I downvoted this post because the question was about capitalizing first letters. ... View more

The macro works fine at the SPL line. Permissions are global. ... View more

Do you have a link to the documentation on multireport? I don't see it here: https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/WhatsInThisManual ... View more

tstats only counts events, not string occurrences. ... View more

TERM will not work with that explicit string, but you can search for the combination of the two substrings: eventname AND deletebucketpolicy (case insensitive). The odds of false positive event matches on those two strings surely must be extremely low to non-existent. A much slower way to do it is just to extract the string with rex multiple times and then count the number of extractions (in the event that an event may contain the string more than once and you want to count every instance). ... View more

First, transaction does not take the max, but instead lists all the value for each field in the order it encounters them much like: | stats list(field1) AS field1 Second, max is NOT used on a multivalue field, but rather on a comma-separated list like: | eval n=max(1, 3, 6, 7, "foo", foo2) where "foo" is evaluated as greater than 0. Third, if you want the max of a multivalued field, use stats like: | stats max(field1) AS field1 Fourth, the accepted answer to this question about re-reading the docs and being a "nice feature request" has SO many inaccuracies that it really should be deleted. ... View more

I downvoted this post because there are several inaccuracies with this answer. A list of values in a field IS a multi-value field. also, you can add a value to a multi-value field using mvappend in eval . streamstats is not best in his situation. transaction does not give a unique list, but rather lists all values like list in stats . ... View more

@joesrepsolc The solution appears fairly complicated, so clarity is not going to be expected when using Splunk to do it. I actually prefer the other answer by @tnesavich for the sake of clarity. But I expect it is much simpler to use the python method, not mentioned in those answers. Have you looked at python-evtx? https://github.com/williballenthin/python-evtx ... View more

It is accurate. Martin Mueller has verified it too. ... View more

no limit. ... View more

datamodel does not take advantage of datamodel accelerations ... View more

subsearch limitations ... View more

I downvoted this post because doesn't work ... View more

It won't work with tstats, but rex and mvcount will work. For the tstats to work, first the string has to follow segmentation rules. Second, you only get a count of the events containing the string as presented in segmentation form. If the string appears multiple times in an event, you won't see that. The best you can get is a count of the number of events containing the string if it follows the segmentation rules or it's contained in an indexed field. Any string with major segment breakers in it will fail in tstats TERM. | tstats count WHERE index=foo sourcetype=bar TERM(mySegment) TERM(mySegment2) Also, if you ever consider using NOT with tstats , you'll also need to consider the effects of the following Splunk bug: https://answers.splunk.com/answers/787657/not-term-removes-results.html?childToView=787658#answer-787658 The better solution is to extract and count each string with rex : index=<yourIndexName> "yourString" | rex max_match=0 "(?<yourStringName>yourString)" | eval str_cnt = mvcount(yourStringName) | stats sum(str_cnt) AS "No. of occurrences" ... View more

It won't work. First, the string has to follow segmentation rules. Second, you only get a count of the events containing the string as presented in segmentation form. If the string appears multiple times in an event, you won't see that. ... View more

I downvoted this post because this answers the questions on what the fields with values are but does not display only the fields with values with their values. ... View more

I'm not a fan of the map SPL command; its too problematic and slow for my tastes. The temporal subsearch filter will preform better: index=idx2 sourcetype=source2 [ search index=idx1 sourcetype=source1 "alert" | stats count by field1 _time | rename field1 AS Machine | eval earliest=_time-86400 | eval latest=_time+86400 | return 999 Machine earliest latest] | table _time Computer status ... View more

The answer on which values in a multivalue field are deduped is this: The multivalue field must match all values in order for it to be deduped: | stats count | eval field=mvappend("a","b") | append [| stats count | eval field=mvappend("1","2")] | append [| stats count | eval field=mvappend("2","1")] | append [| stats count | eval field=mvappend("a1","b2")] | append [| stats count | eval field=mvappend("a1","b2")] | append [| stats count | eval field=mvappend("a1","a2")] | dedup field Even the order of the values in the multivalue field matters! Who would've thought? ... View more

Gregg, You are going to love my next app and talk at .conf19! Improving searches to run 500k times faster against raw data and correlated searches (multiple data sources). ... View more

Agreed. Our first amendment protections are very strong in the United States. I'm not a lawyer, but I have seen many cases where the first amendment prevailed in commerce with very little deviation from a trademark. I would not expect a tshirt saying "Nike just did it" to infringe on the trademark. Imagine if we couldn't say "just did it" on any merchandise. Everything would be protected and virtually nothing could be printed on merchanidise in that world. ... View more

Sued for "Eat. Drink. Splunk. Repeat."? Surely you must be joking. That's not how copyright works. Even if you said "Eat. Drink. Conquer. Repeat.", surely you can't get sued for 4 consecutive words. They can threaten, and even sue but it doesn't mean they will win. It's like me trying to copyright "So be careful" and then threatening to sue anyone (like you) who ever uses that phrase or prints it on a shirt. Big nope. ... View more