Hi I have a single which shows the total assets after a search. I then want to add a token so that i can use the result of that search to add it a label, to show value /$value$ so: index="123" | search field="abc " AS foo | count(foo) AS $tkn_bar$ | [search index="456" | search field2="def" AS new | count(new) AS new | fields new So the single would show: new Then in the label it would be: / $tot_bar$ which would really be "/ foo.count" So the final single would display: new / foo.count ... View more

Hi, I seem to have foobar'd my Admin account, resulting in the majority of the admin privileges not working through the UI: AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/admin/launcher/data/modular-inputs?count=-1 I have edited the \local\authorize to match that of the \default config and restarted Splunk via CLI, but this has not restored my previous admin privileges. C:\Program Files\Splunk\etc\system\local\authorize.conf as follows to reset: (a cut and copy from \default\authorize.conf) [role_admin] accelerate_datamodel = enabled admin_all_objects = enabled change_authentication = enabled edit_deployment_client = enabled list_deployment_client = enabled edit_deployment_server = enabled list_deployment_server = enabled edit_dist_peer = enabled edit_forwarders = enabled edit_httpauths = enabled edit_input_defaults = enabled edit_monitor = enabled edit_roles = enabled edit_scripted = enabled edit_search_server = enabled edit_server = enabled edit_splunktcp = enabled edit_splunktcp_ssl = enabled edit_tcp = enabled edit_udp = enabled edit_user = enabled edit_view_html = enabled edit_web_settings = enabled get_diag = enabled indexes_edit = enabled license_edit = enabled license_tab = enabled list_forwarders = enabled list_httpauths = enabled rest_apps_management = enabled restart_splunkd = enabled run_debug_commands = enabled # This enables the windows specific capabilities for admin edit_win_eventlogs = enabled edit_win_wmiconf = enabled edit_win_regmon = enabled edit_win_admon = enabled edit_win_perfmon = enabled list_win_localavailablelogs = enabled list_pdfserver = enabled write_pdfserver = enabled importRoles = power;user srchIndexesAllowed = *;_* srchIndexesDefault = main;os srchFilter = * srchTimeWin = 0 srchDiskQuota = 10000 srchJobsQuota = 50 rtSrchJobsQuota = 100 cumulativeSrchJobsQuota = 200 cumulativeRTSrchJobsQuota = 400 ... View more

Hi, I want to create a new field, from a string, showing the domain user, where the only constant is "\" which I don't want included. Sample input: (no field either side of "\" is predictable) 12345\alice 45632\__test_account__ PC123\bob My search: index="dc_report" | rex field=domain_user "(?<user>^.*\\(.*$))" This results in unmatched parentheses. Is there a way to use &#92 (hmtl "\") instead of negation? The other route is to use the index of "\" and then select to the right. Unsure of what functions to use/how to use them. ... View more

Hi, I want to groups event times in ranges relative to the current time. Currently this method does not work. The field I'm using is not the event time but a property of a log, so the event looks something like this: logtime (taken as upload date), STR_TIME(1st detection date "2013-11-3"), prop1, prop2 my chart is: chart count(prop1) over AGE by prop2 usenull=f | sort + prop2 Code: eval STR_TIME=strptime(detected_date, "%Y-%m-%d") | eval AGE=case(STR_TIME <= time(-864000s), "10 Days", STR_TIME > time(-864000s) AND STR_TIME < time(-2592000s), "10 to 30", STR_TIME >= time(-2592000s) AND STR_TIME < time(-7776000s), "30 to 90", STR_TIME >= time(-7776000s) AND STR_TIME < time(-15552000s), "90 to 180", STR_TIME >= time(-15552000s), "180 Days Plus", "180 Days Plus" ) | chart count(prop1) over AGE by prop2 usenull=f | sort + prop2 Error: Error in 'eval' command: The expression is malformed. Expected ). I have also tried nested IF statements. I can't find any discussion of using maths within a "case" of "if" eval. Also tried: = (time()- seconds) Are calculations like this possible? ... View more