If you would like to avoid cumbersome regex rules and are just looking for the fourth directory (or 0-4 directory path) you may want to consider the Splunk Multivalue eval functions "mvindex", "split", and "mvjoin" to do the work for you... note that the "nomv" commands are optional in most cases.   | makeresults | eval filepathname="/usr/local/myfiles1/myfacilityA/Debug/ADT/ADT_2019-07-30.txt" | eval Dir4=mvindex(split(filepathname,"/"),4,4) | nomv Dir4 | eval Dir0to4=mvjoin(mvindex( split(filepathname,"/"),0,4), "/") | nomv Dir0to4     ... View more

For just getting the basename / filename from a file path (e.g. executable file from Windows Security 4688 - new process event) I would just use the Splunk built-in Multivalue eval functions "split" and "mvindex" commands.  If regex can be avoided for simplicity, I would suggest that - unless it is the best tool for the job. | eval ExeName=mvindex(split(New_Process_Name,"\\"),-1)   ... View more

If the query needs to be filtered down to a subset of hosts (rather than ALL hosts that have logged to the Splunk indexer) that can be defined in a lookup table (e.g. MyHosts.csv with hostnames under the "host" column), this search can be run, but will only return results over the search time frame... so the subset of hosts (i.e. Asset list) must be appended to find out "what hosts are missing" via the "foundevents" field. As also noted, one can also check for a delay of "600" seconds or greater (i.e. >10 minutes) as well... i.e. to find host and sourcetypes "without events" or latest whose latest event is "more than 10 minutes old" (but still within the current search time range).     | tstats count as eventcount, latest(_time) as lastTime where index=* [| inputlookup MyHosts.csv | stats values(host) as host] by host, sourcetype, source | append [| inputlookup MyHosts.csv | fields host ] | dedup host `comment("Need to dedup by sourcetype possibly as well here")` | eval foundevents=if(sourcetype="PutYourSourceTypeHere",1,0) | eval delaySecs=now()-lastTime | eval delayDur=tostring(delaySecs,"duration") | where foundevents=0 or eventcount=0 or delaySecs>600             ... View more

I have been struggling with the same issue... cannot seem to get another panel search to be disabled and stop running. Even when all of the "searchWhenChanged" fields are set to false. https://answers.splunk.com/answers/231685/how-to-disable-a-search-for-a-dashboard-panel.html ... View more

I have the same problem... In my case I am trying to have both a "dry run" and "update" option to the search. 1) I tried disabling / enabling the panel "view" but that did not work. https://answers.splunk.com/answers/639048/how-to-make-panel-depend-on-token-value.html 2) I also tried changing the function of my "final Search" (last line in my search query) to a "dry run: dummy search string" and the "update: append to lookuptable". It seems that since this changes the "search query itself" -- the panel search query gets rerun -- even though the "Submit" button has not been selected. All other form input fields (note: 'search on change' is disabled for all) simply change variables rather than search queries themselves though. On my dropdown input, it seems explicitly stating searchWhenChanged="false" does help. <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="input-dryrunORupdate" searchWhenChanged="false" > <label>DryRun or Update</label> <choice value="DryRun">DryRun</choice> <choice value="Update">Update</choice> <change> <condition value="DryRun"> <set token="tokFinalSearch">eval x=y | fields - x</set> </condition> <condition value="Update"> <set token="tokFinalSearch">outputlookup append=true access-events.csv</set> </condition> </change> <default>DryRun</default> <initialValue>DryRun</initialValue> </input> <!-- ... more inputs ... --> </fieldset> The last line of my panel search query is: | $tokFinalSearch$ ... View more

This form example above no longer passes validation on Splunk 8.0.1 and maybe earlier, however one can copy the latest example from within the "Dashboard Examples App". <form> <label>Form Elements Within Panels</label> <description>Dashboard Examples: Example of placing form elements within a panel.</description> <row> <panel> <input type="dropdown" token="sourcetype1" searchWhenChanged="true"> <label>Source types for _Internal All</label> <choice value="*">All</choice> <choice value="splunkd">splunkd</choice> <choice value="splunk_web_access">splunk_web_access</choice> <default>splunkd</default> </input> <chart> <title>_Internal All</title> <search> <query>index=_internal sourcetype="$sourcetype1$" | timechart count</query> <earliest>-4h@h</earliest> <latest>now</latest> </search> <option name="charting.chart">line</option> <option name="charting.legend.placement">none</option> </chart> </panel> <panel> <input type="radio" token="sourcetype2" searchWhenChanged="true"> <label>Source types for _Internal Top 3</label> <choice value="*">All</choice> <choice value="splunkd">splunkd</choice> <choice value="splunk_web_access">splunk_web_access</choice> <default>*</default> </input> <event> <title>_Internal Top 3</title> <search> <query>index=_internal sourcetype="$sourcetype2$" | head 3</query> <earliest>-4h@h</earliest> <latest>now</latest> </search> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="rowNumbers">0</option> <option name="type">list</option> <option name="count">5</option> </event> </panel> </row> </form> ... View more

Note that the latest link to "Routeandfilterdatad" is under the "Forward" rather than "Deploy" documentation path. https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad ... View more

I am trying to figure out the same issue as well... ... View more

thank you, that additional eval() worked. It was so frustrating that the "round()" and "floor()" commands can be used like this in a stats function or eval the field after the stats function... but with the chart functions they are charted immediately and simple function wrapping without "eval()" is not accepted as valid by the chart commands. ... View more

The link to the "SplunkCloud" docs apparently require a logon, for general public details here is a better link: https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Use_the_.22Full_Name.22_log_property_in_Event_Viewer_to_specify_complex_Event_Log_channel_names_properly ... View more

This is not my question so unfortunately I cannot accept the answer, though I did award points! I am unable to reconstruct the use case with timechart (e.g. index=wineventlogs sourctype=wineventlog:security EventCode=4624 | timechart span=1h count by user ) ... in that case I do get the "0" valued filled in for each time span. So I am not sure how the OP's "index=my5msummary" is set up. ... View more

Very interesting concept and approach... this looks like it would work. I just had to reference the "kv" is an alias for the extract command and only works on "_raw" data (in this case, in a subsearch). ... View more

Same here... looking for a solution. Fillnull only works if you have empty field events for the bin times. Update: Actually in my simple case, changing from "| bin _time | stats count by _time" to "| timechart count" did work and fill in empty time bins with the value "0" for charting. ... View more

Please see the example I added below from the Splunk Dashboard Examples app. Nesting tags: dashboard > row > panel > single > title > search. ... View more

To convert my original dashboard with a "row of panels" into a "single panel" with a row of visualizations, all I had to do was Edit > Source and move the "title" tags of these panels to be inside the "single" tags, then remove the "panel" (close and open) tags in between each visualization. I found this reference in the "Splunk Dashboard Examples" app: https://splunkbase.splunk.com/app/1603/ Open the "Splunk Dashboard Examples" app and scroll down to "Layout Elements" > "Panel Grouping with Single Values". This is available in Splunk 6.4+. <dashboard> <label>Panel Grouping with Single Values</label> <description>Group multiple single value elements, aligning horizontally.</description> <row> <panel> <!-- 2 elements are grouped into 1 column --> <single> <title>Single panel 1</title> <search> <query>index=_internal earliest=-h | stats count</query> </search> ... </single> <single> <title>Single panel 2</title> <search> <query>index=_internal earliest=-24h | stats count</query> </search> ... </single> </panel> </row> ... ... View more

Incomplete solution: Note that your "dedup PID Source" command in the first search discards multiple new process events, since the PID (Process ID) is quite frequently reused on Windows (i.e. even within 1 hour on my test system), so you are only collecting the latest Process name tied to that PID at the time of the search -- i.e. not necessarily the Process name / PID that was the "Creator_Process_ID" in your second search. Instead try "| table _time PID Source Process | sort PID - _time" or "| stats count values(Process) by PID" to see what you are discarding. Unfortunately this rather common use case appears to be a rather complex one to solve efficiently. Update: Just noticed that Win 10 and Server 2016 added "Creator_Process_Name" field which would help identify parent & child process in the same event, and Sysmon new process Event ID 1 also includes "ParentImage" name as well. ( ref msft ref securityaffairs ref sec:4688 ref sysmon:1) 1: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688 2: https://securityaffairs.co/wordpress/65570/hacking/powershell-attacks.html 3: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4688 4: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?source=Sysmon&eventID=1 ... View more

Need to replace the "less than" (<) and "greater than" (>) brackets with the HTML rendering of the same: "& l t ;" and "& g t ;" (but remove the spaces in between the characters). You can test this by saving any Splunk search with brackets as a dashboard panel, then editing the dashboard to view the XML source. For example, your search string: | rex field=_raw "PhoneNo*=(?< PhoneNo >\d{8})+*" when placed in a Splunk XML dashboard becomes: | rex field=_raw "PhoneNo*=(?%lt;PhoneNo %gt;\d{8})+*" ... View more

While I have not been able to test this myself, the Splunk Cheatsheet (latest ver 2.21, Feb 2019) from MalwareArchaeology.com includes an example of how to do this in Splunk with some snippets here. Note that only 10 blacklists can be entered per [WinEventLog://Security] disabled=0 current_only=1 blacklist = 4689,5158 blacklist1 = EventCode="4688" Message="(?:New Process Name:).+(?:SplunkUniversalForwarder\\bin\\splunk.exe)|.+(?:SplunkUniversalForwarder\\bin\\splunkd.exe)|.+(?:Splunk UniversalForwarder\\bin\\btool.exe)" ... blacklist4 = EventCode="4688" Message="(?:Process Command Line:).+(?:system32\\SearchFilterHost.exe)|.+(?:find /i)|.+(?:Google\\Update\\GoogleUpdate.exe)|.+(?:WINDOWS\\system32\\conhost.exe)" From the splunk docs on filtering Windows Events with inputs.conf (keywords: whitelist, blacklist), it notes: You can have multiple key/regular expression sets in a single advanced filtering entry. Splunk software conjuncts the sets logically. This means that the entry is valid only if all of the sets in the entry are true. You can specify up to 10 blacklists per stanza by adding a number to the end of the blacklist attribute, for example blacklist1...blacklist9. ... View more

The field names that you enter separated by a comma, act as an "AND" operation in accordance with the Alerting Manual - Throttle Alert reference. For example, if your Alert search query summarized alert signature hits per host like the following fields to a table: |table hostname, signature_id, signature_hit_time, signature_hit_count If you set the Alert trigger as Per-result (For each result), enabled Throttle, and in the Suppress results containing field value added hostname, signature_id then the "Per-result" alert for that combination of "hostname AND signature_id" would be suppressed via Suppress triggering for time value. (in Splunk 7.2) https://docs.splunk.com/Documentation/Splunk/latest/Alert/ThrottleAlerts ... View more

That sounds correct according to the Alerting Manual - Throttle Alerts guide. Though in addition to your use case above for events, i.e. Event #4 "(No alert, threat level not = to Critical)" you would just need your Alert search query to include: |search "Threat Level" = "Critical" to filter only those events to alert on. https://docs.splunk.com/Documentation/Splunk/latest/Alert/ThrottleAlerts ... View more

Another hack, is you could select one entry from the lookup table, modify the field values with "eval" commands, then append to the original lookup table. Considering things-table.csv: thing,color,weight 1,blue,"1.1" 2,green,"2.2" 3,red,"3.3" The following command will lookup the first entry, modify it, then append to the lookup table: | inputlookup things-table.csv | search thing=1 | eval thing="4",color="purple",weight="4.4" | outputlookup append=t things-table.csv Then "|inputlookup things-table.csv" will have the output: thing,color,weight 1,blue,"1.1" 2,green,"2.2" 3,red,"3.3" 4,purple,"4.4" ... View more