I’m attempting to write an alert that fetches full event data while also comparing the counts of 2 other searches. The idea being that if C1 is greater than or equal to C2, an alert is fired with an email alert action, attaching the events so that business users can receive check it from their phone. This is the best I could come up with but it doesnt work. Anyone out there able to lend a hand? index=main loglevel=ERROR | stats count by _raw | appendcols [ search index=main loglevel=WARN | stats count(convId) AS C1 ] | appendcols [ search index=main loglevel=ERROR | stats count(convId) AS C2] | where C1 >= C2 ... View more

I'm working to simplify a serverclass.conf and am struggling to get regex working. For example: [serverClass:ConfigUnixBase_OnPrem_Denver_Lab] whitelist.0 = (?i)dhe[li]* # denver non-prod blacklist.0 = SPLUNK-DEPLOY* blacklist.1 = SPLUNK-CMASTER* blacklist.2 = SPLUNK-LICENSE* blacklist.3 = SPLUNK-SEARCH* blacklist.4 = SPLUNK-INDEXER* blacklist.5 = SPLUNK-HVYFWD* blacklist.6 = nhex* # new york prod blacklist.7 = nhed* # new york lab/dev blacklist.7 = nhep* # new york lab/dev I have hosts phoning in with the names dhelapp001 and DHEIAPP001 and neither are matching the whitelist. I'm reading the manual and I feel this should work from these lines: * These patterns are PCRE regular expressions, with the following aids for easier entry: * You can specify simply '.' to mean '\.' * You can specify simply '*' to mean '.*' * Matches are always case-insensitive; you do not need to specify the '(?i)' prefix. I've been banging at this for hours and cannot wrap my head around what regex can actually live in this value. Shouldnt (?i)dhe[li]* work in this case? Alternatively, I could list these out on two rows but then I have to duplicate even those to get around case-sensitivity (eg: dhel* will not match DHEL* ). ... View more