Just add this to your current search | eventstats dc(Username_column) as countUsername by clientip_column ... View more

To get host as a column (basically one row for each for every time bucket ), you'd have to use this alternative to timechart. index=* host=abc_server tag=performance (cpu_load_percent=* OR wait_threads_count=* OR mem_free_percent=* OR storage_free_percent=*) | eval cpu_load = 100 - PercentIdleTime | eval mem_used_percent = 100 - mem_free_percent | eval storage_used_percent = 100 - storage_free_percent | bucket _time | stats eval(round(avg(cpu_load),2)) as "CPU Usage (%)", eval(round(avg(wait_threads_count), 2)) as "Queue Length", eval(round(avg(mem_used_percent), 2)) as "Memory Used (%)", eval(round(avg(storage_used_percent), 2)) as "Disk Space Used (%)" by _time host ... View more

I would do something like this index=oncall_prod currentPhase IN (ACKED, RESOLVED) | rename transitions{}.at AS ack | convert mktime(startTime) as start_time mktime(ack) as ack_time timeformat="%Y-%m-%dT%H:%M:%S%Z" | eval change=ack_time-start_time | search change>=0 AND change<=20000 | eval test=1 | chart max(test) over incidentNumber by currentPhase | stats sum(ACKED) as ACKED sum(RESOLVED) as RESOLVED | eval ReportDate=strftime(now(),"%F %T") | eval Diff=ACKED-RESOLVED | table ReportDate Diff   If you just want to show ... View more

Try something like this your base search for getting vulnerability data for each host, set time range to last two weeks OR 14 days | eval period=if(_time>=relative_time(now(),"-7d@d"),"This_Week","Last_Week") | stats values(period) as periods,..any other fields... by host vulnerability_id | eval remarks=case(mvcount(periods)=2,"Repeat Vulnerability",periods="This_Week","New Vulnerability", true(),"Fixed Vulnerability") ... View more

Give this a try | tstats latest(_time) as latest_time WHERE (index = fig*) (NOT index IN (fig2,fig3,)) sourcetype="abc" by host index sourcetype | eval silent_in_hours=round(( now() - latest_time)/3600,2) | where silent_in_hours>20 | stats dc(host) as silent_hosts max(latest_time) as latest_time by index source type | where silent_hosts=2 | eval latest_time=strftime(latest_time, "%m/%d/%Y %H:%M:%S") ... View more

I would say create a new app on Cluster Manager/Master ($SPLUNK_HOME/etc/master-apps/), say cisco_routing_props_transforms and create file "cisco_routing_props_transforms/local/props.conf" and "cisco_routing_props_transforms/local/transforms.conf". After that deploy the app to both indexer cluster peer. That way both indexers will always have same config. ... View more

Yes, since both indexers can index data and parse it, it should be on both. Since they're clustered, you could create an app containing those configuration and deploy it from Cluster Manager/master.  See this: https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Updatepeerconfigurations ... View more

The primary bucket rebalancing takes place among any existing peers that have searchable bucket copies. Since your newly added indexers do not have any primary bucket on it (based on information that they're not ingesting any data and RF/SF is 1 so buckets are getting replicated to them), nothing happens when you do the rebalance. ... View more

The data routing props/transforms are setup on node where data is parsed and usually it's the indexers where that happens. If you're using Heavy forwarder (a node with Splunk Enterprise on it and does the data collection), then the data parsing happens on heavy forwarder. Also, the null routing happens based on sourcetype/source/host and not index. So identify which sourcetypes/source/host are sending events with dest=53, write a regex which will run on _raw (raw data) and setup appropriate configurations for filtering out the data before indexing.  https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues ... View more

If you always want to exclude last 2 parts (regardless of how many segment your URL may have), try something like this (?<shorturl>.+)\/[^\/]+\/[^\/]+$   In-line search your search | rex "(?<shorturl>.+)\/[^\/]+\/[^\/]+$"   ... View more

Query #1 is giving fields host,hostGuid and "Days until expire". Your query #2 should contain field host and hostGuid (which it was in previous version). New version has fields customerName, customerGuid,  workspaceName and workspaceGuid, thus there are no matching host/hostGuid causing query to fail. If workspactName and workspaceGuid actually corresponds to host and hostGuid, rename them in query #2 so that they match, like this index=indexname environment=prod | rex "Certificates for server agent will expire in (?<expiry>\d+) days" | stats latest(expiry) AS "Days until expire" BY host environment | sort 0 "Days until expire" | eval host=rtrim(host, "prod.net") | eval host=(host."-prod") |lookup host hostName as host Output hostGuid |table host hostGuid "Days until expire"| eval from="events" | append [ | tstats count from datamodel=datamodelname where `ensure_model_activity` [| inputlookup host where hostGuid=".*" | eval host=hostName."*" | return 10 host] by datamodelfiled.workspaceGuid summariesonly=f allow_old_summaries=t | rename submissions.* as * | lookup workspace workspaceGuid output name as workspaceName currentCustomerGuid as customerGuid | lookup customer customerGuid output name as customerName | table customerName customerGuid workspaceName workspaceGuid | fillnull value="Not Found" | stats count by host hostGuid customerName customerGuid workspaceName workspaceGuid | fields - count | rename workspaceName as host workspaceGuid as hostGuid | eval from="lookup" ] | stats values(customerName) as customerName values("Days until expire") as days values(from) as from by host hostGuid | where mvcount(from)=2 | fields - from ... View more

Different count of rows OR different count for #_Failed_Logins? The number of rows depends upon the availability of events in Splunk, so they may not be same every day (unless you expect same number failed logins every day occurring on same hour every day). ... View more

I've not played with it yet, but this seems like the setting you need. On serverclass.conf, you've following attribute (available as global, for each serverclass and for each app, set this on your particular app only.) excludeFromUpdate=$app_root$/local This should prevent local directory on clients from being overwritten (I believe). Another option to achieve what you want to do (this I have used) is to use client Name. https://docs.splunk.com/Documentation/Splunk/8.2.5/Updating/Configuredeploymentclients#Set_a_client_name You'll basically add the serverclass-whitelist to a clientName and then just  set the clientName on the HF you want to be active. When the HF fails, you can just set the clientName to other available HF. The caveat is that if originally active HF comes back, it'll have that clientName setup and will receive the monitoring. So you'll have to find a way to turn that off (or switch the clientName dynamically between HFs). ... View more

Does the app have a local folder on DS? ... View more

You can run something like this to get alert when minimum time (timestamp of oldest event in the index) is older than 90% of the retention period:- | rest /services/data/indexes | table title minTime frozenTimePeriodInSecs | convert mktime(minTime) timeformat="%FT%T%z" | where now()-minTime>frozenTimePeriodInSecs*0.9 | convert ctime(minTime) | eval retention=tostring(frozenTimePeriodInSecs,"duration")  Problem with this is that it may give false positive. The retention is done based on size as well as age. Also, retention is done by the bucket and bucket is retired only when the newest event in the index is older than retention period. You can get an indication with this search but it may not be 100% full proof. ... View more

Yes you can. See this Splunk version upgrade documentation: https://docs.splunk.com/Documentation/Splunk/9.0.0/Installation/HowtoupgradeSplunk#Upgrade_paths_to_version_9.0 ... View more

Contact Splunk support to get the older version of Splunk. ... View more

Look at the field extraction config (regex) and see why it's failing for logs with no user value. You probably have to write a regex that puts null/blank if regex not found. We'd need  current regex and sample logs (for both where regex works and doesn't) to comment anything else. ... View more

Give this a try Your base search | table clientName, apiMethod, sourceSystem, httpStatus, version, timeTaken | stats count as totalCalls avg(timeTaken) as avgTimeTaken by clientName apiMethod sourceSystem httpStatus version ... View more

Use the case command, like this |eval comments= case(Action="create","something has been created", Action="delete","something has been deleted", true(),'comments') The option "true()" is for default option (when all preceding conditions do not match). ... View more

Try something like this sourcetype=amq_queues queue=ABC | where size > 0 | eventstats max(dequeueCount) as maximum min(dequeueCount) as minimum by queue | where maximum=minimum ... View more

It would be better if you provide information on how your (relevant) data is currently ingested in Splunk, what all fields are available and how they're related. Your SQL query gives the logic, but best solution could only be identified if we know how data is stored in Splunk. ... View more