This comment about it happening in parallel vs in order fixed an issue I had for days! ... View more

I had this issue as well and did not find an intuitive way to do it directly, but got a roundabout workaround that worked perfectly. Use the Set Diff command to get the mutually exclusive results, then take the intersection of those results with the set of events that you want to include. So the generalized structure is for search 1 = results I want and search 2 = results I want removed from search 1: | set intersect [ search 1 | field <some field> ] [ set diff [ search 1 | <some field> ] [ search 2 | field <some field> ] ] This finds the results that are either in search 1 or search 2 but not both, then removes the results that are in search 2. ... View more

Man you just saved my life! ... View more

Hi Woodcock This did the trick, thank you for your effort and time. Best regards ... View more

Thankyou very much ... View more

When I need to do this, I add a macro to the end of the search that will add fake data with an append [|makeresults ... for test and | noop for non-test. When testing, just change the macro. ... View more

Hi wpreston, It isn't a feature present in Splunk, you could use three workarounds: if you haven't license consuption problems, you could index data from both the forwarders filtering duplicated data in your searches; if you don't want to twice index your data, you could create a batch on your servers that start/stop forwarder when the node is active or passive (it's the easiest way); at least you could use an ntermediate Heavy forwarder to filter duplicated date before sending to the indexers (but you index twice your data) . Bye. Giuseppe ... View more

I am facing the same issue even if I am searching with specific file name. I removed crcSalt= from input.conf but no result.,I am facing the same issue.Even if I search with specific file. I removed crcSalt= from input.conf but no result. ... View more

Hello SloshBurch, The license expired, then I switched to the free account as per the instructions you sent. This was 6 days ago. A screenshot of the license usage: As for the warnings: I can't clear these warning as there is no more details for them. The warning are: Thank you so much for your help ... View more

Splunk transactions are built in reverse order, and the transaction command actually requires that the events are ordered by descending time. So Splunk looks first for the end of the transaction and then works backwards to the beginning. When you think about this, it may change your approach. You might try this: yoursearchhere | transaction id endswith="D" | where somefield(0)=="A" But this example causes Splunk to build a new transaction each time it sees an instance of "D" - and what you want is for Splunk to start with the earliest instance of "A" and end with the latest instance of "D", with no intervening "A"s. Also, Splunk cannot deal with interleaved transactions unless there is a unique identifier for each transaction. If you have multiple transactions with an id of "35", then one transaction must end before another begins. Finally, the transaction command is very memory intensive. When Splunk runs short of memory, it may "evict" transactions that it otherwise would have kept. Test your searches with the smallest reasonable time range to avoid this problem. You may want to look at the Search Job Inspector for any warnings that would indicate that Splunk was not able to form the transactions completely. I think what would work best is yoursearchhere | transaction id startswith="A" | then go backwards through the transaction's events to the latest event that is "D" As you can see, I haven't figured out the last part yet. But I think that some of these other issues may be inhibiting your progress. I hope this helps you to get closer to a solution. ... View more

Apparently you need an HTML 5 version of IE. ... View more

This worked perfectly. EDIT windoW=1 ... View more

I know this post is old, but in case the answer here doesn't fix it for folks, I recently resolved this issue myself by removing an fields with a "." character in the name. Looks like it was breaking the ability to append. ... View more

Both your answer and @Runal worked. Because it was a smaller subset, I ended up sticking with transactions. The fancy evals from @Runal inspired me to improve my dashboard panel!. I had to remove duration>0 in order to see jobs that had started but not finished. I really like the idea of | eval Job_Status=if(closed_txn=0, "Incomplete", "Complete"), however it was showing complete for jobs that had started but not finished. ....search... + EventDescription="Job Created" OR EventDescription="Job Completed" | transaction Job_ID startswith="*Job Created" endswith="Job Completed" keeporphans=true | eval since=round((now()-_time)/3600, 1), StartTime=strftime(_time, "%m-%d-%y %H:%M:%S"), EndTime=strftime(_time+duration, "%m-%d-%y %H:%M:%S") | eval JobDuration = round(duration/3600, 1)." Hours ", EndTime=if(isnull(EndTime),"Job Currently Running",EndTime), JobDuration=if(isnull(JobDuration),"Currently running time is: ". since ." Hours",JobDuration) | sort -_time | table Job_ID StartTime EndTime JobDuration ... View more

Thanks for that. I prefer the "eval Login_Time=_time | eval Logout_Time=_time + duration" one - less work for the Search Head and less work than my solution. ... View more

I had thought about that as well. Great minds, eh? 🙂 The single search is much more elegant and has fewer moving parts. I'd much rather do it that way if possible. In the end, though, I decided to go with a lookup because of the subsearch result limits. Didn't know how many transactions OP would need to report over. ... View more

One big problem is that right before your join you are doing fields correlation_id and thus throwing away all fields except for correlation_id. This will allow your join to work but all other subsequent search commands will lose the fields they expect (eg req_host, client, FIELDNAME) . Take that fields clause out. In general you don't have to worry about Splunk extracting and preserving too many fields. In fact the search parser does the opposite and optimizes the fields extracted and preserved, down to just fields named in the search string. index="index" tag=tag1 sourcetype=access_combined "def"|rex "(?i)/user/(?P<FIELDNAME>[^/]+)"| bucket span=1d _time |stats count by FIELDNAME _time|where count<30 AND count>20 |join correlation_id[search index="index" tag=tag2 sourcetype=access_combined "hello"] | rex field=req_host "^(?<client>[^.]*)" | bucket span=1d _time |stats count by client FIELDNAME _time | sort - _time count|dedup 3 client However I also strongly recommend using stats instead of join. You should absolutely avoid join for this, and it's a bread and butter case for the use of stats. I think the reason wpreston's search doesn't work for you is that your stats needs to group by correlation_id. You want something more like this: index="index" sourcetype=access_combined (tag=tag1 "def") OR (tag=tag2 "hello") | rex "(?i)/user/(?P<FIELDNAME>[^/]+)" | rex field=req_host "^(?<client>[^.]*)" | stats values(FIELDNAME) as FIELDNAME values(req_host) as req_host) values(client) as client last(_time) as _time by correlation_id | bucket span=1d _time | stats count by FIELDNAME _time |where count<30 AND count>20 |stats count by client FIELDNAME _time | sort - _time count |dedup 3 client One other note - the rows coming into your second stats command already have a count field, so you may want sum(count) as count instead of just another count . Depends what you want to count of course, but I'd make sure you're clear on what you're getting. ... View more

Mine should be far more efficient than the other answer. ... View more

what additional search commands are you running? Can you post the full search string that gave you these negative numbers? ... View more

I've tried to do this, but this won't work. Here is the props.conf: [source::udp:514] TRANSFORMS-changesourcetype = syslog_ciscoesatextmail TRANSFORMS-changesourcetype = syslog_rsaauthmgr Here is the transforms.conf: [syslog_ciscoesatextmail] REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)*[?(10.1.1.152|10.1.1.153)[\w.-]{2,})]?\s FORMAT = sourcetype::cisco:esa:textmail DEST_KEY = MetaData:Sourcetype [syslog_rsaauthmgr] REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)*[?(10.1.1.24|10.1.1.25)[\w.-]{2,})]?\s FORMAT = sourcetype::RSA_AUTH_MGR DEST_KEY = MetaData:Sourcetype In the search app I still see the logs from the specified host as sourcetype:syslog ... View more

I don't know if it supports multiple tabs or not, but try out the Splunk ODBC app. Docs for the app are here. ... View more