Hi , I am facing difference in count between stats and timechart for same search and same filters Stats cmd : Last 24 hours search|bin span=1d _time |stats count by Status|eventstats sum(*) as sum_* |foreach * [eval "Comp %"=round((count/sum_count)*100,2)]|rename count as Count|fields - sum_count comp  7126 error 37 Noncomp 146 NonRep 54 Total 7363 Timechart :  Last 30 days  search|bin span=1d _time |timechart count by Status| addtotals| eval "Comp %"=round((Comp/Total)*100,2) | eval "Error %"=round((Error/Total)*100,2) | eval "Noncomp %"=round((Noncomp/Total)*100,2) | eval "NonRep %"=round((NonRep/Total)*100,2) | fields _time,*% comp  7126 error 36 Noncomp 146 NonRep 53 Total 7361 There is difference in count by 2 between these 2 functions.I am using a macro before the time chart or stats .Please help me with solution or cause of this issue.    ... View more

I have 3 date columns.I have already calculated the difference between current day and the diff is in days are the values in the 3 columns.   Col1 Col2 Col3 12   7 2 34 45 15 25   250 56 120 21     Required filter : - i have  to filter only days <=40 in all 3 columns. - If a column has null and other 2 columns have values <=40 then they need to be shown -if a column or 2 column has null and rest other column has value <=40 they need to displayed -if a column is null and other column values are greater >40 then they need to removed from scope. Please let me know the search .     ... View more

Hi , I have  4 fields and those need to be in a tabular format .Out of which one field has the ratings which need to be converter to column to row format with count and rest 3 columns need to be same . I have tried using transpose and xyseries but not able to achieve in both . Ex : current table format Name Domain Area Rating Nsp -1 IT End user service H NSP-2 IT Mainframe M NTS-10 G&A ENT L NTL -05 EPP Distributed M WMC-04 AES corp L   How this can be changed to the below format using splunk search , Expected table format : Name Domain Area Rating(H) count Rating(M) count  Rating(L) count Nsp -1 IT End user service 1 0 0 NSP-2 IT Mainframe 0 1 0 NTS-10 G&A ENT 0 0 1 NTL -05 EPP Distributed 0 1 0 WMC-04 AES corp 0 0 0   Please let me know how to achieve this in using Splunk search. ... View more

Hi, I have created a single value and statistical table panel using the below base search , base search : <search id="search1"> <query>index=s (sourcetype=S_Crd OR sourcetype=S_Fire) | fields *</query> <earliest>-24h@h</earliest> <latest>now</latest> </search>   In search: <single> <search base="search1"> <query> | rex field=_raw "Fire=(?&lt;FireEye&gt;.*?)," | rex mode=sed field=Fire "s/\\\"//g" | stats values(*) as * values(sourcetype) as sourcetype by sysid | fillnull value="" |evalOS=case(like(OS,"%Windows%"),"Windows",like(OS,"%Linux%"),"Linux",like(OS,"%Missing%"),"Others",like(OS,"%Solaris%"),"Solaris",like(OS,"%AIX%"),"AIX",1=1,"Others") |search $os$  |stats count</query> </search> sometime I am getting correct values but suddenly it displays 0 in all panels including this.After giving ctrl + F5 ,the issue gets resolved .May i know the reason for this and how to resolve this in dashboard.       ... View more

Hi , My query is like below,  index=s sourcetype=Fire | fillnull value="" | eval OS=case(like(OS,"%Windows%"),"Windows",like(OS,"%Linux%"),"Linux",1=1,"Others") | eval group = case(OS="Windows","Windows Host Intrusion Detection Prevention Agents Not Reporting",OS="Linux","Linux Host Intrusion Detection Prevention Agents Not Reporting") | search Environment="Production" OR Environment="PSE" | rename Reporting_Status as Compliance_Status | replace Reporting with Compliant "Not Reporting" with Noncompliant "Not Reporting (possibly due to ITAM FQDN field not populated)" with NotReporting "Not Reporting (ITAM FQDN field not populated)" with NotReporting in Compliance_Status | eval Compliance_Status=case(Compliance_Status="Compliant" OR Compliance_Status="Excluded from reporting, yet is reporting","Compliant",Compliance_Status="Noncompliant" OR Compliance_Status="Not Reporting" OR Compliance_Status="Error","NonCompliant")  | append [| search index=s  sourcetype=Work | fillnull value="" | eval group = case(Environment="Production" OR Environment="PSE","Workstations Host Intrusion Detection Prevention Agents Not Reporting") | rename Reporting_Status as Compliance_Status | replace Reporting with Compliant "Not Reporting" with Noncompliant "Not Reporting (possibly due to ITAM FQDN field not populated)" with NotReporting "Not Reporting (ITAM FQDN field not populated)" with NotReporting in Compliance_Status | eval Compliance_Status=case(Compliance_Status="Compliant" OR Compliance_Status="Excluded from reporting, yet is reporting","Compliant",Compliance_Status="Noncompliant" OR Compliance_Status="Not Reporting" OR Compliance_Status="Error","NonCompliant") ] | append [| search index=c sourcetype=cloud | fillnull value="" | eval group = case(Cloud_Platform="Azure","Azure Baseline Noncompliance",Cloud_Platform="Aws","AWS Baseline Noncompliance") | search Account_Environment="PROD" OR Account_Environment="PRD" OR Account_Environment="PSE" | stats sum(CountOf_Compliant_AssetsTested) as Compliant sum(CountOf_Noncompliant_AssetsTested) as NonCompliant ] |stats count by group The last append is not taken into count ,since Compliance and Non Compliance are not in Compliance_Status field. | stats sum(CountOf_Compliant_AssetsTested) as Compliant sum(CountOf_Noncompliant_AssetsTested) as NonCompliant Is there a way to bring them to new field Compliance_Status ,which will help to show after stats by group. ... View more

Hi, I have to create a trending chart for 30 days using the below search .I am not getting the trending using timechart and chart .  index=s sourcetype=Fire | fillnull value="" | eval trmsc = case(Environment="Production" OR Environment="PSE","Workstations Host Intrusion Detection Prevention Agents Not Reporting") | rename Reporting_Status as Compliance_Status | replace Reporting with Compliant "Not Reporting" with Noncompliant "Not Reporting (possibly due to ITAM FQDN field not populated)" with NotReporting "Not Reporting (ITAM FQDN field not populated)" with NotReporting in Compliance_Status | stats count(eval(Compliance_Status=="Compliant" OR Compliance_Status=="Excluded from reporting, yet is reporting")) as Compliant count(eval(Compliance_Status=="Noncompliant" OR Compliance_Status=="NotReporting" OR Compliance_Status=="Error")) as NonCompliant by trmsc  | append [| search index=c sourcetype=Asset | fillnull value="" | eval trmsc = case(Cloud_Platform="Azure","Azure Baseline Noncompliance",Cloud_Platform="Aws","AWS Baseline Noncompliance") | search Account_Environment="PROD" OR Account_Environment="PRD" OR Account_Environment="PSE" | stats sum(CountOf_Compliant_AssetsTested) as Compliant sum(CountOf_Noncompliant_AssetsTested) as NonCompliant by trmsc] | eval date_wday=strftime(_time,"%A") | search date_wday="Monday" | bin _time span=1d | eventstats count by trmsc | chart count(trmsc) over _time by Compliance_Status Please let me know how to get trending chart for the above search . ... View more

I have a field( version) which is available in different position in different events of same sourcetype,Since the prior field(description) to this has irregular count of characters .Due to this is am seeing null values wherever the field(version) in different positions. I would want fetch the field(version) wherever the field is available in the events of sourcetype.I tried the below , | rex field=_raw "Version=(?<Version>\"\w+\s+\w+\".*?)," | rex mode=sed field=Version "s/\\\"//g" but it didn't worked .Please suggest me a way to fetch this . ... View more