| search "body.refundTenderType"=*
| search "body.refundTenders{}.paymentType"=*
| rename body.refundTenderType as "RefundTender"
| rename body.refundTenders{}.paymentType as "RefundTenderPaymentType"
| stats count AS Count BY RefundTender RefundTenderPaymentType, body.orderNumber add this here
| eval Refund = RefundTender . "-" . RefundTenderPaymentType
| table Refund , body.orderNumber
| chart count by Refund
Try this if it works
... View more
index=windowslogindex EventCode=4663 AND Object_Type=File Accesses="ReadData (or ListDirectory)" OR Accesses="WriteData (or AddFile)" | stats dc(Accesses) as Count by "Insatnce ID or filename"
now where ever count = 2 those files will have logs for both read and write accesses.
I hope this helps.
... View more
Hey, I have found a similar issue with a proper answer
https://answers.splunk.com/answers/376095/how-can-i-split-a-json-array-in-mutiple-events.html
Hope this helps.
... View more
You can do it by adding depends=$token$ for panels.
like
<panel depends=$tokenCPU$> CPU PANELS </panel>
<panel depends=$tokenMemory$> MEMORY PANELS </panel>
and set these tokens in the input like
<input type="dropdown" token="type" searchWhenChanged="true">
<change>
<condition value="CPU">
<set token="tokenCPU">$type$</set>
<unset token="tokenMemory"></unset>
</condition>
<condition value="MEMEORY">
<unset token="tokenCPU"></set>
<set token="tokenMemory">$type$</set>
</condition>
<condition></condition>
</change>
... View more