Still works, thank you! ... View more

You need to install the following packages to get these commands: "strace" to get the strace command "tcpdump" to get the tcpdump command "sysstat" to get the iostat command "elfutils"  to get the eu-stack command   ... View more

Simply echoing xpac's excellent solution with my own, since I've encountered this as well, but perhaps another wording will help future readers as well.   When you write regex in a |rex command, backslashes must be used carefully, because there are multiple levels of escaping. The first is SPL level escaping, because the rex command accepts the argument for the regular expression in quotes, which means you must escape the " character with \ so your regex string can include it. Call this the SPL parsing step. For this to work, \ must also be a special character for the SPL parser. All this only applies to SPL commands like |rex and |regex that accept the regular expression as a string bounded by quotes. For these though, all " and \ characters must be escaped so they appear as literal in the true regular expression For the regular expression itself, " is not a special character, but \ is. So if you need to look for something like a literal \ in the message, your regex must specify \\, and your SPL must specify \\\\. SPL escapes this once to \\, which regex treats as a literal \. This is very annoying for cases where your message is escaped json formatting, as the string \" appears in the message itself. If you need to search for this in a |rex command, you'll need \\\\\".   For other methods of regex written in Splunk .conf files like field extractions, transforms, LINE_BREAKER, timestamp lookahead, etc., the regular expression syntax does not need to be escaped again because there's no SPL parser interpreting it first. Example: message you're searching: {\"key\": \"value\"} regex you want applied (and what should work in .conf files): {\\"key\\": \\"value\\"} how you must write the SPL command: | rex field=_raw "{\\\\\"key\\\\\": \\\\\"value\\\\\"}" ... View more

The thread is even older now, but I also found you need to specify  `'alert.suppress': 0` when posting to `/servicesNS/{owner}/{app}/saved/searches/` to make sure it's an alert and not a report. In total, I specified at least the below parameters to create an alert   { 'is_scheduled': 1, 'cron_schedule': '09-59/10 * * * *', 'alert_comparator': 'greater than', 'alert_threshold': 5, 'alert_type': 'number of events', 'alert.suppress': 0, }     ... View more

Can you be more specific about what you changed? ... View more

Awesome examples, thanks! ... View more

I looked way too hard to find this. Thank you for your answer! ... View more

The simplest answer is to just make a | table val1 val2 . Then switch to the Visualization tab and select a visualization like Line Chart , where your table will be graphed with val1 on the x axis, and val2 on the y axis. If you wish to graph more than 2 values, add them to your table also. Columns 2 and beyond will be graphed as separate series against the first column. This behavior is much like you'd expect making a line chart in excel. ... View more