you are 200% correct.  to use iseval = 1  we must specify the definition within double quotes.  ... View more

Hey @bsayatovic , Did you happen to find a solution for the prefix wildcard? I am running into same issue, so wondering if you found a way around it. ... View more

Old topic, but if someone experiences the same issue ... it will depend a lot on the content of the macro and the overall implementation, but for me the solution was to configure the macro to accept a single argument and in the SPL where I use the macro I enclose the arguments with double quotes. E.g. I had a macro used in dashboard, the arguments for the macro were taken from a multiselect input field on the dashboard. The input field creates a token $multipleValuesSeparatedByComma$ which I passed to the macro (the user can select one or more items in the field, thus passing one or more arguments to the macro):   myMacro($multipleValuesSeparatedByComma$)   This didn't work very well in the SPL contained in the macro when the user selected more than one value in the field. I then tried to add double quotes around the token and this SOLVED the problem, i.e.:   myMacro("$multipleValuesSeparatedByComma$")   Now the users can select single, double or multiple values and the underlying SPL understands it correctly and returns the right results. ... View more

From 8.1 + : You can now use a more intuitive and better readable Syntax like index=main mysearchterm ```This is a comment``` | stats count by host   ... View more

Hi there, Maybe this logic will be of assistance? This logic is designed to create an alert for investigation where Splunk has detected no events within a given sourcetype within the past 2 hours. It does not address your concern of log files not being created, but would be a good indicator that this has not happened. | tstats count dc(host) AS distinct_hosts latest(_time) AS latest_time WHERE index=* BY sourcetype | where latest_time<=relative_time(now(), "-2h") | sort -latest_time | convert timeformat="%H:%M:%S %d/%m/%Y" ctime(latest_time) | where count=0 ... View more

changing the max_rt_search_multiplier is the way to go. changing max_searches_per_cpu and base_max_searches will change also affect the real-time limit, but will alter the limit for historical searches too. max real-time searches = max_rt_search_multiplier x (max_searches_per_cpu * + base_max_searches) And to address woodcock's comment, there is a setting that you can tweak which will allow you to optionally trade performance for latency. It will run real-time searches with higher latency but generally use far less system resources. The setting is under [realtime] indexed_realtime_use_by_default = true/false (defaults to false. set to true for less resource usage but higher latency) ... View more

double quotes are used to quote values in CSV. See https://en.wikipedia.org/wiki/Comma-separated_values#Basic_rules_and_examples ... View more

@nickhillscpl Thanks for the reply. It was more of a hypothetical question that I was discussing with some colleagues, but scenarios do exist where analytics capabilities are being provided as a service using internally built dashboards and scripts, and the provider does not want to expose the inner workings to their client. Obviously the argument is more complex (data location, server ownership...), but from a technical PoV I was curious as to whether there was anything one could do in Splunk. Regards, Andrew ... View more

If you need in stats command.. Here is the text from splunk docs Memory and maximum results In the limits.conf file, the maxresultrows setting in the [searchresults] stanza specifies the maximum number of results to return. The default value is 50,000. Increasing this limit can result in more memory usage. The max_mem_usage_mb setting in the [default] stanza is used to limit how much memory the stats command uses to keep track of information. If the stats command reaches this limit, the command stops adding the requested fields to the search results. You can increase the limit, contingent on the available system memory. If you are using Splunk Cloud and want to change either of these limits, file a Support ticket. ... View more

And a macro method is documented here: http://docs.splunk.com/Documentation/Splunk/latest/Search/Addcommentstosearches ... View more

You can see in lipsy what it's doing in the search.log maybe have to enable debug not sure ... View more

What about this for efficiency and ease? source="jms-queue" | bin _time span=5m | stats per_minute(count_delta) as dpm by queue_name _time | addtotals | where total > 0 | fields - total | xyseries _time queue_name dpm One pass through the data, then eliminate queues that have total count_delta = 0. Finally, put the data in timechart format. ... View more

thanks 🙂 at least i'm not doing things incorrectly 😉 so i have a quandary with this setup; because of my imposed 'hierarchy', i cannot generate reports such as 'show me top eventtypes' without double counting; eg one log event may have 2 or more eventtypes associated with it (ie it's both network_acl and network_acl.denied). i tried running a 'eventtype=network_acl NOT eventtype=network_acl.denied'; but of course the latter argument takes precedence and so the result would just exclude most log messages. any idea how i can generate this 'higher level' report on the the hierarchy? ... View more

Note that stats count in the subsearch just searches to a create a single dummy row so that addinfo can populate it with the info_* fields ... View more

sourcetype=wims_auth | stats count as EVNT by APIP MACID | eventstats perc90(EVNT) as cutoff by APIP | where EVNT>=cutoff | stats sum(EVNT) by APIP ... View more

Yup, sort was killing it for me. Thanks! ... View more

@Sayanta_Basak_Infy You are adding on to a very old thread that has an accepted solution. For better chances at a helpful response, please post a new question describing your problem. ... View more

0 thank you, steveyz. i've added this information to the docs. ... View more

If you have a seperate event for session start and session end, you can do the following. Assuming that you extract a field 'type' that can take on either "START" or "STOP". apd OR tmm | eval count = if(type="START",1,-1) | sort + _time | accum count as concurrency | timechart max(concurrency) ... View more

I see no sub directories in the lookups directory, only csv files (lookup tables). Currently in $SPLUNK_HOME/etc/system/lookups ... View more

We don't run the streaming_preop if your command isn't the first reporting command. So basically you need to be a reporting command (retainsevents=false), and also you have to the first one. This is so that a reporting command can specify a optimization that will reduce what comes back from the indexers to only the sufficient statistics needed by that reporting command. You can specify that your pre-op is required via the requires_preop setting, but that only defeats the second requirement. There is no way that you can force a preop to be run if your command is not a reporting command. ... View more

Ah fair enough. So the problem no longer is searching for the empty string, but rather how to extract it so that I can later search for it. Still seems like I can't get it done properly. I either end up with '' as a value with AUTO_KV set to auto and with AUTO_KV set to "none" it will simply not recognize that the event with the empty field have a field-value pair at all. ... View more

Really you could do this: * [ search * | head 1 | eval earliest=_time | eval latest=_time | return earliest,latest ] ... View more

Transforms.conf, underneath the stanza defining your lookup, case_sensitive_match = false ... View more