Hi, I'm currently trying to implement SMS Alert for Splunk. I have a SMS Gateway server in my organisation and I'm using it to send SMS alert. I'm able to receive the SMS but the message was a long strange of nonsensical alphabets. May I know if there's any formatting of the Splunk Alert that led to this? Or how can I configure the message such that the message sent via SMS is in human readable format. Any help or idea will be greatly appreciated. Thank you 🙂 ... View more

Hi, I'm currently using Splunk Enterprise v.6.2.1. May I know if it's possible to send SMS Alerts through any add-ons or configurations? I'm aware that in v.6.3, i can make use of Twilio SMS Alert add-on to send SMS alert but what about v.6.2.1? Any help/ideas will be greatly appreciated. Thank you 🙂 ... View more

Hi, I'm trying to create a scheduled report that runs daily at 3am. The use case is to track the occupancy number of a carpark on an hourly basis and output a CSV spreadsheet. At 3am when the report runs, I will need a base count. For the hourly count subsequently, the result will be added to the base count ( e.g. at 3am, the base count is 100; at during 3am-4am 3 cars entered the carpark, hence the base count should be updated to 100+3=103). The output result daily will only show base count that is updated at every hour. I came up with a search string, but it isn't giving me any results and I have no idea how to fix it. sourcetype="bn22_epsin" [search sourcetype="bn22_epsin" earliest=-25h latest=-24h |stats count as baseIN ] | bin span=1h _time | stats count as IN by _time | eval baseIN=if(IN!=0, IN+baseIN, baseIN) | table baseIN IN I'm trying to find the base count at 3am in the subsearch by counting events from 2-3am. Please help me out. Any suggestions will be greatly appreciated. Thank you very much! ... View more

Hi, I'm trying to create an alert that fires if there is no event logged within an hour. This is my search string: sourcetype="bn22_epsin" | dedup Cpk_Num | where _time<now()-3600 | table Cpk_Num _time I think my search string is wrong. I would like to know which carpark did not make any logs in the last hour. My alert will be configured to search every 15 minutes. Any help will be greatly appreciated. Thank you. ... View more

Hi I'm trying to display coordinates on a Splunk Map and color code the points with different ranges of count values. I managed to create the map with the default pie chart with the search string below, but it's using the default colors. [base search] | lookup cpk_coord_lookup NUM_CPK as NUM_CPK OUTPUT NUM_LNGTD, NUM_LATD | geostats latfield=NUM_LATD longfield=NUM_LNGTD maxzoomlevel=18 globallimit=0 count by NUM_CPK I also referred to a similar question: https://answers.splunk.com/answers/221348/geostats-display-bubbles-on-map-instead-of-pie-cha.html and came out with a second code which is color coded, but each bubble is identified by the color category (eg greenCount) instead of the NUM_CPK (ID). [base search] | lookup cpk_coord_lookup NUM_CPK as NUM_CPK OUTPUT NUM_LNGTD, NUM_LATD | geostats latfield=NUM_LATD longfield=NUM_LNGTD maxzoomlevel=18 globallimit=0 count(NUM_CPK) as TOTAL | eval redCount = if(TOTAL >= 50000,TOTAL,0) | eval yellowCount = if((TOTAL >= 10000 AND TOTAL < 50000),TOTAL,0) | eval greenCount = if(TOTAL < 10000,TOTAL,0) | fields - TOTAL I understand that the 2nd search string is not displaying the NUM_CPK column because I didn't use the BY clause. However, if I use the BY clause (first search string), I won't be able to do conditional formatting on the points anymore. Any idea how I can use the first search string and yet do conditional formatting? Any help will be greatly appreciated. Thank you very much. ... View more