I'm going through the Splunk Fundamentals 1 course and I'm currently on module 9 - Transforming commands. During the top command section, there is a bit about about the top command clauses: limit = int countfield = string percentfield = string showcount = true/false showperc = true/false showother = true/false I can't find any documentation on showother - is this an error and supposed to be useother ? ... View more

I'm trying to create a query that will show me {stuff} that's happening outside of 'typical' working hours (i.e. Sat/Sun, Outside of 9 to 5 with a couple hours grace). I am using the below query to create what's essentially a boolean value (starting with day only) and I want to return a Table based on 1/True index="<some_index>" | eval day_of_week=strftime(_time,"%A") | eval is_outside=case(day_of_week == "Saturday" OR day_of_week == "Sunday", "1", 0=0, "0") | where is_outside == "1" This creates a field that looks like something I can work with. I'm just not sure how to return a table with only "1" values I've tried things along the lines of the below to no avail. | eval test=if(day_of_week, [ table action ], "") ... View more

I have some CSV data about files imported in to Splunk. The data looks like this: "\\domain\path\to\file\","<filename>","<fsize>","<ext>","<Last_access>","<last_write>","<creation_time>","<attributes>","<owner>" I have converted all the date strings to epoch using: | eval epoch_LastAccessTime=strptime(LastAccessTime, "%d/%m/%Y %H:%M:%S") ... ... I want to get: A percentage of files last accessed between 6 months and 3 years ago A percentage of files last accessed 3 years or more ago. This is the search query that I have tried before getting stuck: index="<my_index>" sourcetype="<my_sourcetype>" | rex field=DirectoryName "\\\domain\.org\\\teams\\\(?<Team>[^\\\]*)" offset_field=_extracted_fields_bounds | eval epoch_LastAccessTime=strptime(LastAccessTime, "%d/%m/%Y %H:%M:%S") | eval _time=epoch_LastAccessTime | timechart span=6mon count I've tried using commands along the lines of: | where epoch_LastAccessTime>=three_year_ago_from_now AND epoch_LastAccessTime<=six_months_ago_from_now However, this excludes everything else (3y+) I want the result to look something like: TimeRange Perc 6m-3y 60% 3y+ 40% ... View more

Hi, I want to extract a certain part of a string, for instance: Input \\domain.org\teams\team1\bla\bla\bla \\domain.org\teams\team2\bla\bla \\domain.org\teams\team3\bla \\domain.org\teams\team4 I want the following output: team1 team2 team3 team4 I'm using the below Regex which works in Regex101 but not on Splunk. The regex I'm using is: (^\\\\domain\.org\\teams\\)(?P<Team>[^\\]+) and has this error in Splunk: Error in 'rex' command: Encountered the following error while compiling the regex '(^\\domain\.org\\teams\)(?P<Team>[^\]+)': Regex: missing terminating ] for character class ... View more