Thanks this is good info. ... View more

see the documentation on the stats command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats <mysearch >| stats avg(Failed_Attempts) avg(Passed_Authentications) ... View more

@yashwanth.g.prakash, you might have to provide sample data for scenarios mentioned above. Have you checked out the Splunk App for Cisco ISE: https://splunkbase.splunk.com/app/1589/ ... View more

To accomplish this for viewing of only those Dashboards/Panels within ES you would have to modify all of the panels/views within ES and remove Read (all) rights. Then you would create a New Role that did not inherit rights from any user and grant the needed index'es/rights for the Role. Then you would select all Roles for viewing minus your new role for the panels/dashboards you did not want view access on, then for the ones that the new User/Role would get View access to you would select that Role also or reselect (all). Again this method will take some time and will take some testing to verify all still works after the change. ... View more

Do you mean something with that kind of logic: tag=network | stats count(eval(action=="failure")) as failure, count(eval(action=="success")) as success by src | search failure > 100 success > 1 ... View more

Does this restart at the same time every night, at 23:15? If so, most likely there is some script in windows that is restarting the services, and you should talk to your windows admins. If the times are random, there is something else going on, maybe and upgrade to the latest version would help. ... View more