@bismsit29 , Try this: | strcat Type "-" _time column | xyseries column, Store, Counts | eval column=split(column, "-"), Type=mvindex(column, 0), _time=mvindex(column, 1) | fields Type, _time, Store* ... View more

For LINE_BREAKER , regex captured group should contain everything between end of previous event and beginning of current event. Try this: [xml] KV_MODE = xml LINE_BREAKER = \<\/photo\>([\r\n\s]+)\<photo NO_BINARY_CHECK = 1 TRUNCATE = 0 TIME_PREFIX = \<CreationDate\> TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N ... View more

By default deployer merges both local and default directories then pushes apps to search heads. Check your changes in default directories on search heads. It might be something to do with default.xml in your app. Check if following content is there in the default.xml in $SPLUNK_HOME/etc/apps/yourapp/default/data/ui/nav/ . If not add it in the app on deployer server, deploy apps again and check. <nav search_view="search" color="#5CC05C"> <view name="search" default="true" /> <view name="reports" /> <view name="alerts" /> <view name="dashboards" /> </nav> ... View more

You can use inline field extraction. Add below configuration in props.conf. Fields are extracted whenever you search source=tomcat.txt . You can also use a sourcetype name in place of source name. props.conf [tomcat.txt] EXTRACT-myfields = \(Success:(?<Success>\w+)\)-\(Validation:(?<Validation>\w+)\)-\(F_TAG:(?<F_TAG>\w+)\)-\(CLIENT_ID:(?<CLIENT_ID>\w+)\)-\(Total_TT:(?<Total_TT>\w+)\)-\(AppServer_TT:(?<AppServer_TT>\w+)\) ... View more

Use append: <your search> | append [| makeresults | eval column1=3, column2=0] ... View more

Try this: | rex "AlertID[:\s]*(?<AlertID>\d+)[:\s]*(?<Description>[\w\s:\-\.]+)\s*Class[:\s]*(?<Class>[\w\s]+)\s*Host[:\s]*(?<Host>[\w\-\.]+)\s*External\sID[:\s]*(?<External_ID>\d+)\s*Tier[:\s]*(?<Tier>\d+)\s*Impact[:\s]*(?<Impact>[\w\W]+)\s*Urgency[:\s]*(?<Urgency>[\w\-]+)" | rex "\/\*\s(?<dateTime>[\w\s:\.]+)\s\*\/" | rex "\<USER:\s(?<USER>[^\>]+)\>" | rex "\<Incident_Number\>(?<Incident_Number>[^\>]+)\<\/Incident_Number\>" | table AlertID, Description, Class,Host, External_ID, Tier, Impact, Urgency, dateTime, USER, Incident_Number ... View more

Below query should work: index="juniperindex" ("Login Failed*" OR "Primary authentication failed") | rex "(?<UserName>\w+)\(VPNUsers\)" | table UserName ... View more

Try this: index=monitor [search index=holiday_list earliest=0 latest=now| stats count by OCCURRENCEDATE | fields OCCURRENCEDATE] ... View more

hi @jerinvarghese, Try this: | rex "(?<root>\<ROOT\>[\w\W\s]+\<\/ROOT\>)" | spath input=root | rex field=ROOT.Notes "AlertID[:\s]*(?<AlertID>\d+)[:\s]*(?<Description>[\w\W\s]+)\s*Class[:\s]*(?<Class>[\w\s]+)\s*Host[:\s]*(?<Host>[\w\W\.]+)\s*External\sID[:\s]*(?<External_ID>\d+)\s*Tier[:\s]*(?<Tier>\d+)\s*Impact[:\s]*(?<Impact>[\w\W]+)\s*Urgency[:\s]*(?<Urgency>[\w\-]+)" | rex "\/\*\s(?<dateTime>[\w\s:\.]+)\s\*\/" | rex "\<USER:\s(?<USER>[^\>]+)\>" | table AlertID, Description, Class,Host, External_ID, Tier, Impact, Urgency, dateTime, USER Without spath: | rex "AlertID[:\s]*(?<AlertID>\d+)[:\s]*(?<Description>[\w\s:\-\.]+)\s*Class[:\s]*(?<Class>[\w\s]+)\s*Host[:\s]*(?<Host>[\w\-\.]+)\s*External\sID[:\s]*(?<External_ID>\d+)\s*Tier[:\s]*(?<Tier>\d+)\s*Impact[:\s]*(?<Impact>[\w\W]+)\s*Urgency[:\s]*(?<Urgency>[\w\-]+)" | rex "\/\*\s(?<dateTime>[\w\s:\.]+)\s\*\/" | rex "\<USER:\s(?<USER>[^\>]+)\>" | table AlertID, Description, Class,Host, External_ID, Tier, Impact, Urgency, dateTime, USER Sample query: | makeresults | eval _raw= "<MTIER><TID: 0000000181> <CATEGORY:com.remedy.log.WEBSERVICES> /* Wed Apr 22 2020 14:49:21.277 */ <LEVEL: FINE > <Class: com.remedy.arsys.ws.services.ARService><Method: performOperation><TENANT: null> <USER: na\xsmoogitsm> input document: <?xml version=\"1.0\" encoding=\"UTF-8\"?> <ROOT><Incident_Number>INC000013542725</Incident_Number><Work_Log_Type>General Information</Work_Log_Type><Locked>No</Locked><View_Access>Public</View_Access><Summary>AlertID: 171945364 : Open : USWNK-WANRTC001 : Node is down. Class:Custom Trap Host: uswnk-wanrtc001.</Summary><Notes>AlertID: 171945364 : Open : USWNK-WANRTC001 : Node is down. Class:Custom Trap Host: uswnk-wanrtc001.sa.xom.com External ID: 34217579 Tier: 3 Impact: 2-Significant/Large Urgency: 2-High</Notes><z2AF_Attachment1_attachmentOrigSize>0</z2AF_Attachment1_attachmentOrigSize><z2AF_Attachment2_attachmentOrigSize>0</z2AF_Attachment2_attachmentOrigSize><z2AF_Attachment3_attachmentOrigSize>0</z2AF_Attachment3_attachmentOrigSize></ROOT>" | rex "(?<root>\<ROOT\>[\w\W\s]+\<\/ROOT\>)" | spath input=root | rex field=ROOT.Notes "AlertID[:\s]*(?<AlertID>\d+)[:\s]*(?<Description>[\w\W\s]+)\s*Class[:\s]*(?<Class>[\w\s]+)\s*Host[:\s]*(?<Host>[\w\W\.]+)\s*External\sID[:\s]*(?<External_ID>\d+)\s*Tier[:\s]*(?<Tier>\d+)\s*Impact[:\s]*(?<Impact>[\w\W]+)\s*Urgency[:\s]*(?<Urgency>[\w\-]+)" | rex "\/\*\s(?<dateTime>[\w\s:\.]+)\s\*\/" | rex "\<USER:\s(?<USER>[^\>]+)\>" | table AlertID, Description, Class,Host, External_ID, Tier, Impact, Urgency, dateTime, USER ... View more

If you know all the expected values for field blocks then you can do this. Here, block1, block2, block3, block4 and block_10 are expected values of multi-value field blocks. <my search> | foreach block_1,block_2,block_3,block_4,block_10 [ eval <<FIELD>>=if(like(blocks, "%<<FIELD>>%"), "yes", null)] | stats count(block_*) as block_* | transpose column_name=blocks Here you avoid using mvexpand which is time consuming for large number of events. ... View more

Try using timechart with span: index=myindex Service=MyService earliest=-2d@d | timechart span=1d count ... View more

"Event actions --> Show Source" is a workflow action and a workflow action can only be created at event-level (meaning they apply to an entire event), field-level (meaning they apply to specific fields within events), or both. You cannot create it for all events. Check this:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/CreateworkflowactionsinSplunkWeb ... View more