Try this: index=perfmon host=* counter="% Processor Time" | timechart span=5min avg(Value) | predict "avg(Value)" as prediction algorithm=LLP holdback=2 future_timespan=2 period=288 upper95=upper95 lower95=lower95 | `forecastviz(4, 2, "avg(Value)", 95)` | eval isOutlier=if('avg(Value)' > 'upper95(prediction)', 1, 0) | table host, isOutlier | search isOutlier=1 For the trigger conditions, set trigger alert when number of results are greater than 0 and trigger for each result with limited throttling set if you don't want to receive multiple email alerts ... View more

Try this: index=* | rex field=user "(?P<domain>^.*)\\(?P<userid>[3-5].*$)" This regex retrieves only the domain\userid where userid starts with either 3, 4 or 5 and any value for domain. Hope this helps!!! ... View more

Posted it 🙂 ... View more

Can you please specify the way this log is generated? Looking at the log snippet provided, this looks to be an issue with the way log is updated, since splunk indexes the log file and every new entry in the log should only get indexed. But, in this case, looking at the log snippet, looks like each updated entry is updating/refreshing the whole log file itself, making splunk to consider this as a new file to be indexed again since the crc value has changed: 02-19-2019 15:30:02.144 +0100 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/net/dell479srv/dell479srv2/apps/TheOne-RSAT/qcstTools/qcstOutFiles/qcst_out_toolsMonitoring_CheckToolLifeCycle.txt'. ... View more

Try this: .*\/(?P<field>.*\_\d{2})\_.*$ ,Try this: .\/(?P._\d{2})_.* ... View more