Hi, I wonder whether someone may be able to help me please. I have two saved searches as below: Form Submission index=main auditSource=for-frontend auditType=FormSubmission detail.referenceNumber="$refno$" | append [search index=main "\" auditSource\":\"for-frontend\"" "\"auditType\":\"FormSubmission\"" NOT auditSource=* | spath | search "auditType"="FormSubmission"] | eval stime=strptime('detail.submitted', "%Y-%m-%dT%H:%M:%S.%3N") | convert timeformat="%d/%b/%Y %H:%M:%S" ctime(stime) | rename stime as "Submission Date & Time", auditType as "Audit Type", detail.referenceNumber as "Ref No." | table "Submission Date & Time", "Ref No.", "Audit Type" and Request Received index=main auditSource=for-hod-adapter auditType=RequestReceived | append [search index=main "\" auditSource\":\"for-hod-adapter\"" "\"auditType\":\"RequestReceived\"" NOT auditSource=* | spath | search "auditType"="RequestReceived"] | eval refno=substr('detail.referenceNumber',1,7) | rex field=detail.input "\/(?<refno>\d+)$" | rex field=detail.input "for\/(?<refnopt1>[^\/]+)\/(?<refnopt2>[^\/]+)\/" | STRCAT refnopt1 refnopt2 compref | eval referencenumber=coalesce(refno, compref) | search referencenumber="$refno$" | eval stime=strptime(generatedAt, "%Y-%m-%dT%H:%M:%S.%3N") | convert timeformat="%d/%b/%Y %H:%M:%S" ctime(stime) | rename stime as "Submission Date & Time", auditType as "Audit Type", detail.responseMessage as "Reason for Failure", referencenumber as "Ref No." | table "Submission Date & Time", "Ref No.", "Audit Type", "Reason for Failure" | sort +"Submission Date & Time" NB. The ="$refno$" rows. This so I can link this to a token on my dashboard. Both of these saved searches have a start date of 01/01/16 and an end date of "now", i.e. current date The dashboard that they run in contains an input box (hence the token) and a 'timepicker'. Independently they run fine irrespective of the timerange selected in the 'timepicker'. In a final panel, I pull both saved searches together using the following search: | savedsearch "Form Submission" refno="$refno$"] | append [| savedsearch "Request Received" refno="$refno$"] | fields "Submission Date & Time", "Ref No.", "Audit Type", "Submission ID", "Message Received", "Satisfaction Rating", "Feedback Comments", "Error Message", "Reason for Failure" | sort +"Submission Date & Time" This is where I have the issue: If I select the 'timepicker' range on my dashboard from 01 March to Current Date all of the expected results are returned. If I select the 'timepicker' range on my dashboard from 01 February to Current Date all of the expected results are returned. However, if I select the the 'timepicker' range from 01 January to Current Date there are no results returned. I have to admit this has left me baffled, because all I'm doing is extending the time range. I just wondered whether someone could possibly look at this please and let me know where I've gone wrong. Many thanks and kind regards Chriss ... View more

Hi, firstly my apologies if this isn't the correct forum, but I wonder whether you may be able to help me please. I have just taken over some administration tasks for Splunk, so definitely a beginner, but I've noticed that over time, the version numbers of users' apps have become a little, well a lot in some cases, out of alignment. We use GitHub, Puppet, and Jenkins to propagate the Splunk app through our 4 environments: DEV, QA, Staging, and PROD. Now I think I've been able to find most of the settings to use so that I can update or amend the apps correctly through our 4 environments, but I'm not sure what .conf file contains the version number of the app, so I can then update it in the GitHub repository and pass through the environments. I just wondered whether someone may be able offer some guidance on where I may be able to get this from? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. From a field called 'detail.input' there are two potential outputs as shown below: Request to /for/submissions/1234567890 and Request to /for/savedforlater/9876543210 What I'd like to do is extract the number at the end of the string. I'd thought about using a regex, but because of the difference in the string, i.e. "submissions" as opposed to "savedforlater", I wasn't sure whether this could be done, so I wondered if I could the 'str' and 'len' commands. I know how to omit the end of the character string, but I was wondering whether someone may be able to provide some guidance please how I can extract the end of the character string. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm trying to extract the "1234567/123" from the string below, but I'd like the final output to be "1234567123". "/for/1234567/123/AB1+2BC I did come up with the following "\/for\/(?<refno>[^\/]+)\/(?<refno2>[^\/]+)\/ , but I wasn't sure about how to join the "refno" and refno2". I also wasn't sure if there was a more elegant way of doing this. I just wondered whether someone could possibly look at this please and offer some guidance on how I may go about achieving this. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm using the query below to successfully create a 'lookup' table which contains the dates that user accounts were created or edited. index=_audit action=edit_user operation=edit OR operation=create |stats min(timestamp) as "created" by object |rename object as user |output lookup inactiveusers.csv I know that data exists in the table because I have used the '| inputlookup mylookup' command. I'm then trying to update this table via the following code: index=_audit action=edit_user operation=edit OR operation=create | stats min(timestamp) as "created" by object | rename object as user | lookup inactiveusers.csv user OUTPUT user AS exists | where isnull(exists) | fields – exists | outputlookup append=t inactiveusers.csv The problem I have is that when I run this query I receive the following error: Could not append to file 'inactiveusers.csv': Cannot append to file because none of the fields match. I've looked a t quite a few tutorials and I thought I had followed them to the 'letter' but I've clearly done something wrong. I just wondered whether someone may be able to look at this please and offer some guidance on where I've gone wrong. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm trying to compare the apps set up in my four environments i.e DEV, QA, Staging and PROD. So for each environment I have written the following query which I will then extract into Excel to compare: | rest /services/apps/local | search disabled=0 | table label, title, eai:acl.perms.read, eai:acl.perms.write, version |rename label as "App Name", title as "App Folder", eai:acl.perms.read as "Read Access", eai:acl:perms.write as "Write Access", version as "Version" |sort +"App Name" The query works fine, but I'm trying to transpose the table so, that the values in column "A" become he column headers, and the column headers become the row titles. I've tried using "transpose", "chart over", and "xy series", but I just can't seem to get this to work. I just wondered whether someone could possibly look at this please and offer some guidance on how I may achieve this. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please with something that I just don't understand. I'm using the query below with the date range of 'Yesterday' which returns the figure of 2699. index=main auditSource=preferences auditType=TxSucceeded | dedup detail.input-ur | search "detail.input-preference-tal"=true |stats count(detail.input-ur) AS "Number of unique URs that opted in" I then have tried using the following with the same date range: index=main auditSource=preferences auditType=TxSucceeded | search "detail.input-preference-tal"=true | dedup detail.input-ur|stats count(detail.input-ur) AS "Number of unique URs that opted in" But this returns a figure of 2703 and I don't understand why. Could someone possibly look at this please and explain the logic behind the different values? Many thanks and kind regards Chris ... View more