Hi Team,    Need your help in creating regex to create a field.  "User_Claim":("sub":"qweihaytej"; "login_id":"Abc@domain.com";........)  Here User_Claim is a field. I have to create a field for login_id. I have tried with this, and it's not working.  ..... | rex field=User_Claim " login_id"(? <loginID>\w+.) " I am unable to see the field name in the interesting fields.    Please suggest in this.    Thanks Sagar       ... View more

Trying to extract splunk search queried data from Splunk API using Postman. What all para meters need to pass to get successful response. https://testsplunk:8089/services/search/jobs/export?output_mode=csv Headers: [{"key":"search","value":"index=abc sourcetype=xyz|stats count by host ","description":"","type":"text","enabled":true}] Authorization header : UserName: jhasuagduh Password: pwd   I am getting 400 bad request and 401 unautherized as response. Please assist. Thanks Sagar ... View more

Is there any way to write a corn schedule for a alert which needs to be triggered every 5 min between 6 AM to 11 PM everyday except last week of the month? I am using this as: */5 6-23 1-28 * * But this did not work as ending weeks can have any of the day. Need someone's help here. Thanks ... View more

I am using this cron schedule. */5 7-23 8-31 * * Could you please check and confirm if this works. ... View more

I wrote the following query for today's comparison with last week: index = abc App_Name=xyz earliest=-0d@d latest=now | multikv | eval ReportKey="Today"|append[search index = abc App_Name=xyz earliest=-7d@d latest=-6d@d | multikv | eval ReportKey="LastWeek"| eval _time=_time+60*60*24*7]|eval _time=if(isnotnull(new_time), new_time, _time)|timechart span=5m sum(TOTAL_TRANSACTIONS) as Transactions by ReportKey I want the query to do the following: allow someone to view the comparison of yesterday's data and last week's(considering yesterday to its one week data), or the "day before yesterday" to its corresponding "last week" data, and so on. So, could you please help how can i write the query for that? ... View more

index = abc earliest=-70m@m latest=@m| stats avg(AVERAGE_RESPONSE_TIME) as Today by Time Application_Name |eval Today= round(Today,2) |appendcols [search index = abc earliest=-7d@m-70m latest=-7d@m |stats avg(AVERAGE_RESPONSE_TIME) as LastWeek by Time Application_Name |eval LastWeek= round(LastWeek,2)|eval _time=relative_time(now(),"-7d")]|lookup RESP_LOOKUP_App Application_Name as Application_Name OUTPUTNEW RESP_DEVIATION_THRESHOLD | eval AVG_RESPONSE_Deviation=(Today/LastWeek)*100|table Time Application_Name Today LastWeek AVG_RESPONSE_Deviation RESP_DEVIATION_THRESHOLD | where AVG_RESPONSE_Deviation>RESP_DEVIATION_THRESHOLD My Aim is to compare the Avg value for a Particular Application_Name for today with the last week for any particular timing. E.g Today For a particular time "t" for a particular Application_Name "x" . I am calculating the Average of "AVERAGE_RESPONSE_TIME" field mentioned in the logs. When I am trying to find the average of AVERAGE_RESPONSE_TIME field for the application named "x", for the particular time "t" in the last week, it is not showing the correct value. I guess it is considering another Application_Name and showing the Average of Average_Response_Time for other application_names for that time. Please help to modify the query ... View more

How to write a cron schedule to execute in every 5 mins between 7 am to 12 min-night ? ... View more

I have used this query for the alert creation. index = xyz sourcetype=abc |table _time response_time|search response_time>50 I have used corn schedule for 5 min. But this creates lot of noise. So I want to use throttle for this alert for 15 min. Means after the first alerts triggered, it will take a 15 mins dealy. I have used below configuration for each result triggered. Throttle : "Checked" Suppress results containing field value: "response_time" Suppress triggering for : 15 mins But this is not working. Please help. ... View more