I have a search that captures a specific product code, calculates the total number of units attributed to the product code that were sold over the timeframe assigned to the search (say, seven days), and presents the data as a timechart. The search also references a lookup table to provide a "human friendly" name that matches the product code, along with a baseline value which reflects a specific number of units expected to be sold each day. The search looks like this... sourcetype=foo index=bar item="productA" | lookup product_table.csv productCode AS item | timechart span=1d sum(product_count) as volume by item | eval baseline = max(dailyBaseline)   ...and the lookup table looks like this: productCode name dailyBaseline productA Widget 5000 productB Thingamajig 10000   I would like the ensuing chart to show the baseline I've defined in the lookup table. If I replace "max(dailyBaseline)" in the eval statement with a static value such as 5000, it works fine. I can't figure out how to get the "dailyBaseline" value from the lookup table to work, though. ... View more

I'm using a pretty straightforward query to see how many unique HTTP status codes are thrown from an IIS server during a given time period:   index=foo host=bar sourcetype=iis85 | top sc_status   The results are as follows:   sc_status count percent 401 95115 36.975773 302 91840 35.702623 200 70141 27.267179 404 140 0.054425   Adding the percentage values for each of the status codes together equals 100%. I'd like to run the search across a longer timeframe (24 hours) and visualize on a line chart the percentages for each status code using a five minute aggregation. How can I accomplish this? ... View more

I have a line chart panel in my dashboard that's comparing two series of datapoints, and I have "charting.legend.mode" set to "seriesCompare" to see the values next to the appropriate series name in the legend. Trouble is, the font color used for those values is very light and difficult to see.  Can an adjustment be made to change the font color of those compare values? I've circled the value in the screen capture below:     ... View more

I'm working on a query with the goal of determining the percentage rate of request/response event pairs that match by way of a common field value. The events share the same index, sourcetype and source; the field name, however, is different. The field in the request event is called "ID" while the field in the response event is called "InResponseTo". NOTE: The response event also contains a field called "ID" which should be ignored. Here is a sample of each type of event (note that these two events share the matching value "_907b4184-e85c-41f2-9a32-c1c735f01510")... Request:   Oct 26 17:32:29 ServerX knick.knack [10/26/22, 17:32:20:292 EDT] 00018baf id=00000000 om.tivoli.am.fim.trustserver.sts.utilities.IDMappingExtUtils I traceString INFO --saml20-access-policy-utilities.js - [axamf4EhUmaVjkwwd+akl10BbjbDS1vVg6YJhu2F2E8=]:[protocolContext.getAuthnRequest()] <samlp:AuthnRequest xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://xyz.com" Destination="https://foobar.com" ForceAuthn="true" ID="_907b4184-e85c-41f2-9a32-c1c735f01510"</samlp:Response>   Response:   Oct 26 17:32:29 ServerX knick.knack [10/26/22, 17:32:20:455 EDT] 00018baf id=00000000 .am.fim.saml20.types.SAML20HTTPPostBrowserResponseWriterImpl 1 getStringMessage Request XML message: <samlp:Response xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Destination="https://dundermifflin.com" ID="FIMRSP_1635e05b-0184-1dc4-803d-f94b11a6d04e" InResponseTo="_907b4184-e85c-41f2-9a32-c1c735f01510"</samlp:Response>   The development flow: Look at all request and response events for a given timeframe. Sometimes, duplicate events show up...so they would need to be deduplicated. If the same value is found for both "ID" and "InResponseTo", that's considered a 100% success rate. Mark it as a match. The sample events provided above would be an example of this. If the same value is not found (i.e., there's a request event but no matching response event), that's considered a 0% success rate. Mark it as a non-match. Add up the number of matches and divide the sum by the total number of request events found. Multiply the quotient by 100 to determine the percentage rate. The results will be visualized using a simple line chart (timechart) showing the average percentage rate over time. I'm able to compare the overall number of requests against the overall number of responses (regardless of matching field values) to produce a percentage rate, as shown here:   index=zig sourcetype=zag samlp:AuthnRequest | timechart count as RequestCount | appendcols [ search index=zig sourcetype=zag samlp:Response | timechart count as ResponseCount ] | eval ResponseRequestRatio = round(((ResponseCount/RequestCount) * 100),2) | table _time, RequestCount, ResponseCount, ResponseRequestRatio   How would I modify this query to accommodate the additional rules? I'm guessing that some sort of count could be used to determine the percentage rate, with a "1" for matches and a "0" (zero) for non-matches. ... View more

I'm working on a search that evaluates events for a specific index/sourcetype combination; the events reflect SSO information regarding user authentication success as well as applications the user has accessed while logged on. The search is a result of an ask to identify how many users have accessed 10 or fewer apps during their logon session.  For the user, I'm using a field called "sm_user_dn"; for the app name, I'm using "sm_agentname". My search looks like this currently:     index=foo sourcetype=bar | table sm_user_dn, sm_agentname     This is pretty basic, and shows me all the user name/app combinations that have been reported in the events.  At this point, how do I tally up the number of apps per user and only show the users which have nine or fewer apps associated with them? ... View more

I have the following events that arrive every five minutes from a pool of servers (two servers' events shown):   Aug 2 18:00:23 ServerX stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache LRU expired : 0 Aug 2 18:00:23 ServerX stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache lifetime : 0 Aug 2 18:00:23 ServerX stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache inactive : 21157 Aug 2 18:00:23 ServerX stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache del : 297 Aug 2 18:00:23 ServerX stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache add : 21967 Aug 2 18:00:23 ServerX stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache miss : 8801 Aug 2 18:00:23 ServerX stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache hit : 79198 Aug 2 18:00:32 ServerY stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache LRU expired : 0 Aug 2 18:00:32 ServerY stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache lifetime : 1 Aug 2 18:00:32 ServerY stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache inactive : 21085 Aug 2 18:00:32 ServerY stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache del : 230 Aug 2 18:00:32 ServerY stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache add : 21861 Aug 2 18:00:32 ServerY stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache miss : 8880 Aug 2 18:00:32 ServerY stats.pdweb.sescache 2022-08-02-18:00:00.000-05:00I----- pdweb.sescache hit : 74540 Aug 2 18:05:23 ServerX stats.pdweb.sescache 2022-08-02-18:05:00.000-05:00I----- pdweb.sescache LRU expired : 6100 Aug 2 18:05:23 ServerX stats.pdweb.sescache 2022-08-02-18:05:00.000-05:00I----- pdweb.sescache lifetime : 0 Aug 2 18:05:23 ServerX stats.pdweb.sescache 2022-08-02-18:05:00.000-05:00I----- pdweb.sescache inactive : 71624 Aug 2 18:05:23 ServerX stats.pdweb.sescache 2022-08-02-18:05:00.000-05:00I----- pdweb.sescache del : 6122 Aug 2 18:05:23 ServerX stats.pdweb.sescache 2022-08-02-18:05:00.000-05:00I----- pdweb.sescache add : 80511 Aug 2 18:05:23 ServerX stats.pdweb.sescache 2022-08-02-18:05:00.000-05:00I----- pdweb.sescache miss : 190 Aug 2 18:05:23 ServerX stats.pdweb.sescache 2022-08-02-18:05:00.000-05:00I----- pdweb.sescache hit : 6239   The server names (in this case, "ServerX" and "ServerY") are extracted at index time as a field called "server_name". In addition, two other field extractions are performed at index time: "metric_type": In this example, the values are "LRU expired", "lifetime", "inactive", "del", "add", "miss" and "hit". "metric_value": The numeric value at the end of each event. I'm attempting to do the following: Collect the "metric_value" values aligned with the seven metric types for each server in five minute increments and display all values in a table (each row reflecting the unique time, server name, and values for each metric type) Perform arithmetic operations against four of the metric types (add - (del + inactive + lifetime)) to create a new value "current_sessions". I envision the output to look like this: _time server_name LRU expired lifetime inactive del add miss hit current_sessions 18:00:00 ServerX 0 0 21157 297 21967 8801 79198 513 18:00:00 ServerY 0 1 21085 230 21861 8880 74540 545 18:05:00 ServerX 6100 0 71624 6122 80511 190 6239 2765 ...and so on... Here's what I've put together so far:   index=foo sourcetype=bar stats_category="pdweb.sescache" | bin span=5m _time | stats values(*) AS * by server_name, metric_type, _time | table _time, server_name, metric_type, metric_value   The resulting table shows me the following: _time server_name metric_type metric_value 2022-08-02 18:00:00 ServerX LRU expired 0 2022-08-02 18:00:00 ServerX lifetime 0 2022-08-02 18:00:00 ServerX inactive 21157 2022-08-02 18:00:00 ServerX del 297 2022-08-02 18:00:00 ServerX add 21967 2022-08-02 18:00:00 ServerX miss 8801 2022-08-02 18:00:00 ServerX hit 79198 2022-08-02 18:05:00 ServerX LRU expired 0 2022-08-02 18:05:00 ServerX lifetime 1 2022-08-02 18:05:00 ServerX inactive 21085 2022-08-02 18:05:00 ServerX del 230 2022-08-02 18:05:00 ServerX add 21861 2022-08-02 18:05:00 ServerX miss 8880 2022-08-02 18:05:00 ServerX hit 74540 2022-08-02 18:00:00 ServerY LRU expired 6100 2022-08-02 18:00:00 ServerY lifetime 0 2022-08-02 18:00:00 ServerY inactive 71624 2022-08-02 18:00:00 ServerY del 6122 2022-08-02 18:00:00 ServerY add 80511 2022-08-02 18:00:00 ServerY miss 190 2022-08-02 18:00:00 ServerY hit 6239   How should I adjust my query to accommodate my requirements? ... View more

I have a search being used in a dashboard (note the use of XML encoding for < and > symbols) that leverages the HTTP user agent field to identify browser and device type, then displays results (from highest to lowest volume) in a table. Here's the search:   index=foo sourcetype=bar source=*widget.log* http.agent | rex field=http_user_agent "(?&lt;useragent&gt;\S+)\s+\((?&lt;deviceType&gt;[A-Za-z0-9 .]+); (?&lt;OSinfo&gt;[A-Za-z0-9 _.;:\/-]+)\).*\) (?&lt;extensions&gt;.+)" | eval browserType = if(match(extensions, "^.*CriOS\/[0-9.]+"),"Chrome for iOS", if(match(extensions, "Google-Read-Aloud"),"Chrome with Google TTS (Text To Speech)", if(match(extensions, "^.*GSA\/[0-9.]+"),"Google Search App for iOS", if(match(extensions, "^.*EdgiOS\/[0-9.]+"),"Edge for iOS", if(match(extensions, "^.*FxiOS\/[0-9.]+"),"Firefox for iOS", if(match(extensions,"^Version\/[0-9.]+\sSafari\/[0-9.]+$$"),"Safari", if(match(extensions,"^Version\/[0-9.]+\sMobile\/\S+\sSafari\/[0-9.]+$$"),"Safari for iOS", if(match(extensions,"^Version\/[0-9.]+\sDuckDuckGo\/[0-9]+\sSafari\/[0-9.]+$$"),"Safari", if(match(extensions,"^Version\/[0-9.]+\sMobile\/\S+\sDuckDuckGo\/[0-9]+\sSafari\/[0-9.]+$$"),"Safari for iOS", if(match(extensions, "^.*Edg\/[0-9.]+$$"),"Edge", if(match(extensions, "^.*EdgA\/[0-9.]+$$"),"Edge for Android", if(match(http_user_agent, "^.*rv:11.0.*"),"Internet Explorer 11", if(match(http_user_agent, "^.*Gecko.*Firefox.*"),"Firefox", if(match(http_user_agent, "^.*OPR"),"Opera", if(match(extensions, "^.*Chrome\/[0-9.]+\sSafari\/[0-9.]+$$"),"Chrome", if(match(extensions, "^.*Chrome\/[0-9.]+\sMobile\sSafari\/[0-9.]+$$"),"Chrome for Android", if(match(extensions, "^.*Chrome\/[0-9.]+\sMobile\sDuckDuckGo\/[0-9]+\sSafari\/[0-9.]+$$"),"Chrome for Android","OTHER"))))))))))))))))) | eval deviceType = if(match(http_user_agent,"Windows NT 10.0"),"Windows 10", if(match(http_user_agent,"Windows NT 6.0"),"Windows Vista", if(match(http_user_agent,"Windows NT 6.1"),"Windows 7", if(match(http_user_agent,"Windows NT 6.2"),"Windows 8", if(match(http_user_agent,"Windows NT 6.3"),"Windows 8.1", if(match(http_user_agent,"\(Windows Mobile 10;"),"Windows Mobile 10", if(match(http_user_agent,"iPhone"),"iPhone", if(match(http_user_agent,"X11"),"Linux", if(match(http_user_agent,"\(Linux x86_64;"),"Linux", if(match(http_user_agent,"iPad"),"iPad", if(match(http_user_agent,"Macintosh"),"MacOS", if(match(http_user_agent,"Linux; Android.*;"),"Android", if(match(http_user_agent,"Linux; Android.*\)"),"Android", if(match(http_user_agent,"Android.*; Mobile;"),"Android","OTHER")))))))))))))) | eval browserDevice = browserType . ":" . deviceType | stats count as Events by browserDevice | sort - Events   (side note: I tried using a Splunkbase TA such as "TA-user-agents" to facilitate the user agent parsing, but I found that it was adding a LOT of time to my search execution...so I just isolated specific user agent fields of interest in my search). I've recently had an ask to filter the table results to show only the Apple related results returned in the "browserDevice" field (i.e., "Safari:MacOS", "Safari for iOS:iPhone", etc.). The key here is to show each result's percentage share among all possible "browserDevice" results returned (Apple or non-Apple related). I had originally scoped my base search to only include Apple related objects; while only Apple results were returned, the percentages were based on all Apple results as opposed to all Apple/non-Apple results. The table results should show the count and the percentage share; how would I accomplish this ask?   ... View more

I am taking events from three source types (same index; two common fields present across all three) and creating a table with the results. The events are indexed using a "timestamps" field that is present in the raw data (the result of an API call to a monitoring tool and a subsequent JSON payload retrieval of synthetic test metrics; the value is in epoch time and pushed into _time using a transform aligned with the source types). Here's the query I'm using: index=smoketest_* sourcetype=smoketest_json_dyn_result OR sourcetype=smoketest_json_dyn_duration OR sourcetype=smoketest_json_dyn_statuscode | rename dt.entity.synthetic_location AS synLoc, dt.entity.http_check AS httpCheck | stats values(*) AS * by httpCheck, synLoc, _time | rename "responseTime{}" AS "Response Time (ms)" | table _time, synLoc, httpCheck, status, "Response Time (ms)", "Status code" The common fields found in all three source types are "synLoc" and "httpCheck". 95% of the time, I get the desired result pictured here (requested fields from all three sourcetypes align as a single row on the table): In this example, you can see the results of two unique tests (executing every five minutes, over a 15 minute period). Since the events being grabbed from the three source types all have the same _time value, this works as expected. If, however, one or two of the source types have events with a _time value that does not match the others, this happens: Again, there are two unique tests represented here. However, note that one row reflects a value from one source type at 10:01 while the two values from the other two source types are on a separate row at 10:02. Ideally, all three values should be on the same row (much like the 10:06 and 10:11 entries). How can I alter my search query to account for this behavior? ... View more

I have a JSON payload that's ingested through a REST API input on a heavy forwarder, with the following configuration in props.conf (on the heavy forwarder, not on the indexer):     [json_result]     INDEXED_EXTRACTIONS = json     KV_MODE = none     DATETIME_CONFIG = CURRENT     SHOULD_LINEMERGE = false     TRUNCATE = 200000 The ensuing event in Splunk looks like this (minified): {"totalCount":3,"nextPageKey":null,"result":[{"metricId":"builtin:synthetic.http.resultStatus","data":[{"dimensions":["HTTP_CHECK-02B087D58EC18C33","SUCCESS","SYNTHETIC_LOCATION-2CD023FA5F455E28"],"dimensionMap":{"Result status":"SUCCESS","dt.entity.synthetic_location":"SYNTHETIC_LOCATION-2CD023FA5F455E28","dt.entity.http_check":"HTTP_CHECK-02B087D58EC18C33"},"timestamps":[1639254360000],"values":[1]},{"dimensions":["HTTP_CHECK-02B087D58EC18C33","SUCCESS","SYNTHETIC_LOCATION-833A207E28766E49"],"dimensionMap":{"Result status":"SUCCESS","dt.entity.synthetic_location":"SYNTHETIC_LOCATION-833A207E28766E49","dt.entity.http_check":"HTTP_CHECK-02B087D58EC18C33"},"timestamps":[1639254360000],"values":[1]},{"dimensions":["HTTP_CHECK-02B087D58EC18C33","SUCCESS","SYNTHETIC_LOCATION-1D85D445F05E239A"],"dimensionMap":{"Result status":"SUCCESS","dt.entity.synthetic_location":"SYNTHETIC_LOCATION-1D85D445F05E239A","dt.entity.http_check":"HTTP_CHECK-02B087D58EC18C33"},"timestamps":[1639254360000],"values":[1]}]}]} The text in red reflects what I'm trying to extract from the payload; basically, it's three fields ("Result status", "dt.entity.synthetic_location" and "dt.entity.http_check") and their associated values. I'd like to have three events created from the payload, one event for each occurrence of the three fields, with the fields searchable in Splunk. I've tried this approach in props.conf to get what I'm looking for...     [json_result]         SHOULD_LINEMERGE = false     LINE_BREAKER = },     DATETIME_CONFIG = CURRENT     TRUNCATE = 0     SEDCMD-remove_prefix = s/{"totalCount":.*"nextPageKey":.*"result":\[{"metricId" :.*"data":\[//g     SEDCMD-remove_dimensions = s/{"dimensions":.*"dimensionMap"://g     SEDCMD-remove_timevalues = s/,"timestamps":.*"values":.*}//g     SEDCMD-remove_suffix = s/\]}\]}//g ...but I'm only getting one set of fields to show up as an event in Splunk: And, the fields aren't showing up as "interesting fields" in the left navbar (possibly because the props.conf is not on the indexer?). Any assistance would be greatly appreciated. UPDATE: I referenced this post that's pretty close to what I'm trying to accomplish: https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-json-array-into-multiple-events-with-separate/m-p/139851 The format of the JSON payload cited in this post is different than the format of the payload I'm using, though...so I'm guessing that some additional logic would be necessary to accommodate my format. ... View more