I have a lookup table. Let's say the lookup table contains a column called "a". The "a" column contains a list of indices. How can I perform a stats count of logs found in each index from the "a" column?   | inputlookup lookuptable.csv | table a     ... View more

SITUATION I'd like to track the changes done to lookup tables. I observe this helpful post: "https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-get-the-Audit-for-Lookup-files-modification-using-the/td-p/119363" I observe the below sourcetypes having "Lookup edited successfully" lookup_editor_rest_handler lookup_editor_controller I observe both having "Lookup edited successfully" I observe both having unique event counts for the same time window I observe "lookup_editor_controller" having the "action" field while lookup_editor_rest_handler" does not PROBLEM I don't know which sourcetype I should use. QUESTION Which sourcetype should I use? ... View more

SITUATION: - I use indices "A" and "B" to come to answer the same question but for different environments. - Each index has unique fields names but said fields represent the same data in each index. - I want a table to answer the same question in one table using both indices. - I'm starting with SPL similar to this: (index=A AND indexA_unqiue_field=x) OR (index=B AND sourcetype=v indexB_unique_field=y) | rename indexA_unqiue_field AS field | rename indexB_unique_field AS field | table _time, field, index PROBLEM: - With the above SPL I am failing to answer the same question using the 2 indices. It appears to work fine for index B but "field" does not populate for Index A. QUESTION: - How do I get all fields to populate? - Or how may I achieve the goal? ... View more

Situation: I have a panel. The panel creates a token for me from a field I extract from the search. In the same panel I create a URL that enables me to "drilldown". Open Tickets search... | table "ticket_num", "Creation Date", "other_field", "other_field" $field3.earliest$ $field3.latest$ $result.ticket_num$ 5 none row true <eval>replace($row.url$, "http://", ""</eval> <link target="_blank"> <![CDATA[ https://other.tool/$ticket_num$ ]]> </link> </drilldown> </table> </panel> My table appears to work nicely where each row represents unique open tickets. Problem: All rows, upon clicking, "drilldown" only to the first row's "ticket_num". Which I think makes sense. Question: Can you pleas share if its possible with ES simple XML and without any other add-on to modify the panel so that, upon clicking a row, I "drilldown" to the respective row's unique "ticket_num"? ... View more

Situation: - I have some records with a human readable field "Creation Date" (MM/DD/YYYY HH:MM:SS). - I'd like to sort by "Creation Date" Problem: - The sort command does not appear to work. I believe this is because it needs to be in epoch time to make the calculation. Proposed Solution: - Convert the field to epoch and run the sort command against the data set using the new epoch field. ... View more

My Splunk Admin is the landlord and I'm the tenant. Let's say the landlord is dealing with personal matters and cannot tend to their normal house upkeep duties. How may I selfishly help my landlord in order to improve my SplunkES experience? Context is an extremely slow ES experience. Here are some of my thoughts: o Enumerate all apps and versions and request upgrades o Enumerate saved searches/alerts and their performance impact - make searches more efficient o Enumerate all dashboards and their load - make searches more efficient o Disable real-time searches only when necessary o Enumerate unused knowledge objects - delete any unused Am I thinking in right direction? Version: 7.2.5.1 Enterprise Security Version: 5.2.2 ... View more