Correct. This is also known as the De Morgan's Law of Union Or De Morgan's Law of Intersection ... View more

You should able to do that with enclosing your field name with dollar sign ($) $Application Server$="running" Refer to: https://community.splunk.com/t5/Splunk-Search/Search-field-names-with-spaces-in-map-command-inner-search/m-p/241379#M71778 ... View more

Probably it's not chosen, it's just "lazy" coding for input checking and extractions. You could create an idea for fix this on ideas.splunk.com. Add: I actually create a new idea for it https://ideas.splunk.com/ideas/EID-I-2035 ... View more

Depending on your actual events, try something like this index=X (sourcetype=sourcetypeA OR sourcetype=sourcetypeB) | eval fieldB = coalesce(fieldB, fieldA) | eventstats values(fieldD) as fieldD by fieldC | where fieldA=X OR fieldB=X | stats count by fieldA, fieldC, fieldD, fieldE, fieldB   ... View more

If the field is not multivalue then mvexpand will not do anythihg to it. ... View more

No problem. I believe $click.value$ will give you the field that is clicked. However, you may want to use a specific field regardless of where on the row the click occurs. When that occurs I think $row.$ is the choice for that behavior. At any rate... good luck. ... View more

@vnravikumar - thank you! ... View more

can you post the XML so far so that we may make suggestions? ... View more

Thank you for the guidance this is helpful. ... View more

hey have you tried looking at the visualisation for | chart latest(percent_used) over host by instance Also try this index=os host="host1" OR host="host2" OR host="host3" object="LogicalDisk" counter="% Free Space" instance ="C:" OR instance ="D:" | eval percent_used=100-Value | stats latest(percent_used) by host, instance | eval host=host." ".instance | fields- intance let me know if this helps! ... View more

oh you must've edited it before I saw. ... View more

This is really helpful ty! ... View more

Merry Christmas! ... View more

Thanks appreciate it! ... View more

Defining a baseline can be tricky as each system and environment is different. You might need to build a dashboard with multiple panels (queries) to give you a broad idea of average behavior over time. I see you're in a windows environment, I'll suggest taking a look at a few known working Windows queries here: http://gosplunk.com/category/wineventlogsecurity/ You can probably find a few queries to throw together in a dashboard, as well as use and abuse the queries to come up with something that'll suit your needs. In addition, I'd use statistical functions such as average, median, standard deviation (etc, etc) over a proper period of time (week / month, weekend vs weekday) to properly determine behavior and baselines. My $.02 at least 🙂 ... View more

OMG, you gotta love the consistency of the documentation! I've read in a dozen places about using: dashboard stylesheet="blah.css" I tried it 100 different ways in various places, all failing. Then I read RLacher's comment above here about using: form style="blah.css" and THAT didn't work. On a whim, I tried: form stylesheet="blah.css" AND IT WORKED! Go figure. And comments like: "I cold not explain it better than the documentation itself" can go take a hike... ... View more

Even if I assume it is in milliseconds, this converts to Thu, 31 Jan 2019 05:00:00 GMT! ... View more

I'm borrowing regex from the CEF app here. You should be able to use this in the field extractor app or within your props & transforms. (?<=unkwnownProperties=)(.*?(?=(?:\s[\w.:\[\]]+=|$))) note that unkwnown is spelled wrong. It should be unknown but you provided incorrect spelling in your example. ... View more

Oct 5 02:44:54 rlay256-x7t0 : 2015-10-05,2:44:54, PUY1234, rlay256-x7t0, 12.123.1.2, 123.123.12.12, 123456, P.RDP.Signed (Old),"P.RDP.c3 Priv Win 4.1.2, Password Change (RACF), Password Reset (Self Help)",Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko,,,,,,Login succeeded for 123.123.12.12/P.RDP.Signed (Old) (session:00000000) Thanks for your response. I want the guys in bold. So I don't even want the "RACF" or "Self Help". I know I can write the code in SPL but I just don't understand why the field extractor works perfectly fine for some messages but then not for others. The format is the same. ... View more

I love you. Thank you sir. ... View more

| eval logid=mvindex(Logon_ID, 0) - das erste von oben nach unten gesehen | eval logid=mvindex(Logon_ID, 1) - das zweite | eval logid=mvindex(Logon_ID, 2) - das dritte | eval logid=mvindex(Logon_ID, 3) - das vierte mit mvindex legt man fest welches der erkannten Werte genommen werden soll. Wenn ich mich recht entsinne sollte es bei dir | eval logid=mvindex(Logon_ID, 1) sein da die User Logon_ID als zweites kommt. Gruß Micki ... View more

Ok. Thanks I appreciate your help. ... View more

This works for me, thanks! ... View more