I am not sure this is running the reports every 5 minutes, 1hour, or 24 hours as I think I set it up. I tried to trip an alert with logging in wrong but didn't get anything on my dash board. If I set up send email I get one every 5 minutes but I that I am not running the search again - just getting the PDF every 5 minutes.... Do I need to set these up as alerts? I was hoping on using the dash board - here is one of the dash boards: eventtype=failed_login hoursago=24 | stats latest(_time) AS time, count by username, host | search count > 3 | convert ctime(time) I need this to run every 24 hours same with the 1 hour and 5 minute dashboards I clicked the autorun in the editing of dashboards...I found some stuff in XML reference manua for refresh but no examples... thanks ... View more

I need to do the same thing, but the LDAP group membership to check against will be one of many chosen as input so I'd rather do it without a lookup for the group membership, but rather as initially suggested with a subsearch. It seems like it would require using ldapfetch with ldapgroup. In the original suggestion I don't see anything that connects user fields between the AD group and the events. In my search the event field User is equivalent to AD group member_name, so I will have the group cn as input, then I want only events where member_name=User returned. Any advice appreciated. ... View more

Thanks you for this! Just ran into the same problem. Purged records from the py_health.log file and dashboard began to populate. Anyone know if Splunk intended to fix this bug? ... View more

Ok, update your Alert search with by adding | search Result1="Error" OR Result2="Error" and then change the Trigger Condition to number of results greater than 0. Also, make sure the alert is set Trigger Once, not For Each Result. Let's say you're scheduled the alert for every 5 minutes looking back at the last 5 minutes...with "For Each Result" set, if your search returns 20 events below 40%, you'll get 20 alert messages. If you set to "Trigger Once", you'll get 1 alert if the search returns any events below 40% within the last 5 minutes. This way, at most you'll get 1 alert every 5 minutes, but only if Result1 or Result2 went below 40% once within the last 5 minutes. ... View more

I did this with a similar situation where a syslog header was added to the front of XML events. In props.conf , make a LINE_BREAKER setting for the sourcetype (or whatever) and add the regex for the syslog header, and end with the opening of your JSON (XML in my example): `[sam:xml] # Strips syslog header and makes events pure XML LINE_BREAKER = (\d\s\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}-\d{2}:\d{2}\s[\w_-]+\s[\w-_]+\s\d+\s-\s-\s) SHOULD_LINEMERGE = false` Obviously, your regex will vary. Post a sample event if you need help with the regex. ... View more