the 'search' functionality, with each app allocated it's own role which in turn, we assign to users. I'm now wanting to allocate the roles to specific indexes for the purpose of increased efficiency and security which I'm comfortable and able to do. I'm told, that although the 'search' function is a link within the app, I'm not able to restrict the indexes via the role to prevent users being able to search indexes not pertinent to the user. Could someone please confirm for me whether this is correct or not? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone could help me please. I'm trying to create a Splunk regular expression to extract the postcode from the sample as shown below. {"line1":"1 THE STREET","line2":"TOWN","line3":"CITY","line4":null,"postcode":"AB1 1AB","country":"GREAT BRITAIN","startDate":944697600000,"type":"Residential"} I'm using Regex101 and in this I can create the following which extracts the data: \"postcode\"\:\"(?[^\.]{0,7})\" However, when I run this in Splunk, it doesn't extract the data. I think it may have something to do with the space between the two elements of the postcode, but could someone please look at this and let me know where I've gone wrong. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm using the following subqueries: The first extracts a list of macros that have been created. | rest /servicesNS/-/-/admin/macros count=0 splunk_server=local | where isnull(args) | where like(definition, "%index=dg_%") | rex field=definition "auditSource\=(?<source>[^\s]+)\)" | rex field=title "(?<indexorig>[^\s]+)_" | eval index="dg_" .indexorig | fields source index The second provides me with a list of indexes that have been created. | eventcount summarize=false index="dg_*" | dedup index | fields index What I'm trying to do is create a query which joins via the "index" fields, but produces a list of 'sources' in the first column (first subquery), and then 'indexes' in the second (second subquery. Comparing the two, I'm expecting gaps in the index column. I've tries using the 'append, 'join', 'appendcols' commands, but so far I've been unable to get this to work. I just wondered whether someone could look at this please and offer some guidance on how I may achieve this. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. Could someone tell me please, is it possible to create a query which produces a list of all the 'search macros'. I've tried to find the correct settings using a REST query, but I'm not sure whether I'm going down the correct path or not. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm running the search below inserting a specific user name. index=_audit NOT "search=' | history" NOT (user=splunk-system-user OR user="monitoring" OR user="txm.alerts") NOT "search='typeahead" NOT "search=' | metadata type=* | search totalCount>0" | eval Status=if(like(_raw, "%export%"), 1, 0) | where Status=1 | search user="name" | table user, search The search runs but because the user has exported data from a dashboard panel, the result for the search are returned as follows: > REST: > /search/jobs/_c3RlcGiZW5u_c3lbi5iZW5u_c3BsZXh0cmFjdC1hcHA__search9_147626.3699/results/export][n/a] Could someone tell me please, is there a way to actually see the search for the dashboard panel? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. Could someone possibly tell me whether it's possible to build a lookup table from the results of an "Accelerated Report"? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm using the following query to create a table in my dashboard: index=main auditSource=frontend auditType=ExitSurvey detail.manageList!="None" | append [ search index=main "\"auditSource\":\"agent-frontend\"" "\auditType\":\"ExitSurvey\"" manageList NOT auditSource=* | spath | search auditType=ExitSurvey detail.manageList!="None"] | replace /agent/survey With "Manage List" | contingency tags.path detail.manageList | append [search index=main auditSource=agent-frontend auditType=ExitSurvey detail.viewPayments!="None" | append [ search index=main "\"auditSource\":\"agent-frontend\"" "\auditType\":\"ExitSurvey\"" viewPayments NOT auditSource=* | spath | search auditType=ExitSurvey detail.viewPayments!="None"] | replace /agent/survey With "View Payments" | contingency tags.path detail.viewPayments ] | search tags.path!="TOTAL" | rename tags.path TO "Question" | fields Question, 1, 2, 3, 4, 5 | addtotals label=Total | rename 1 TO "Very Dissatisfied", 2 TO "Dissatisifed", 3 TO "Neither", 4 TO "Satisfied", 5 TO "Very Satisfied" The query works, but I'm now coming up against the problem of the 50,000 row limit because of the 'append' command. I'm now looking to change this and incorporate the 'multisearch' command instead of the 'append'. I can get so far a show below, | multisearch [ search index=main auditSource=agent-frontend auditType=ExitSurvey detail.manageList!="None" | replace /agent/survey With "Manage List"] [ search index=main "\"auditSource\":\"agent-frontend\"" "\auditType\":\"ExitSurvey\"" manageList NOT auditSource=* | spath | search auditType=ExitSurvey detail.manageList!="None"] [ search index=main auditSource=agent-frontend auditType=ExitSurvey detail.viewPayments!="None" | replace /agent/survey With "View Payments"] [ search index=main "\"auditSource\":\"agent-frontend\"" "\auditType\":\"ExitSurvey\"" viewPayments NOT auditSource=* | spath | search auditType=ExitSurvey detail.viewPayments!="None"] | contingency tags.path detail.manageList | contingency tags.path detail.viewPayments | search tags.path!="TOTAL" | rename tags.path TO "Question" | fields Question, 1, 2, 3, 4, 5 | addtotals label=Total | rename 1 TO "Very Dissatisfied", 2 TO "Dissatisifed", 3 TO "Neither", 4 TO "Satisfied", 5 TO "Very Satisfied" but the problem I have is with these rows: | replace..... | contingency.... I just wondered whether someone could possible look at this please and offer some guidance on how I may be able to accomplish this. Many thanks and kind regards Chris ... View more