In your search, you need to escape your quotes, like this:  search="search index=list-service source=\"eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;\" \"kubernetes.namespace_name\"=\"list-service\" | stats dc(kubernetes.pod_name) as pod_count" or use single quotes around the search contents: search=‘search index=list-service source="eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;" "kubernetes.namespace_name”="list-service" | stats dc(kubernetes.pod_name) as pod_count’   ... View more

Below one works for me.  | gentimes start=1 end=5 | eval [| makeresults | eval foo="test" | return foo] ... View more

The last search just shows a list of users with a active/inactive field right? What i am looking for is if a user goes from inactive -> active ... View more

Thanks! ... View more

Hi, Sorry for coming again, I have verified the output table and the table contain only the field of sourcetype1 and the sourcetype2  field values are showing blank ... View more

Ah....so even if the user deletes their report the job keeps running?  ... View more

Hi Jwalthour Nope. Haven't opened a support case yet.  Thought of asking here first. ... View more

Hi @leecholim, good for you, see next time. Remember to accept the answer for the other people of Community and Karma Points are appreciated by all the Contributors. Ciao and happy splunking. Giuseppe ... View more

Can you provide more information about your data? Generally, you could | timechart span=1d count(eval(result==“success”)) as successes count(eval(result==“failure”)) as failures to help you further, I’d need to know more.  ... View more

That makes sense. Thank you so much appreciated! ... View more

With the current simpleXML, you cannot use page anchors. However, you could use “depends” where clicking on values at the top of the page reveal the associated panel. Have a table at the top of the dashboard with the choices of panels as rows down or columns across. Use the drilldown functionality to set a token. The value of the token is used in subsequent panels, initially not visible, to make one of the panels visible, whichever depending on the value clicked at the top. ... View more

Thanks for your recommendation, I think I understand  the cause of this problem. I'll try another way to index those log file. ... View more

Hi jwalthour, I'm new here and found your response here in community (even when far in the past) as I have same issue that .splunkrc file is not recognized. My understanding was, that if I have this file correctly setup and stored, I do not need to enter any login data to any Python script at all. But if I understood your Python example correctly, it ask actively to enter credentials and host/port  when I execute login.py   ... View more

Yes, I checked splunkd and the DBX logs and there was nothing that shed any light on the cause of the error. ... View more

This search might work for you: index=_audit action=search info=granted search_id=* | append [search index=_internal sourcetype=splunkd action=search info=granted search=*] | fields search_id search | table search_id search ... View more

Is there a suggested article on how to update the cacert.pem with the root or intermediate SSL certificates ? ... View more

@jwalthour - Did the answer provided by Steve G. help provide a solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks! ... View more

Like this: | rex "(?ms)^(?:[^\t]*\t){2}\"?(?<message>.+)\"?\t(?:[^\t]*\t){4}[^\t]*$" ... View more

Thank you, woodcock! ... View more

Here is some documentation on how you can achieve that http://docs.splunk.com/Documentation/Splunk/6.2.8/Viz/tokens#Conditional_operations_with_form_inputs ... View more