index=* host="123.0.0.456" source="/etc/tomcat/logs/catalina.out" or do nslookup 123.0.0.456 to get hostname if host field is a name. ... View more

Hi VanyBerg, As you didn't mention any time field, I have taken _time as reference I used _internal index, you can try this and modify the query per your requirement. index=_internal | eval time_hour=strftime(_time, "%H") | eval time_hour=case(time_hour <9,"1",time_hour <17,"2", time_hour <24, "3") | stats count(_raw) as count by time_hour | appendcols [ search index=_internal | stats count as Total_count ] | eval Average_value=count/Total_count You need to add src to stats if you need to get stats by src Hope it helps. ... View more

Hi, Actually dedup TransactionID should work if you are looking for distinct transactions. But if you are looking for all the logs per each transaction, you can try transaction command. index=bc-dag-app AND ERROR | transaction TransactionID Hope, it helps. ... View more

Hi @ravikiransharma, One way I could think of is, create separate input fields for 3 inputs. So, you will have 3 tokens. Use Machine Name token in the panels 1/2 and Ip address token in 3/4. Hope it helps. ... View more

Hi @jkrehrer22 Try this: | makeresults | eval timestamp_field = "4/8/19 6:01:47.200 PM" | eval timestamp_field= strptime(timestamp_field, "%m/%d/%y %I:%M:%S.%3Q %p") | fieldformat timestamp_field = strftime(timestamp_field, "%d/%m/%Y %H:%M:%S") ... View more

To make the field visible in event list along with metadata, it doesn't necessarily have to be metadata field. If you can add it during the indexing time and make it appear in Interesting fields during search, you just have to mark it as a selected field and it will appear in your event list along with your metadata(i.e. host, sourcetype, source). ... View more

Looking at this specific error: ERROR IntrospectionGenerator:resource_usage - KVStoreConfigurationProvider - Unable to read an X509 cert from '' file. It seems like the file was not found. Make sure the $SPLUNK_HOME variable is set and verify the cert file in the specified path and try again. ... View more

You can search directly like this: index="your index" "10.196.x.x" ... View more

@moizmmz try this: I think for this scenario you may have to use eventstats. It will calculate the sum of concurrent sessions by account into a new field as you require. Hope it helps index=video-eng-live | rename message.timestamp as time | eval time=strftime(time/1000, "%m-%d-%Y %H:%M:%S") | dedup message.concurrent_sessions, time | eventstats sum(message.concurrent_sessions) as "Concurrent Sessions" by message.account | addcoltotals labelfield=message.account label="Total" ... View more

@williamcharlton0028 Looking at your statement: My goal is to extend the query such that the search results includes only N events where N is the number of unique chunk values evaluated at the time the search is run. For obtaining unique values, dedup didn't worked for you? To my understanding you should try something like this index=myindex widget="widget_a" | dedup chunk ... View more

Hi, I hope you know that free license also includes only 500 MB indexing per day. If you have crossed daily license, you may have to wait until the midnight for it to get reset. If you have already crossed 5 violations on your free trial enterprise splunk license and turned to free license, you may have to wait until there are less than 3 license violations in previous 30 days. ... View more

Assuming that you are looking for sum(Degradation_Time) by file and then percentage, not count. See my answer below: eventtype="Start" AND (NOT host=E* AND NOT host=I*) | eval Degradation_Time=coalesce('Durée de la dégradation','Degradation Time','Tiempo de degradación','Beeinträchtigungszeit') | eval File_Name=coalesce(Nom_du_fichier,File_Name,Dateiname,Nombre_de_archivo) | stats sum(Degradation_Time) as Degradation_Time_By_File by File_Name | appendcols [search eventtype="Start" AND (NOT host=E* AND NOT host=I*) | eval Degradation_Time=coalesce('Durée de la dégradation','Degradation Time','Tiempo de degradación','Beeinträchtigungszeit') | stats sum(Degradation_Time) as Total_Degradation_Time] | filldown Total_Degradation_Time | eval Percent_Degradation_Time_By_File =(Degradation_Time_By_File*100)/Total_Degradation_Time Hope it works ... View more

If you want to consider distinct count as well, try this: eventtype="Start" AND (NOT host=E* AND NOT host=I*) 2. | eval Degradation_Time=coalesce('Durée de la dégradation','Degradation Time','Tiempo de degradación','Beeinträchtigungszeit') 3. | eval File_Name=coalesce(Nom_du_fichier,File_Name,Dateiname,Nombre_de_archivo) 4. | stats dc(Degradation_Time) as Total by File_Name 5. | top Total by File_Name ... View more

Hi, you can try top command(by default it will give 10 results, so I haven't used limit): eventtype="Start" AND (NOT host=E* AND NOT host=I*) 2. | eval Degradation_Time=coalesce('Durée de la dégradation','Degradation Time','Tiempo de degradación','Beeinträchtigungszeit') 3. | eval File_Name=coalesce(Nom_du_fichier,File_Name,Dateiname,Nombre_de_archivo) 4. | top Degradation_Time as Total by File_Name ... View more

Ok, so I have used a transaction command to group all events with CPU usage >=90%. And finally using where command filtering out transactions that were less than 10 min duration. Can you try this and let me know if this is what you are looking for: index=perfmon host= object="processor" counter="%_processor_time" instance =1 | eval minutes_above_90_pct = if(Value>=90,2,0) | transaction host minutes_above_90_pct startswith=eval(minutes_above_90_pct==2) endswith=eval(minutes_above_90_pct==0) | where duration > 600 ... View more

Actually it should be capital V in Values, can you try this: index=perfmon host= object="processor" counter="%_processor_time" instance =1 | eval minutes_above_90_pct = if(Value>=90,2,0) | stats sum(minutes_above_90_pct) as sum_minutes by host Coming to displaying in dashboard, if frequency of query is 2 min and search range is last 10 min, you can do this: ....... | where sum_minutes = 10 | fields host If your search range is more than 10 min, filter the events for last 10 min and run stats sum ... View more

If you are just looking for a static count of minutes for which the CPU crossed 90%, I think you can try this: index=perfmon host=* object="processor" counter="%_processor_time" instance = * | eval minutes_above_90_pct = if(value>=90,2,0) | stats sum(minutes_above_90_pct) by host I have used 2 in if condition as you are collecting data for every 2 min (assuming the CPU > 90% for those 2 min) Let me know if it works ... View more

As you don't have source_mac in both source types, we are renaming mac_address in source type B to source_mac to facilitate join with source type A. Not sure why it didn't work. ... View more

One correction in "if" function is already mentioned by renjith. Regarding returning a blank value: When you use count, it will always return an integer, you may have to use another eval to set the field to blank if it is "0". ... View more

To my knowledge, you cannot pass the whole query from the output of lookup for a search. But if you have query with fixed variables as you mentioned in the sample and constant query, you can try something like this: index=abc I where api=fig I table api msg Split the fields from the query into individual fields ex: index_from_lookup=abc , api_from_lookup=fig, so you lookup looks like this Name Subcategory index_from_lookup api_from_lookup Get Vehicle abc fig Post Summary cfg his and then pass them to map command after the lookup. Sample is shown below. I have used "where" instead of "lookup command" for sample as I don't have the csv to do lookup |makeresults | eval Name="Get" | eval category="Vehicle" | eval index_from_lookup="_internal" | eval file_from_lookup="shelper" |append [|makeresults | eval Name="Post" | eval category="Summary" | eval index_from_lookup="_internal" | eval file_from_lookup="messages"] | where Name="Post" AND category="Summary" | map search="search index=$index_from_lookup$ file=$file_from_lookup$ | table method, output_mode" If you have limited searches in lookup and if you can create macros for each search, you can try this after you have the macro name from output of lookup | map search="search $macro_name_from_lookup_output$ " (This will not be an option for you if you have 1000 different queries in your lookup). Hope it helps. ... View more

Hi Tullir, Did you get a chance to test this? Just want to know whether it worked or not ... View more

As you are looking for highest value of sizesent, sort it based on that field and then use dedup ... | sort time, ip_address, -sizesent | dedup time ip_address Let me know if it answered your question ... View more