Hello. I want to be able to add subsearches in the same row. Example: Search #1.....| append [search #2....] | append [search #3....] Office Value#1 Value#2 Value#3 Is there a way to do this? Thanks ... View more

Hello. I have my indexers indexing the results of iostat every few minutes. rrqm/s wrqm/s r/s w/s rMB/s wMB/s avgrq-sz avgqu-sz await svctm splunk_cold 0.00 0.00 10.16 173.12 0.32 0.68 11.17 0.15 0.77 0.19 splunk_hot 0.00 0.00 0.00 0.01 0.00 0.00 8.00 0.00 4.39 0.09 Is there a way I could run a search-report to display the stats for either Splunk_cold and or Splunk_hot with the data? How do you tell Splunk to recognize this table that comes from a log file? Thanks ... View more

Hello. I have a search that looks like this: sourcetype="sendmail_syslog" host=*-ess-css* | stats count by search_from_domain It lists all of the sending domains through a set of email hosts. I also configured a csv file that lists the valid sending email domains. I've imported the file under the lookups folder and I can return results by running "|inputlookup css_domains.csv" of the valid domains. I need help creating the search that will compare the search results to the csv file as well as the sending IP address and alert if the domain is not in the csv file. Can you help me structure the search? ... View more