Use the raising column option. Set that to the date field. This will make sure you will not get duplicates. ... View more

Always try to avoid transaction command if you want to achieve better performance. You can improve the performance by 10 X times by using Splunk meta data fields. I can help you in that please contact me in fiverr or Email (hurdlej1@gmail.com) https://www.fiverr.com/s2/affc9b7a8a https://www.fiverr.com/s2/608e8ed73f?utm_source=CopyLink_Mobile ... View more

You can improve the performance by 10 X times by using Splunk meta data fields. I can help you in that please contact me in fiverr or Email (hurdlej1@gmail.com) https://www.fiverr.com/s2/affc9b7a8a https://www.fiverr.com/s2/608e8ed73f?utm_source=CopyLink_Mobile ... View more

You can improve the performance by 10 X times by using Splunk meta data fields. I can help you in that please contact me in fiverr or Email (hurdlej1@gmail.com) https://www.fiverr.com/s2/affc9b7a8a https://www.fiverr.com/s2/608e8ed73f?utm_source=CopyLink_Mobile ... View more

You can also do like this, | rex field=_raw "^(?:[^ \n]* ){3}(?P\w+)" ... View more

Just add dedup after the eventstats. index=* "message.Origin"=blabla source="something " | search logger="test1" OR logger="test2" | eventstats count(eval('logger' ="test1")) as "example1", count(eval(logger ="test2)) as "example2" by ID | dedup ID | table example1,example2,source,index,ID ... View more

Try to apply all searches at the first stage so that you will have less data for the computation. index=* "message.Origin"=blabla source="something " | search logger="test1" OR logger="test2" | eventstats count(eval('logger' ="test1")) as "example1", count(eval(logger ="test2)) as "example2" by ID | table example1,example2,source,index,ID ... View more

Replace stats with eventstats. index=* "message.Origin"=blabla source="something " | eventstats count(eval('logger' ="test1")) as "example1", count(eval(logger ="test2)) as "example2" by ID | table example1,example2,source,index,ID Note: Eventstats is not good if you are concerned about the performance. ... View more

If you are using base searches, you must return the fields required by all the panels on base search. If you do not return the fields on base search, then the panels will not work as expected. In you situation change your base search return fields, then your problem should be resolved. Please let me know if this doesn't work. <search id="baseSearch1"> <query> $control_token_visualizations$ |from datamodel:"Malware.Malware_Attacks" |search $env_tok$ dest="*$hostname_tok$*"$avtype_tok$ vendor_product="$vendor_tok$" sourcetype!=carbonblack:defense:json |fields vendor_product,dest </query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> </search> If you want to know how to use base searches with a quick example, you can also refer to the below video. https://www.youtube.com/watch?v=6s3jV6Tx6yg ... View more

We can reset both username(admin) and password to whatever we want. Changing admin password: Identify /etc folder of your splunk installation and rename passwd file to passwd.back (you can rename to anything we want) In the same etc folder, navigate to /System/local folder and create a file user-seed.conf. This configuration should have the latest password. [user_info] USERNAME = admin PASSWORD = changeme (you can enter whatever you want) restart the splunk. Now you will see a new passwd file will be created with admin as username and encrypted password. At this stage you should be able to login to Splunk with UserName as admin and Password as changme Rename the default username: -> we can go to etc folder and open passwd file and there we can rename the admin to whatever name we want. You can refer to below video for the instructions. https://www.youtube.com/watch?v=pJferqpXcsc&t=16s ... View more

You can try to download the dmg file from Splunk.com and double click on it to install. This is very easy step. I have installed the latest version of Splunk on Mac and I don't see any problems. Please note that the latest version of Splunk requires us to create username and password during the installation whereas with Old versions we get default username and password with it (admin/changeme) Download .dmg file from below location: https://www.splunk.com/en_us/download/splunk-enterprise.html#tabs/macos You can also follow the video on youtube. https://www.youtube.com/watch?v=1wkmEvsUe68 ... View more