Hi, I have a search that shows the last time a server last had a virus update but how can I make the search so it only shows machines that have not had a virus update for say 14 days? Thanks, ... View more

I have a single value search that I have added to my dashboard I want it to change colour and have added this to the end of the search but the number does not change colour why does this not work? rangemap field=count low=0-2 elevated=3-6 default=severe ... View more

It will not let me post a comment on the http://splunk-base.splunk.com/answers/70576/break-a-search-down-per-day answer as it says it is too many letters so I have to create a new post (sorry if there is a way to post the comment but could not see how!) I have created the below search, but I get the following error when I try to run the search but I can not see what I have done wrong. "Error in 'stats' command: The number of wildcards between field specifier '' and rename specifier 'daily_failure_count' do not match. Note: empty field specifiers implies all fields, e.g. sum() == sum()" source="secure" sshd "pam_ldap: error trying to bind as user"|top uid limit=8 | fields – percent | bin _time span=1d | stats count sshd "pam_ldap: error trying to bind as user" AS daily_failure_count by uid _time | where daily_failure_count =>5 | table_time uid daily_failure_count ... View more

I have this search I want to only display results for when the sum(failures) is higher than 4 how can I do this? (index=infrastructure-os OR index=main) sudo "incorrect password attempt*" |rex field=_raw "sudo:[^a-z]+(?<user>[^ ]+) : (?<failures>[0-9]+) incorrect" |stats sum(failures) by user, host | where user!="addm"| ... View more