Hi everyone, I need some help with a SPL query. I am trying to create an inventory of all queries running in my dashboards (both Classic and Dashboard Studio) by using the | rest /servicesNS/-/-/data/ui/views endpoint. I need a query that produces a table with the following columns for every panel: 1. App & Dashboard Name 2. Panel Name 3. Base Search search id & Query (if the panel uses one) 4. Panel Search Query 5. Full Query (The Base Query + Panel Query combined) I am struggling to write the SPL that extracts the Base Search IDs if any and Base Queries, & extract panel queries and then correctly maps them to the individual panels to form the full query string. Does anyone have a working SPL query that handles the logic for both Classic and Studio? Thanks in advance!  ... View more

I have a dataset to visualize my organization in Splunk. When I search for Org=CDO, I get all the direct reports under the CDO, which include positions like CSO and CIO. Under each of these positions, there are many VPs, and under each VP, there are many directors. How can I retrieve the results for the entire hierarchy under the CDO using Splunk? We have a field named Org and another field name job_title When I search Org=CDO I get only direct reports of CDO, no other value in the raw event to extract. any help would be appreciated ... View more

I have a raw Nessus file that I've processed by separating host names into individual hosts. However, I am encountering a problem with extracting data between <ReportItem> tags, especially when there are multiple lines involved (I have multiple report Items in one event under a hostname) .   Here is the regular expression I am using:   | rex field=_raw max_match=0 "\<ReportItem\s(?<pluginout>.*?)\<\/ReportItem\>" OR | rex field=_raw max_match=0 "\<ReportItem\s(?<pluginout>.*(\s+)?)\<\/ReportItem\>"     Unfortunately, it doesn't seem to capture anything that spans multiple lines, as shown in the example below:   "<ReportItem>     ...     (multiline content)     ... </ReportItem>"   Could you please help me adjust my regular expression to correctly capture multiline content within <ReportItem?   Note: ReportItem without multi lines are extracting fine.   any help would be appreciated   ... View more

  How can I match the IPs from csv file with the CIDR ranges in another csv? If no CIDR matches, I want to return "NoMatch" and if proper IP and CIDR match then return the CIDR  I tried the approach below, but I keep getting "No Match" for all entries, even though I have proper CIDR ranges: "| inputlookup IP_add.csv | rename "IP Address" as ip | appendcols [| inputlookup cidr.csv] | foreach cidr [ eval match=if(cidrmatch('<<FIELD>>', ip), cidr, "No Match")]" Note: I can't use join as I don't have IP field or ips in the cidr csv any help would be greatly appreciated. Thank you 🙂   ... View more

I have two lookups, 1 with 460K rows and another with 10K rows.  I used join to get the 10K results from 460K rows, however join is not working and not returning any results.  I used table and stats in both lookups though no results.    Below is the query I used:  | inputlookup unix.csv | eval sys_name = lower(FQDN) | join sys_name [| inputlookup inventory.csv | eval sys_name = lower("*".sys_name."*") | table Status sys_name host-ip  "DNS Name"  ] &  | inputlookup unix.csv | eval sys_name = lower(FQDN) |stats values(*) as * by sys_name | join sys_name [| inputlookup inventory.csv | eval sys_name = lower("*".sys_name."*") | table Status sys_name host-ip  "DNS Name"  ] Any help would be greatly appreciated.  ... View more

Hello,    I have 2 different files names lookup1.csv and lookup2.csv, which have column A and column B in both.    How can we merge two files using a single word in Column A in both files with a sentence in it? lookup1: Column A: "I am good"  lookup2: Column A: "I am bad"  I want to combine both the files using a word "I am" in this case.   Any help would be appreciated.     ... View more

Hello,           Please help me with the below requirement.          I need to capture usernames from 90 days worth of data from a large datasets which includes multiple source types and multiple indexes.           Search "index=* sourcetype=* earliest=-90d@d latest=now | eval LOGIN = lower(user) | stats count by LOGIN sourcetype"" is taking forever.            Is there a better way to capture the 90 days worth usernames and source types without timeout?          Note:  I can able to schedule the search to capture them and append the results. However I am not sure, what time modifiers I should use, If I want to capture all of them in a single day & that should be a continuous process every day.       ... View more

Looking for the exact query to find outliers or anomalies in my csv data using stddev in Splunk enterprise? Fields from csv:  user, action, src, dest, host, _time    Any help would be appreciated.    Thanks in advance!     ... View more