im trying to write a splunk search to extract the user id and time of a login.  log sample below:   trx# datetime                           remaining text in event 10    1/17/2025 15:03:20   account record user100 does not exist 12   1/17/2025  15:03:20   login as admin, raising privileges   both results represent a successful login. both results have the same datetime but different trx# (10 or 12) ive tried streamstats count  by _time which generates a count for each result. the issue is how do I isolate the first result (trx# =10) so i can extract the userid (user100)? the streamstats  command doesnt always assign the same count value (1 or 2) to the two logs.    Thanks in advance for your help.     ... View more

I'm creating an alert to notify oracle database administrators  when a  db_connect connection has failed. I have created the query to return the name of the failed connection using the splunk _internal logs. However, I would like to include the hostname and default database that are defined in the connection.  I have not been able to locate logs with the connection host and default database using the connection name as the search criteria. Is there a REST or CURL command available that retrieves the host and default database (using the connection name as input) that I can  use to join with my  completed query that retrieves failed connections? Thanks In Advance.   ... View more

A user is unable to access investigations in Enterprise Security (version ES 7.1.1) on Splunk Cloud (Splunk 9.0.2) . When clicking on investigations from the main menu the message "You do not have permissions to access investigations" appears. The user is assigned the ESS Analyst role which includes the capability Manage-All-Investigations.  any ideas?     Thanks in advance.   ... View more

I am trying to create an alert that triggers when a certain number of failed logins are reported in a 5 minute time period. Specifically, when a given user fails to login 3 successive times without a successful login in the next login attempt I want the alert to fire and list the failed login attempts (user and _time ). 1) events below trigger alert user     time  login attempt status smith 12:01 failed smith 12:03 failed smith 12:04 failed 2) below events will NOT trigger alert since the last event is a successful login user    time    login attempt status smith 12:01 failed smith 12:02 failed smith 12:03 failed smith 12:04 succeeded how do i create a splunk query(using the transaction command presumably) to identify user login attempts that meet the trigger condition?       ... View more

is there a REST command to delete rows from the dmc_forwarder_assets.csv? For example, to remove rows where the status=missing or where hostname = a value provided in the REST command?     Thanks in advance.   ... View more

I need to create a search and subsearch to exclude results in a query.  the primary search is a lookup table. the subsearch is a query on events that extracts a field I want to use to join to the primary search. the common field is hostname. If a given hostname in the lookup table is found in the subsearch i want to discard it.   primary search | inputlookup hosts.csv field = hostname output: host1 host2 host3 subsearch index=abc message="for account" sourcetype=type1 rex field=names"(?<hostname>\S+) field hostname output: host3   I want the following output: hostname host1 host2 I want to discard host3 since its in the subquery.  How do I correlate the searches to do this? I can't use  a join because the hostname in the subsearch is not computed until the subquery is executed.  Thanks in Advance.     ... View more

I'm trying to convert a field with multiple results into a multivalue field. I'm querying a host lookup table that has several hostnames. I'd like to create a single multivalue field containing all the hostnames returned by the inputlookup command separated by a comma. I'm using the makemv command to do this but it returns each host as a separate result instead of a single result with all the hosts separated by commas.    Any suggestions? here's my query: | inputlookup host_table fields hostname | makemv delim="," hostname | table hostname   Thanks in advance.   ... View more

Can someone assist extracting fields using the string below? The first line is header info: date, protocol, response_status, response_type each line following (one to many) is a website and an error code i can't figure out a regex to capture the header line AND the successive lines of websites and error codes.    02-Mar-2021 UDP Response Found Response Type: ABC www.site1.com 404 www.site10.com 100 www.site4.com 400 .....   Thanks in Advance.   ... View more

I'm requesting help constructing a regular expression for the following: I need to extract two values from the string below: [app/task/function/5] field a='app' (string after first [ before first slash) field b = '5' (value after last slash before closing]) Another example is: [app/task/3] fielda = app fieldb= 3 In addition, I need the extraction to fail if a string of characters is found. For example, the character string to exclude is 'function': [function/app/2] The extraction should fail since 'function' is contained in the string. Any assistance would be appreciated. Thanks in advance. ... View more

Splunk Add-on for Juniper 1.3.0 version 1.3 release notes indicate that the sourcetype juniper:sslvpn is deprecated. version 1.3.0 still supports this sourcetype. Will events associated with this sourcetype be re-mapped to another sourcetype in the next version after 1.3.0 ? Do I need to take any action when upgrading from version 1.2.0 to 1.3.0? Any assistance is appreciated. ... View more

i need a splunk query that will the list the applications on each member of the search head cluster. i am running the query on the deployer. I've cant find a REST command or a splunk internal query to list the apps. Any assistance is appreciated. ... View more

How can I schedule a dashboard for PDF delivery to run at midnight on the next Tuesday after the third Friday of each month? Thanks in advance. ... View more

i have events that contain the following. host sourcetype value1 value2 100 log-c .60 100 log-d .75 100 log-retention-c 1 100 log-retention-d 2 100 cpuload .4 i want to combine the events to the following: host sourcetype value1 value2 100 log-c .60 1 100 log-d .75 2 100 cpuload .4 The only source type that requires this are those beginning with log. I need value1 or value2 in the same event to calculate a status based on the values. Note: Sorted by source type, there are no intervening source types between log% and log-retention%. Any assistance is appreciated. Best Regards, ... View more

Currently, the search head and cluster master reside in the same Splunk instance. What are the steps to migrating the cluster master to a dedicated Splunk instance on another server? We are using Splunk version 6.5. thanks in advance. ... View more

I'm trying to create an event break for an Oracle sql query I created in Splunk DB connect the oracle query generates multiple rows that I would like to consolidate into a single event. The delimiter is "||" characters that I appended as the last row in the query. I configured the source type settings as follows: BREAK_ONLY_BEFORE = || SHOULD_LINEMERGE = true As part of creating the input, I selected current index time as the timestamp. However, Splunk is creating separate events for each row in the query instead of merging the results into a single event based on the delimiter. I've tried generating the "II" row at both the beginning and end of the query. Any suggestions? Thanks in Advance. ... View more

When the user clicks on the app they should be directed to the appropriate dashboard for their role. thanks in advance. ... View more

how can i combine queries to populate a lookup table? I have a lookup table with the following values item 1 2 3 i'm using the splunk web framework to allow a user to insert an item. if the user enters 3 then item 3 is changed to 4 and item 3 is inserted. the field input_item represents the value entered by the user. i'm using the query below to first renumber item 3 to 4 and to insert item 3 via an appended search. | inputlookup item.csv | eval input_item = 3 | eval itemnumber = if(itemnumber >= input_item, itemnumber +1, itemnumber) | fields - input_item | outputlookup item.csv | append [ | inputlookup item.csv | stats count as testcount | eval input_item =3 | eval itemnumber = input_item | fields - testcount | outputlookup item.csv append=true] unfortunately, the new item is created with a value of 4 instead of 3. is there way to combine these two queries or do i need to create 2 separate queries via 2 separate searches in the search manager? thanks in advance, Peter ... View more

I need some assistance coding a rex statement to extract data from events generated by a Powershell script. Sample data: Name Port Description Protocol Windows remote mgmt RPC 135 @FirewallAPI TCP Corenet-12345 421 TCP Port 75 and 443 UDP I have two questions: 1) How do I extract non-contiguous characters into one capturing group (one for name and the other for port) 2) How do I handle cases where one or more fields are blank? (in this case, the port in the second row and both the port and description in the third row? Thanks in advance for your help. ... View more

I am trying to determine uptime duration on Windows 7036 events. Below is sample data: TIME SERVICE STATE 10:00 splunk running 10:03 splunk running 10:04 splunk stopped 10:07 splunk stopped 10:10 splunk stopped 10:15 splunk running 10:16 splunk stopped 10:20 splunk running I'm trying to compute for a period of time (20 mins here) the total time that a service (Splunk here) is in a running or stopped service state. I will then use those totals to produce an uptime percentage. Any suggestions? thanks in advance, Peter ... View more