Hi, I am trying to map the ip address in my search to my lookup table, and it should return me the countries of the IP address. Sample lookup table country ip_address Italy 2.123.123.9/24, 2.124.124.9/11 Problem is, in my events, my IP address is 2.123.123.1. I want to search the ip_address in the lookup table perhaps for 2.123.123 and return me Italy ? This is my search query index=ip_address "status=200" ip_address | lookup ip_mapping.csv ip_address outputnew u_country as country The search executed successfully, but there is no country being returned. What am i missing ? ... View more

Hi Splunk, I have an app in Splunk (Splunk app for Jenkins), however it is used by another team already, all the indexes needed by the app is also used. We dont want to share the data with other teams. How can i use the same app, but we can keep the data visibility to our team only. We dont want to share data with other team, so i am interested to see if we can separate app permission and usage among teams. ... View more

Hi Splunk, My Splunk version is Splunk Enterprise 7.1.0, and Splunk App For Jenkins 2.0.2 The dashboards in the Splunk app is using "jenkins_statistics" in the query. How do we customize this to use our own indexes instead ? Our company has strict index creation guideline, and we cant create jenkins_statistics index. Can we replace the "jenkins_statistics" index in the query with our own index? If yes, how ? Thanks for response ! ... View more

Hi, How do i customise Splunk App for Jenkins ? Any github link or project ? We want to change the default index that the app is using for searching in the dashboard panels. Our company have strict index naming requirement, so we want to change the indexes used in the search field to cater to company's policy. Many thanks. ... View more

Hi, I have a search query below : sourcetype="XXX" earliest=-1w@w latest=now | rex field=_raw "(?msi)(?<user_login>\{.+\}$)" | spath input=user_login | rex field=repo_name "^(?<repo_name>[^/]+)" | spath input=repo_name | stats values(repo_name) as REPO_LIST dc(repo_name) AS DISTINCT_REPO by user_login | where DISTINCT_REPO > 4 | sort by DISTINCT_REPO desc This query will generate results and send alert emails to admins if there is a result. However, we want to monitor this everyday, but we prefer to get alerts if the results for each alert are different. Currently, the results is same everyday. How to configure it to send alerts if only the results is different from previous sent alert ? ... View more

Hi Splunk, I am in trying to create an alert that will send email to users if the search query returned results if there is 10 unique repository returned in the events. search_query earliest=-10m@m latest=now | stats count by repository| where count > 9 | sort - count Currently, the alert trigger if there is an occurence of 10 times of the SAME repository. I want to improve the query by triggering alert if only there is 10 DIFFERENT repository. ... View more