We are looking to perform heavy calculations within Splunk from multiple sources. Currently the formula we are working with is something like: result = ( constant_value * ( avg_1 + avg_2 + 1 ) ) where there will be multiple results. I have found the limitation of eval only accepting one field within an algebraic request so I've broken this endeavor into multiple searches. The issue that I am running into is that while I can manually run my tiers of searches and get the results I expect, it does not work when I attempt to automate the searches. First I perform this search: index=first_index | dedup 1 finding IP | stats avg(first_number_average) as avg by IP | outputcsv first_average.csv This ensures that I only return the most recent finding for each IP and I generate a table of averages broken out by IP and write to a .csv file (which is monitored to be ingested into an index). Second I perform the search: index=second_index | dedup 1 different_finding_type IP | stats avg(second_number_average) as avg by IP | outputcsv second_average.csv This search looks at another set of data and returns the most recent different_finding_type for each IP and then generates another table of averages by IP and gets the same treatment of output to CSV and re-indexed. Finally I schedule a search to spit out the result with the search: index=csv_monitoring_index IP=w.x.y.z | stats sum(avg) as avgpt1 by IP Address | eval result=(0.2*(avgpt1+1)) | table IP result | outputcsv result_IP.csv I have found performing these searches manually results in correctly outputting CSV files and indexing the results for the following step to utilize. I find that when placed into staggered scheduled searches the .csv files are not being written to, despite the searches resulting in findings when input manually. I saw that the final search can not be summary indexed due to the eval that occurs after the stats command. That is the setup and the wall I seem to have run up against is a limitation on being able to pipe to outputcsv for a scheduled saved search when the commands produce the intended results when performed manually. Any help is appreciated, or insight into possible ways of performing calculations a little more involved than what the current eval capability provides. ... View more

Hello there, So I built this query and as the case often is it worked fine with a smaller set of test data but does not behave as expected with a larger set. When working as planned this search language returns a tally of how many times a feature in our system triggers as well as a total duration that the feature was turned on (broken out by location). This worked fine with a smaller set of data. With a larger amount of events it seems to return inflated numbers that I couldn't find any pattern to the amount of increase. Some triggered totals are off by as much as 6, some as little as 3 or 4. The "duration on" totals end up being off by +50% more to almost +200% more. index=stuff | transaction startswith="Feature_On" endswith="Feature_Off" | eval FeatureToggled=if(status="Feature_Off",1,0) | stats sum(duration) as D sum(FeatureToggled) as "Times Feature Triggered ON" by Location | eval "Total Feature Duration (min)"=(D/60) | fields "Times Feature Triggered ON" "Total Feature Duration (min)" Location The information is correct when I specify which "Location" at the beginning of the query so I think it may be incorrectly counting events from other locations when searching/tallying across all locations. I threw a location-picker into the dashboard that displays this information for the time being. Ideally I can tweak this query to display accurate totals/counts for all sites with a single search. Any help is greatly appreciated, thank you very much! ... View more

So I have events which have the following fields that I would like to sort by: app, dst_ip, bytes Preferably I would want to display them in a table such as: web-browsing I'M.A.DST.IP 1571453 I'M.A.DST.IP 71453 I'M.A.DST.IP 1453 skype I'M.A.DST.IP 1412345 gmail-base I'M.A.DST.IP 1012345 I'M.A.DST.IP 212345 ssl I'M.A.DST.IP 612345 I'M.A.DST.IP 123456 I'M.A.DST.IP 12345 I'M.A.DST.IP 1234 The sort function would be preferably be having these apps sorted via "-bytes" but also showing a breakout of associated dst_ips and their respective bytes count under each app (again sorted via -bytes). I am hoping this is possible via the search language whether it is with table or any other data formatting command. I recall stumbling across a grouping command before and I can't seem to find it again. Thank you for any help/assistance on this. Sincerely, Alex ... View more

I've been trying to utilize the linebreaker to break an xml file into multiple Splunk events. I've tried many different ways. I had looked at this example and I'm still having trouble. Here is the Code I believe should work: Inputs.conf ######### [monitor:///opt/reports] source = TRAFFIC sourcetype = app_log index = traffic props.conf ######### [source::TRAFFIC] TIME_PREFIX = \<CreationDate\> TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N SHOULD_LINEMERGE = false LINE_BREAKER = \>\s*(?=\<entry\>) REPORT-xmlext = xml-extr Below is an excerpt from the xml file I am trying to ingest. - <response status="success"> - <report name="Top applications" logtype="appstat" start="2011/05/17 00:29:20" end="2011/05/17 01:29:19" generated-at="2011/05/17 01:29:20"> - <entry> <risk-of-name>4</risk-of-name> <name>dns</name> <nsess>1197</nsess> <nbytes>336017</nbytes> <nthreats>0</nthreats> </entry> - <entry> <risk-of-name>4</risk-of-name> <name>ssl</name> <nsess>542</nsess> <nbytes>10747761</nbytes> <nthreats>0</nthreats> </entry> - <entry> <risk-of-name>4</risk-of-name> <name>web-browsing</name> <nsess>341</nsess> <nbytes>8085374</nbytes> <nthreats>2</nthreats> </entry> Thanks for any help! ... View more

I would like to be able to combine the following two searches or at least be able to reference the output of the searches to display them as a ratio or percentage of "count/sum(RX)" broken up by splunk indexers: source="netstat" | chart sum(RX) by splunk_server sourcetype="threats" | chart count by splunk_server These searches both reference different sources and they currently are displayed by splunk indexer in a table. Any help is much appreciated, thank you for any help. ... View more

Hello, I'm having difficulty implementing the drilldown from the example UI dashboard. The search itself works on it's own but this is my first stab at drilldowns and I've hit a wall. After I select a severity from the column chart I am told my drilldown table finishes without any results. Any help is appreciated, I've pasted my code below. Thanks! <module name="HiddenSearch" autoRun="True" layoutPanel="panel_row1_col1_grp1"> <param name="search">sourcetype="pan_threat" subtype="spyware" | chart count by severity</param> <module name="HiddenChartFormatter"> <param name="chart">column</param> <param name="chartTitle">Count by Severity</param> <param name="legend.placement">none</param> <param name="primaryAxisTitle.text">Time</param> <param name="secondaryAxisTitle.text">Count</param> <module name="JobProgressIndicator"/> <module name="FlashChart"> <param name="width">100%</param> <param name="height">200px</param> <param name="enableResize">False</param> <module name="HiddenSearch"> <param name="search">sourcetype="pan_threat" subtype="spyware" | top 10 threatid</param> <param name="earliest">-1h</param> <!-- this module will grab the value we clicked on and put it in as a searchterm, severity="someSourcetype". --> <module name="ConvertToIntention" layoutPanel="panel_row1_col1_grp2"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="severity">$click.value$</param> </param> </param> <!-- finally, we render the search in another FlashChart, and we throw in a JobProgressIndicator for good measure. --> <module name="JobProgressIndicator"></module> <!-- We throw in a header so we can tell the user what they clicked on. --> <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">Top Threats for Severity=$click.value$</param> </module> <module name="SimpleResultsTable"> <param name="displayRowNumbers">False</param> <param name="drilldown">row</param> <param name="entityName">results</param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> <module name="SimpleResultsTable"> <param name="displayRowNumbers">False</param> <param name="drilldown">row</param> <param name="entityName">results</param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> ... View more