Original Search sourcetype=xxx | dedup user | timechart span=1d count(user) I found that the results are different for selecting the different time ranges Time Range _time count(user) All time : 2019-10-20 269 during Oct 20: 2019-10-20 1473 Why I got different results by selecting different time ranges? Thank you ... View more

I have asked to find a way to keep log who and when the saved searches or dashboards got edited. I have already read a lot of posts here but it seems none of them could help. I tried the following query which I found in another post but it seems only showing when the scheduled query runs instead showing when did the saved search get edited. index=_internal sourcetype=splunkd_access ( method=POST OR method=DELETE ) ( user!=sandy user!=splunk-system-user) ( uri_path=/servicesNS/* uri_path!="/user-prefs/" uri_path!="/servicesNS////jobs//control" uri_path!=/servicesNS//mobile_access ) | replace "/ui/views" with "/ui_views", "/props" with "*", "/distributed/peers*" with "/distributed_peers", "/server/serverclasses" with "/server_class" in uri_path | where mvcount( split( uri_path , "/" ) ) > 6 | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method="DELETE" , "Deleted" ) | rex field=uri_path "/servicesNS(/[^\/]+){3}/(?[^\/]+)/(?[^\/]+)" | eval object_name = urldecode( object_name ) | table _time, user, object_name, object_type, activity ... View more

Hello, my user tried to feed in the CSV like log file in the Splunk and I have asked to do the field extraction. With the help from here, the task is almost can be done. However, they required the field extraction can handle the escape character and control character, for example the raw log is as follows. "2018-12-12T03:16:07Z","4B82113678C1ADDCF","4976","Test 20190109","Test\, analytics","test line 1\ntest line 2\ntest line 3","40000","2018-12-12T03:14:00Z","2018-12-12T04:14:00Z","Rm111" or following (Control C as delimiters between each field) "2018-12-19T10:04:29Z"^C"4B82113678C1ADDCFE81934078258730D08EDC49AF44B9DF683ED28961F39D54"^C"4978"^C"Test analytics 0109"^C"Test analytics with un-escaped double quote"^C"Test analytics with "un-escaped" double quote""40000"^C"2018-12-19T10:03:00Z"^C"2018-12-19T11:03:00Z"^C"Rm111" The reason why have this requirement as the log is CSV like in first version which is in the format "2018-12-12T03:16:07Z","4B82113678C1ADDCF","4976","Test 20190109","Test, analytics","test line 1 test line 2 test line 3","40000","2018-12-12T03:14:00Z","2018-12-12T04:14:00Z","Rm111" and my regex is ^"($ms)(?.)","(?.)","(?.)","(?.)","(?.)","(?.)","(?.)","(?.)","(?.)","(? .)"$ This able to handle most cases but since the description and name can be freely inputted by user, if there are "," pattern in the input, the field extraction would be wrong. Therefore we are looking for this issue. Would you please help me on this case as I do not have any idea on this. Thank you ... View more

I would like to create a dashboard to have some charts for showing statistics of occurrence. The query for plotting the chart is as follows. | chart count(range) as "Count" by range But, I would like to include the device with the range = 0. i.e. Which cannot be logged with Splunk but I have the static value that is calculated by Total - Count(range>0), how can I insert this value into the table so that it can be plotted on the chart? I know that the scenario is little bit hard to understand, to put it briefly , I would like to add a static value as one of the data into the existing table. Is it possible to do that? ... View more

Hi all, I tried to export my dashboard to the PDF but failed. The following error message is seen. Unable to render PDF. Exception raised while trying to render "Test2" to PDF. [Errno 101] Network is unreachable I tried to output another dashboard with map to PDF and working fine, therefore I sure that a map can be exported to PDF well. Anyone can share your experience or solution for me ? Thanks ... View more

We have developed a query to list out all the user accounts that login from a particular IP address, the table is as follows. IP Username Department xxx.xxx.xxx abc123 Dept A def456 Dept B efg789 Dept C -------------------------------------------------------------------- yyy.yyy.yyy xyz123 Dept A zxc456 Dept A -------------------------------------------------------------------- zzz.zzz.zzz aaa234 Dept A bbb456 Dept A ccc123 Dept C What we want to enhance the case now is removing the entry that with same department, that means the new table becomes IP Username Department xxx.xxx.xxx abc123 Dept A def456 Dept B efg789 Dept C -------------------------------------------------------------------- zzz.zzz.zzz aaa234 Dept A bbb456 Dept A ccc123 Dept C I have no idea on this. Anyone please help. ... View more

I have a lookup table sample_lookup.csv which consists of two fields, wildcard and location wildcard location *123* ABC *456* DEF I would like to add the location field to the existing search and create a new table so I can finally count the number of entries in each location. My existing search is as follows. Sample1 UserID 212389 AAA 345699 BBB 412366 CCC 545688 DDD I would like to have the table like this by matching the wildcard in the lookup table and add a location field in the new table: Sample1 UserID Location 212389 AAA ABC 345699 BBB DEF 412366 CCC ABC 545688 DDD DEF How can I make use of lookup to achieve this? It really stuck me for a long time =( ... View more