Im attempting to show when a file was received and when it was sent out. The code below generates the table below that.. index=syslog (source=“Outbound.log" OR source="Inbound.log") |stats values(User) as user, earliest(_time) as received, latest(_time) as sent by externalId |eval oc_received = strftime(received, "%F %T") |eval oc_sent = strftime(sent, "%F %T") |eval oc_time = round((sent - received)/3600,2) |fields user, externalId, oc_received, oc_sent, oc_time |sort - oc_time example_user | example_id | 2019-12-24 05:32:22 | 2019-12-24 05:32:22 | 0.50 But won’t output a result when it just received the file but did not send it yet. Is there a way I could have these show as blank or NULL in the table? And if it is empty how would I generate the time difference as between now and when it was sent Thanks! ... View more

I currently am trying to extract the externalDropshipId from the following log "updatedTimestamp" : "2019-12-23T20:43:04.774Z", "fulfillmentOrderId" : "124B27HTRBRZC9L6P9KL7GC968", "externalOrderId" : "9163225842155", "externalDropshipId" : "6372205554", I am using the field extractor and selecting externalDropshipID as the required text and 6372205554 as the field. This is resulting in the following error.. The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings. How would I go about fixing this? Thanks ... View more

I'm trying to add the hostnames that result from a search to the email subject of an alert but currently I'm only able to have 1 hostname in the subject when I use $result.host$. For example if the search results in having host1 and host2, only host1 will show up in the email subject line. Is there a way to have both hosts show? Thanks ... View more

I'm having some trouble with getting the top 5 line values on a line chart. My current search is below index=db sourcetype="dbmetrics" db_type IN (DB2, SQLSERVER) |eval db_inst=db_instance +" - " +application |eval db_app=database +" - " +application |eval db_info=coalesce(db_app, db_inst) |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=0 The problem is that when I add where MAX in top5 I get the warning splunk Series filtering is disabled if a split-by field average. Is there another way to get this to work? Currently it looks like this but I want it to just show the top 5 lines. Note: I have to take the average of db_connections due to certain db_instances having multiple events per hour Thanks for any help. ... View more

I'm trying to create a single value panel that shows the total count of results in panels on the dashboard. So say if Panel number 3 , 5 and 8 on the dashboard are showing results the single value panel at the top would say 3. Thanks for any help! ... View more

So I am currently trying to compare the average value of a field is using 7 days of events to what the value is currently. If the current value is greater than 3 times that average I want it to send an alert. Currently I am able to do the first part that finds the average count of the field but I am unable to figure out how to compare that to the current field value. index=db sourcetype="dbmetrics" earliest=-7d | stats avg(db_connections) as DBConnectionsAvg by database Sorry if the explanation on this is messy, pretty new to Splunk ... View more

I am trying to create an alert for the below search that would go off if within the event there are 10 times where EventCode equals 1 within a 5-minute span. I also want EventCode equals 2 once within that span which is why I am doing the search for EventID equals 1 AND EventID equals 2. index="myindex" EventCode=1 OR EventCode=2 earliest=-5m | transaction user | search EventID=1 AND EventID=2 | eventstats count(eval(match(EventID,"1"))) as loginFail count(eval(match(EventID,"2"))) as loginSuccess by user |table user,loginFail,loginSuccess |where loginFail >= 10 Currently the results of this search are: user loginFail loginSuccess testuser 1 1 exampleuser 1 1 Even if there are 3 times within the transaction where EventID equals 1 and 1 time where it equals 2. Thanks for any help! ... View more