Thanks. I figured it out with your help.  It turns out date_wday was being extracted as well. I just had the search term formed wrong.  I ended up with the following: NOT ((date_hour>=1 date_hour<5) AND user=[username] AND date_wday=saturday) ... View more

Thanks, but how do I exclude Saturday as well as part of the condition?  The "date_wday=saturday" doesn't work and that's why I did the eval to assign a day of the week in the search. ... View more

Do you know what a search like that would look like?  I can check and see if those types of events show in the indexes my servers are forwarding to.  Thanks. ... View more

I want to do what the person in this old post tried to do but the solution there isn't working for me: https://community.splunk.com/t5/Splunk-Search/day-of-the-week-average/m-p/142904 ... View more

Thanks for the response.  But that search doesn't produce any results in the "avg" column.  It's blank. ... View more

It jacked the formatting of the rex line up. I cut and paste exactly like you showed, but it doesn't look that way in my response. ... View more

Thanks for the help. Still producing same output with the following search. I guess I don't know enough about regex to troubleshoot. I was even going to regex101.com to test without any luck: | tstats count as Counts where index=ahc_os source="var/log*" by host | inputlookup append=t May_Linux_Hosts.csv | rex mode=sed field=source "s/(\/var\/log)./\1/" | stats values(Counts) as count by source host | fillnull count | where count=0 ... View more

Thanks but I must be doing something wrong. I've added a lookup file with the format: host, source host1, /var/log* host2, /var/log* I've done your search: | tstats count as Counts where index=[my index] source="/var/log*" by host | inputlookup append=t May_Linux_Hosts.csv | rex mode=sed field=source "s/\/\w+/\/*/3" | stats values(Counts) as count by source host | fillnull count | where count=0 And the output I get is: source, host, count /var/log/, host1,0 /var/log/, host2,0 . . . So it's like it's not treating the * as a wildcard. Any idea what I'm doing wrong? ... View more

Thanks. Will a wildcard in the CSV file work? Could the source be /var/log/* ... View more

Thank you so much! That works great. ... View more

So your first part got me almost where I wanted. This is my search with your second line added: index=[my_index] sourcetype=[my_sourcetype] source=[my_source] | stats count as Count by APPLICATION_NAME USER_ID | stats list(USER_ID) as USER_ID list(Count) as Count by APPLICATION_NAME | search [|inputlookup app_file.csv|fields APPLICATION_NAME] | lookup app_file.csv APPLICATION_NAME OUTPUT App_Name | rename App_Name as "Application Name", USER_ID as "User ID" | table "Application Name", "User ID", Count | sort "Application Name", -Count Now my search results show three columns. Application Name, User ID, and Count. It displays beautifully. One section for each application name with the second column being all the user IDs with events sorted alphabetically by user name for each application. Is there a way to sort by highest number of events first vs. alphabetically by user ID? I want the app owners to see who the heaviest users are without having to scan the list, sort an export, etc. I thought that's what the last line would do but no luck. ... View more

So I took your query and I want to make sure I'm understanding the results properly. For the column marked max_15m, does that mean over the course of 24 hours there were "X" times it hadn't talked to Splunk for more than 15 mins? If so, I have a host in my results that shows "4" for max_15m column. That means there were four times for that host where it went more than 15 minutes without talking to Splunk? If so, I could increase the interval to 30m and see if that drops to zero. I really want to get as few alerts as possible. So if it's "normal" for a host to go four times a day for more than 15 minutes without talking to Splunk, I set the max delay time in my alert to something like 20, 30, 40, etc. mins based on the tweaking I do with your query. Am I understanding that right? ... View more