Does not answer the question. I know how to set this. I don't want to explicitly list every possible domain. I want a wildcard for the sake of maintenance.  ... View more

Still broken.  Solved my issue by running dbxquery output to a csv lookup, then using the normal lookups.  ... View more

Add a count and a | where count>1 - assuming your Conn values are not reused. ... View more

By client do you mean a forwarder? https://docs.splunk.com/Documentation/Forwarder/8.0.2/Forwarder/Controlforwarderaccess#Prerequisites_to_configuring_forwarder_access_control Or a user? https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/WhatyoucansecurewithSplunk ... View more

This is what I wrote for my system, the asset file contains the short name as Host and an Environment Column. | inputlookup MyAssets.csv | append [search * | rex field=host "^(?\w*).?" | stats count by Host ] | fillnull value=0 count | stats values(Environment) as Environment, sum(count) as Events by Host | fillnull value="Unknown Asset Reporting" Environment Hosts with 0 events are not reporting, and Hosts with Unknown environments are unknown assets. ... View more

My case # was 577972 - At the time I was running Splunk Build c8a78efdd40f for 7.0.0 ... View more

So far this is pretty ugly, but only substrings are working for me to extract from a clob. My system does not understand the XMLType data type. (DBX 3, Java 8 and Oracle JDBC driver for 18C) This runs... select DBMS_LOB.substr(a.My_OBJ, 3000 , 1) as MyXML1, DBMS_LOB.substr(a.My_OBJ, 3000 , 3000) as MyXML2 from MyTableWithClob a ... View more

The count function using an eval seems to require an AS clause. As per the doco: "count(eval(status="404")) AS count_status" However count(eval(status="404")) without an as clause will cause a job inspector failure, and sometimes you get a useful message: Error in 'stats' command: You must specify a rename for the aggregation specifier on the dynamically evaluated field 'count(eval(status="404"))'. ... View more

Support is stating that there is a fix in the works for this with a release soon. Until then, there are two possible options 1) Do not have more than 1 REX for the same field in your search, extract unique field names and then eval a new name at the end along this design pattern: | eval My_Field=if(isnull(my_field1),my_field2, myfield1) 2) The second is a work around to turn off optimizations by placing this at the end of your SPL | noop search_optimization=f Both of these options are working in my 7.0 install. ... View more

Hit this same issue in 7.0, all search modes, workaround did not work either. ... View more

I'm looking into lookups as a way to invoke a script at search time, either way as a custom search command or a lookup it looks like py is the answer. ... View more

The design pattern seems to be "concatenate a time value to the Stats by-clause variable that is consistent with the time based aggregation that you want, then separate the compound key and run eventstats to get sd and avg by the original key." Posting corrected answer syntax. {mySearch} | eval Loaded=mvzip(key,doc_count) | mvexpand Loaded | eval Loaded= split(Loaded,",") | eval KeyName=mvindex(Loaded,0) | eval Doc_Count=tonumber(mvindex(Loaded,1)) | search KeyName!="AFI*" | eval MasterKey=strftime(_time,"%Y-%m-%d" )."#".KeyName | stats latest(Doc_Count) as MyLast earliest(Doc_Count) as MyFirst by MasterKey | eval TotalDiff=tonumber(MyLast-MyFirst)| rex field=MasterKey "(?<YearDate>[^#]+)#(?<KeyName>.*)" | eventstats stdev(TotalDiff) as SD avg(TotalDiff) as AVG by KeyName | table MasterKey, KeyName, TotalDiff, SD , AVG | eval KeyStatus=if(abs(TotalDiff -AVG ) > SD*2, "RED", "GREEN") | fields MasterKey, KeyName, TotalDiff, SD , AVG, KeyStatus ... View more

I don't understand why one works and the other does not. This structure is logically equivalent to the original. Something weird in the appended stream when _time is modified? ... View more

Syntax in if statement should have a ) not a ]. also changed the eariest date to be -14d@d. ... View more

Changed latest to Now() and added an eval before date marker. result was just "last week" numbers looked good, but now this week was getting 0 record counts. ... View more