I'm looking for login attempts and the question is to identify new attempts from usernames that previously didn't try.    Day 1  = day count of new seen 3 bob sam steve Day 2      = day count of new seen 2 sam  # because previously seen, exclude from count tom ralph ... View more

I was so close at one point but didnt have the trailing \d. Thanks so much ... View more

THanks got it to work without the if statement was almost there just didnt think about the eval for that.  ... View more

Thanks, I can do it by the time of the event but what I am looking for is by the firstSeen value from the event itself.    eval FirstSeenMonth=strftime(firstSeen,"%b") How can I group by FirstSeenMonth or is there something else I need to do before I do any charting? ... View more

THanks, was close but long day and brain stopped working.  ... View more

perfect, thanks. need to learn that bin function... ... View more

eval is not matching correctly. the mvfind says it has an error.  ... View more

not sure how it was exceeded as I only take in a csv with max 30 lines per day at 12:00 (covid data from the city) for a test I was doing. I did have a internet speed test that splunk injected every hour but that only contained one line of date_time,download speed. I am running on linux so may try to reinstall. or just move to another platform.  ... View more

I think I see the problem. During the trial I created these things under a user i created or admin. Since I downgraded there is no user. I changed all the permissions/owner to nobody but not sure where else I need to change. But my newly created items are listed as nobody as the owner.  ... View more

Ok, thanks for the help. Not a big deal if a one off. But I don't want to rebuild every time.  ... View more

Migrating to: VERSION=8.0.5 BUILD=a1a6394cc5ae PRODUCT=splunk PLATFORM=Linux-x86_64 Copying '/opt/splunk/etc/myinstall/splunkd.xml' to '/opt/splunk/etc/myinstall/splunkd.xml-migrate.bak'. Checking saved search compatibility... Checking for possible timezone configuration errors... Handling deprecated files... Checking script configuration... Copying '/opt/splunk/etc/myinstall/splunkd.xml.cfg-default' to '/opt/splunk/etc/myinstall/splunkd.xml'. Deleting '/opt/splunk/etc/system/local/field_actions.conf'. The following apps might contain lookup table files that are not exported to other apps: departures-board-viz event-timeline-viz heat-map-viz missile_map network-diagram-viz splunk_monitoring_console Such lookup table files could only be used within their source app. To export them globally and allow other apps to access them, add the following stanza to each /opt/splunk/etc/apps/<app_name>/metadata/local.meta file: [lookups] export = system For more information, see http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/SetPermissions#Make_objects_globally_available. Checking for possible UI view conflicts... App "splunk_monitoring_console" has an overriding copy of the "dashboards.xml" view, thus the new version may not be in effect. location=/opt/splunk/etc/apps/splunk_monitoring_console/default/data/ui/views App "splunk_monitoring_console" has an overriding copy of the "reports.xml" view, thus the new version may not be in effect. location=/opt/splunk/etc/apps/splunk_monitoring_console/default/data/ui/views App "splunk_monitoring_console" has an overriding copy of the "alerts.xml" view, thus the new version may not be in effect. location=/opt/splunk/etc/apps/splunk_monitoring_console/default/data/ui/views Removing legacy manager XML files... Removing legacy nav XML files... DMC is not set up, no need to migrate nav bar. Removing System Activity dashboards... Removing splunkclouduf XML file... Removing splunkclouduf view XML files... Distributed Search is not configured on this instance Removing legacy search.xml file from splunk_instrumentation... Deleting '/opt/splunk/share/splunk/search_mrsparkle/modules'. Moving '/opt/splunk/share/splunk/search_mrsparkle/modules.new' to '/opt/splunk/share/splunk/search_mrsparkle/modules'. Checking for the modules related files and folders that should not be present after upgrade. Checking for the Advanced XML dashboard templates that should not be present after upgrade. Checking for the 'Getting Started' app that should not be present after upgrade. It seems that the Splunk default certificates are being used. If certificate validation is turned on using the default certificates (not-recommended), this may result in loss of communication in mixed-version Splunk environments after upgrade. "/opt/splunk/etc/auth/ca.pem": already a renewed Splunk certificate: skipping renewal "/opt/splunk/etc/auth/cacert.pem": already a renewed Splunk certificate: skipping renewal Clustering migration already complete, no further changes required. Generating checksums for datamodel and report acceleration bucket summaries for all indexes. If you have defined many indexes and summaries, summary checksum generation may take a long time. Processed 1 out of 12 configured indexes. Processed 2 out of 12 configured indexes. Processed 3 out of 12 configured indexes. Processed 4 out of 12 configured indexes. Processed 5 out of 12 configured indexes. Processed 6 out of 12 configured indexes. Processed 7 out of 12 configured indexes. Processed 8 out of 12 configured indexes. Processed 9 out of 12 configured indexes. Processed 10 out of 12 configured indexes. Processed 11 out of 12 configured indexes. Processed 12 out of 12 configured indexes. Finished generating checksums for datamodel and report acceleration bucket summaries for all indexes. [App Key Value Store migration] Checking if migration is needed. Upgrade type 1. This can take up to 600 seconds. [App Key Value Store migration] Migration is not required. [App Key Value Store migration] Checking if migration is needed. Upgrade type 2. This can take up to 600 seconds. [App Key Value Store migration] Migration is not required. [DFS] Performing migration. [DFS] Finished migration. ... View more

migration.log.2020-07-30.12-07-30 ... View more