Hi @skoelpin, I tried , but didn't work the above one. However, your previous one helped to get the results | where now()-strptime(LastUsedTime,"%Y-%m-%d %H:%M:%S")>86400*7 Thanks a lot for your help. Binay ... View more

Hi @somesoni2, Thank You for your help. The data gets reflected once in every 24 hours. We are getting the latest data , however it has been designed such that we are getting old data also even if we remove the software. e.g. if I had removed mozilla from my system yesterday, and I search the query for today; the result should not come. However, it is coming. Lastusedtime is showing as yesterday date only. Need to search in such that it shall check LastUsedTime newer than a period of choice I have used the one you suggested , however not got the desired result . Time format is same as mentioned. | where now()-strptime(LastUsedTime,"%Y-%m-%d %H:%M:%S")>86400*7 Thanks for your help. Binay Agarwal ... View more

Hi @tiagofbmm, Thanks for your information. Just to clarify , I mean, supposed I have firefox program installed in my system . Now , I am getting in my splunk event when I ran the query and this is expected. Now, If I remove/uninstall firefox from my system and then search the query , it still appears in the splunk event. The reason I told because of fieldname LastUsedTime and retention for 90 days. Will your above answer help in this and what it refers to | rest /services/apps/local . Sorry, this is a new concept for me . So thought of asking. Thanks again for your help. Binay Agarwal ... View more

Thanks @mayurr98 for the help. ... View more

@niketnilay , Thanks a lot. I tried with Field Extraction and extracted successfully. This looks very simple now 🙂 ... View more

Thanks for some valuable information. To integrate I mean to send data from Splunk to hive and auto incident to be created when any alert triggers. ... View more

Hi oda, Thanks for your response. I don't want to remove the fields that contain null values . I want to shrink the column width as it is filled with blank spaces ( screenshot attached in the main question) . Thanks & Regards, Binay Agarwal ... View more

Hi Nikentnilay, Thanks for your response. I have attached the screenshot in the main question page. I would like to eliminiate the white space between the two columns . I ran the stats command to display result in tabular format and between columns there are white spaces that's of no use. So need to delete or shrink the column length. Thanks & Regards, Binay Agarwal ... View more

Thanks a lot. It works 🙂 🙂 ... View more

Hi, Thanks for the valuable input. I ran my query like this below but somehow result is not coming. <!-- base search--> <search id="product_name"> <query>index="index_name" (ProductName="Google Chrome" OR ProductName="Skype") | stats count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <single> <title>Google Chrome</title> <search base="product_name"> <query>search ProductName="Google Chrome" | stats count</query> </search> </single> </panel> </row> <row> <panel> <single> <title>Skype</title> <search base="product_name"> <query>search ProductName="Skype" | stats count</query> </search> </single> </panel> </row> Not sure where it is missing or where I am doing wrong. If I ran the above base query as normal search I could get the count but when it passes to the query for panel - no result is coming. Will be really thankful if it can be fixed. Thanks & Regards, Binay Agarwal ... View more

I am trying to run with the below query but no result found index="indexname" [ | inputlookup file1.csv where (Allow='Y')| fields Application, Allow | rename Application as App ] | table host, App Also tried like this : index="indexname" [ | inputlookup file1.csv | fields Application, Allow | rename Application as App | search Allow='Y' ] | table host, App No result found. Note: the reason I use rename Application as App as there is no fieldname by Application in raw event. The field Application is only in my lookup file as a column header. Anything I am missing out in the query, please help Thanks & Regards, Binay Agarwal ... View more

Hi @somesoni2, all, Would like to add feature in my lookup file . Now I have 2 columns the .csv file Application, Category_Y Paint, Y abc*, Y xyz* aaa*, Y Now I want to write a query that gives the result when Catogory_Y =Y Current Query: index="index_name" [ | inputlookup | table Application | rename Application as App ] | table host, App Kindly suggest changes need to be made in the query to match the condition and get the result. Thanks in advance Best Regards, Binay Agarwal ... View more

Hi @somesoni2, all, Would like to add feature in my lookup file . Now I have 2 columns the .csv file Application Category_Y Paint Y abc* Y xyz* aaa* Y Now I want to write a query that gives the result when Catogory_Y =Y Current Query: index="index_name" [ | inputlookup | table Application | rename Application as App ] | table host, App Kindly suggest changes need to be made in the query to match the condition and get the result. Thanks in advance Best Regards, Binay Agarwal ... View more

Hi @somesoni2, I mean if we can pull out from other source if hostname and username are present in say in firewall logs (different index ) or in different search head. Not sure how that could be . and also if there is any way to retrieve username when the details are not present in raw logs at all. Thanks inadvance. Best Regards, Binay Agarwal ... View more

Hi, The dashboard is perfectly prepared. One additional thing required. Need to add the field with username, but the challenge is user field is not available in raw event. So any way we can co-relate or pull username matches with the host name and display username in the report. Query looks like this: index="index_name" [ | inputlookup | table Application | rename Application as App ] | table host, App And want to add one more column username so query should be | table host, username, App Would be thankful if someone can help on this. Thanks & Regards, Binay Agarwal ... View more

Thanks @somesoni2. It helps 🙂 ... View more