Thank you - this was exactly what I was trying to figure out.  I had a regex and couldn't figure out why only part of it was disappearing.  I didn't understand about the capture group. ... View more

and you got a fix for this? i am getting the same issue ... View more

By "above" I meant "fk319 's post" - sorry.  ... View more

The easy way is to have a jump page or index page.  This page allows you to select the filters and build links to the other dashboards by updating the URL. The hard way is to run a bunch of searches, save and retrieve data from a KV (or lookup). ... View more

From 8.1 + : You can now use a more intuitive and better readable Syntax like index=main mysearchterm ```This is a comment``` | stats count by host   ... View more

Hi @curtgran, as @fk319 said, you could use the transaction command, but this is a very slow command, so I hint to use it only if you haven't any other solution. I usually use stats command correlating events by the common key (in your sample AssignedIP and src_ip). Something like this: (search_one) OR (search_two) | rename src_ip AS AssignedIP | stats values(username) AS username earliest(_time) AS _time values(dest_ip) AS dest_ip values(traffic) AS traffic BY AssignedIP I listed all the fields you have, obviously you can use only the ones you need in your use cases. ciao. Giuseppe ... View more

Hi there, I've spent 2 days trying to configure the Splunk emails. Not sure what the settings in alert_actions.conf file are but by default the sender is set to"splunk_sender" or something like that....so in order to send an email you have to specify the "from" property. Also you can change it in Settings > Searches, reports and alerts. Find your search or alert (if you want to use the alert email action) click Edit > Advanced edit and then change the value of "action.email.from". Also trying to send an email using gmail's smtp is a bit tricky as probably you have 2-layer authentication. I would recommend you to change the server. ... View more

All this I understand. In my case app1, app2, and app3 are the same app, but they are different users. They share the same dashboards and searches but have different data. I am looking for a way for an admin, to review mylookup for all three apps at the same time. in my case, mylookup will seldom change, but if user1 makes a change in app1, I would like for the admin to look at their dashboard and review the change without checking the apps individually. ... View more

On behalf of Frank, He meant Splunk SH Cluster in AWS Cloud (EC2) instances. We have 4 SH in cluster on EC2 instances And Current config on ELB is to LB on port 443 in round-robin mechanism and Stickyness for stickysession is defined as 30s Does that make sense ? need any additional information ? ... View more

Nice! Always good to see the finished product! --rmmiller ... View more

There is no straight away solution for your requirement, But you can achieve it via by adding some javascript with your token. var defaultTokenModel = mvc.Components.get("default"); defaultTokenModel .on("change:your_token_name", function(tokenmodel, value, options ){ /* Here based on your value you can construct your HTML and update the document */ }) You cannot use inline javscript inside splunk xml. you have to follow this doc ... View more

restmap.conf defines rest endpoints. removing, or commenting, an entry will prevent the endpoint from being created. (a restart will be required) ... View more

Nice post! I am trying to set up my custom endpoint, pretty sure went through restmap.conf and web.xml, python file properly. I can view the endpoint on port 8089 at https://mysplunk:8089/services/testendpoint and can get the print out from the python file. However, when I tried to call service in dashboard javascript with: service.post('/services/testendpoint', ...) I got 404 error. I am using Splunk 7.2.0. I noticed that you used '/servicesNS/nobody/app_name/saved/searches/receive', Why is it "saved/searches'? I tried the same path and got "Bad Request" error even I don't do anything with the form data. Curious what is your URL on your 8089 port web? I appreciate your response. Thanks, Tony ... View more

take a look at the details under https://splunkbase.splunk.com/app/1618/#/details. You'll need spigot or craftbukkit and to use the logToSplunk plugin with them. If you get stuck chime in here again. ... View more

Thank you for sharing the full page. The only other things I would test it I were you is if that behavior changes on different releases (in case it's a bug that was addressed) and if btool shows that the alert_actions.conf has some settings in it causing silliness. All that said, I'm pessimistic those will produce promising answers for you so I'd suggest opening a support case since it appears feature/functionality is not working as documented. Make sure to outline the key points of this thread so as to expedite your case by reducing support's interest in asking questions we addressed here. ... View more

there is a pre-defined environment variable so you do not ahve to hard code. $env:app$ http://docs.splunk.com/Documentation/Splunk/7.2.1/Viz/tokens#Use_global_tokens_to_access_environment_information ... View more

Thank you, it gets me one step closer... ... View more

Did you put this in default? I had no luck in local. ... View more

this is not working with default submit button (field set) , any suggestions? ... View more

I think this is a job for return. Here's an example: index=_internal | head 1 | eval sum = [ stats count | eval string = "1+2" | return $string] | table sum Here return results in the in-place substitution of the whole expression [ stats count | eval string = "1+2" | return $string] with the string 1+2 , which then allows eval to attribute the value 3 to the "sum" field. While this answers the initial query of sourcing an eval expression with a string from an external source, your use-case seems a more complex as it would require iteration over a result set, using different eval expressions based on a field in the result - "eventtype", if I'm not mistaken. I can think of two ways that you may be able to achieve this: Use map as an iterator over your result set Provided that there is low variance in the eval expressions that you want to apply, you might want to consider simply doing this in-line (or better yet, with an EVAL- directive in props.conf) using a case() statement. If you have to map a large number of eventtypes to a small number of eval expressions, you'll probably want to introduce a field such as "output_format_type" in your lookup table mapping various eventtypes to the output format you would like. That "output_format_type" is what your eval case() statement would operate on to decide what output format is appropriate. ... View more

I have events that have a start and an end. I would like to know how many events I have each second. so by computing before the report window an can count starts that have not ended yet, ie that are still running during my report window. I am using streamstats to count, I was not able to get meaningful data from eventstats. ... View more

I looked and looked and skipped the 'p's I guess. pow is what I was looking for, thanks... ... View more