Something like | transaction user startswith="login=failed" endswith="login=succeeded" maxspan=5m maxevents=4 keepevicted=true | where closed_txn == 0 ... View more

There is no such command.  Individual lines in CSV files cannot be removed.  The only way to do it is to read the entire CSV, remove the unwanted lines, and re-write the file. ... View more

You wrote what you need to do - a search, a subsearch, and exclude (NOT). | inputlookup hosts.csv where NOT [ index=abc message="for account" sourcetype=type1 | rex field=names"(?<hostname>\S+) ] It also can be done with a join, but that's not preferred. | inputlookup hosts.csv | join type=left hostname [ index=abc message="for account" sourcetype=type1 | rex field=names"(?<hostname>\S+) ] ... View more

First, please clarify that you want a comma-delimited string as output, not a multivalue field.  Is this correct?  to get a true multivalue field, use | inputlookup host_table | stats values(hostname) as hostname To get one comma-separated text string, do | inputlookup host_table | stats values(hostname) as hostname | eval hostname = mvjoin(hostname, ",") This latter output will be single-valued. ... View more

Hi @pc1234, you have to use two regexes: the first to extract the header: | rex "^(?<date>[^ ]+)\s+(?<protocol>\w+)\sResponse\s+(?<response_status>\w+).+Response\s+Type:\s+(?<response_type>\w+)" that you can test at https://regex101.com/r/wP3LyX/1 the second to extract the sites: | rex "(?<site>www\.[^ ]+)\s+(?<response_code>\d+)" that you can test at https://regex101.com/r/UCwx2h/1 Ciao. Giuseppe ... View more

When a sourcetype is depreciated, is there somewhere I can look to understand why this action was taken.  We currently make use of that sourcetype in the Splunk Add-on for Juniper v1.2.0.  In doing some testing in our Splunk Dev environment, I found out the hard way that this was the case, as nothing parsed after that upgrade. What are customers to use, what that data and parsing is still needed? ... View more

Hi @pc1234, use these two regexes: | rex "^field\s*a\s*\=\s*(\'|\s)(?<fielda>\w+)" | rex "^field\s*b\s*\=\s*(\'|\s)(?<fielda>\d+)" You can test the first at https://regex101.com/r/circlS/1 and the second at https://regex101.com/r/circlS/2 Ciao. Giuseppe ... View more

There is a REST command to list the apps on a local instance, but I have not found one to do the same for a remote instance. That said, each member of a SHC should have the same apps as those in $SPLUNK_HOME/etc/shcluster/apps on the deployer. I haven't tried it, yet, but you could wrap a script around https://:/services/apps/local to get a list of apps. Have a look at https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTcluster#Search_head_cluster_endpoints to see if any of those endpoints do what you want. They will have to be run from a cluster member, however, and some from the captain. ... View more

“At 00:30 on day-of-month 3 and on every day-of-week from Tuesday through Friday in every month from January through December.” https://crontab.guru/#30_00_3_1-12_2-5 ... View more

I would like you to explain the situation more concretely As a general story… The way to combine the fields of another event into the event is below. (Efficient method) sourcetype=sourcetype_a OR sourcetype=sourcetype_b | stats latest(*) AS * BY your_key (Easy way) sourcetype=sourcetype_a | join type=inner your_key [search sourcetype=sourcetype_b | dedup your_key| table your_key, fields_1, ields_2,fields_other] ... View more

Here you go. http://docs.splunk.com/Documentation/Splunk/6.5.9/Indexer/Handlemasternodefailure ... View more

It’s best practice to use a LINE_BREAKER instead. Try this: [yourSourcetype] ... SHOULD_LINEMERGE = 0 LINE_BREAKER = (\|\|) You’ll have to re index the data to see the results. ... View more

The proposed solution seems to be for routing users to different applications based on their role. I want to route users to a different dashboard within the same application based on their role. When the user launches the app the landing page will be the dashboard specific to their role. I’ve tried creating a separate navigation menu for each role(that opens the associated dashboard) and restricting permissions to that role but that doesn’t seem to work. ... View more

@pc1234 since you are anyways using Splunk Web Framework, this scenario seems to be a valid case for KV Store. So, you should try KV Store in place of Lookup: http://dev.splunk.com/view/webframework-tutorials/SP-CAAAEZT ... View more

If data are at fixed length, you can do some like this: (?<name>.{39})(?<port>.{15})(?<info>.{26})(?<protocol>.+) Look at this: https://regex101.com/r/RwdS6Y/2 ... View more

Hi Peter, I think you can use the transaction command to accomplish that. First you need to have a field that will identify the values "Splunk running" and "Splunk Stopped", let say this field is called splunk_status. Than you can submit the transaction: your search | transaction splunk_status | stats sum(duration) AS duration by splunk_status After this search you will have a table with splunk_status and duration fields. Now you can sum both to find total with the command " | addcoltotals". Hope this helps ... View more

you were correct about the field extraction. The problem was hidden characters or spaces. I changed the regex and the date fields now convert without issue. thanks again for the help. ... View more

You can use eventstats to calculate the avg on each row, then use a where to limit your results: ... | eventstats avg(<your_field>) AS avg | where <your_field> > avg Or if you don't want to limit your results, and simply want a new field to "label" as 'high' or 'very high' you can use an eval after the eventstats : ... | eventstats avg(<your_field>) AS avg | eval label = case(<your_field> > avg * 2, "VERY HIGH", <your_field> > avg, "HIGH", 1=1, "NORMAL") If you need to calculate the average by a specific field, just add a by statement ... | eventstats avg(<your_field>) AS avg by <your_by_field> | eval label = case(<your_field> > avg * 2, "VERY HIGH", <your_field> > avg, "HIGH", 1=1, "NORMAL") Example: value host 2 A 4 A 2 B After using the last code snippet I gave you, the results would look like this: value host avg label 2 A 3 NORMAL 4 A 3 HIGH 2 B 2 NORMAL Hope this helps ... View more