Splunkers, Looking for some kind of time modifier that will allow the following alert to fire only if CPU has been at 97% or higher for more than 15 minutes. Here is the search string I've started working with: index=perfmon sourcetype="Perfmon:CPU" counter="% Processor Time" instance=_Total | stats max(cpu_load_percent) as load by host | eval load = round(load, 2) | where load >=97 | rename host as Host, load as "% Processor Time" Any advice would be great. Thanks. ... View more

Splunkers, Search String: admon-user-lookup-update | eval src_user = (cn) | fields src_nt_domain, displayName, cn | rename cn as user | join user [ search index=winevents (EventCode=630 OR EventCode=4726 OR Eventcode=4720 OR EventCode=4725) dest_nt_domain="xxxx" | fields user, action, ComputerName, EventCode, EventCodeDescription, src_user, status] I am able to match "cn" with user to produce a display name correlation between userid and full name.. How can I match src_user to use display name as well? ... View more

Splunkers, Looking for a search string that will allow me to use the time picker to see how much data has been indexed over 30, 60, 90, etc days by index. I tried a few searches but had no luck. Any help would be greatly appreciated. Thanks ... View more

Splunkers, I'm trying to display the results for several users using a multi-select dropdown on a dashboard. The results for one user will display correctly. When I add a second, third, fourth, etc user, I get no results found. Here is the SPL for the panel: index=trn5 source="*trn5/logs/system/access.log" NOT user="SYSUSER" NOT user="-" NOT user="USER01" NOT user="USER03" NOT user="USER04" NOT user="user10" NOT user="user11" NOT user="b12663" | lookup cis_users.csv userid AS user | search username="$input_user2$" | eval day=strftime(_time, "%B %d %Y") | eventstats range(_time) AS duration BY username day | stats values(duration) as duration by username day | eval duration=tostring(duration, "duration") | rename username as User, day as Date, duration as "Time in Portal" SPL for the dropdown: index=trn5 | lookup cis_users.csv userid AS user | fields username | table username | dedup username | sort 0 username Field for Label: username Field for Value: username ... View more

Splunkers, I'm attempting to display how long a user as spent in our training portal over the last 30 days. Search string: index=blah | stats earliest(_time) as login, latest(_time) as logout by user | eval diff=logout-login | eval diff=tostring(diff, "duration") | convert timeformat="%B %d %Y %I:%M:%S %p" ctime(login) | convert timeformat="%B %d %Y %I:%M:%S %p" ctime(logout) | rename user as User, login as Login, logout as Logout, diff as "Time in Portal" Any advice would be great. Thanks! ... View more

Splunkers, Here's the search string I'm using to calculate stdev over the last 30 days: | tstats count where index=* by host, _time span=1d | eventstats avg(count) as avg stdev(count) as stdev by host | eval lowerBound=(avg-stdev*exact(2)), upperBound=(avg+stdev*exact(2)) | eval isOutlier=if(count < lowerBound OR count > upperBound, 1, 0) | where isOutlier=1 My goal is to have this run as a report at 0600 everyday. I'm looking to display the results only from the previous day. Any guidance would be fantastic. Thanks ... View more