which version are you in? can you share screenshot? Have you gone to your master node (node 1) and restarted Caspida? ... View more

@jip31 Not exactly sure what you looking for but can you try below. Also what is the final output you need host field and count or more fields ? index="x" sourcetype="y" process_cpu_used_percent>80|stats count by host ... View more

The field should be parsing by default. Do you have the Splunk TA for Windows installed on the Search Head (Link: https://splunkbase.splunk.com/app/742/)? If so, this search should work: index=<<your_index>> source="WinEventLog:security" EventCode=4738 Account_Expires="<never>" ... View more

You would need to modify the value of SPLUNK_BINDIP in $SPLUNK_HOME/etc/splunk-launch.conf: https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Splunk-launchconf SPLUNK_BINDIP=<ip address> * Specifies an interface that splunkd and splunkweb should bind to, as opposed to binding to the default for the local operating system. * If unset, Splunk makes no specific request to the operating system when binding to ports/opening a listening socket. This means it effectively binds to '*'; i.e. an unspecified bind. The exact result of this is controlled by operating system behavior and configuration. * NOTE: When using this setting you must update mgmtHostPort in web.conf to match, or the command line and splunkweb will not know how to reach splunkd. * For splunkd, this sets both the management port and the receiving ports (from forwarders). * Useful for a host with multiple IP addresses, either to enable access or restrict access; though firewalling is typically a superior method of restriction. * Overrides the Splunkweb-specific web.conf/[settings]/server.socket_host param; the latter is preferred when SplunkWeb behavior is the focus. * Defaults to unset. Be careful when modifying this variable. Certain apps that store credentials for modular inputs often try to retrieve those credentials by hitting REST endpoints on localhost. If Splunk isn't bound to localhost it could cause the modular inputs to fail. ... View more

urldecode works for decoding the values of URL addresses and strings Try the below examples: with url : | makeresults | eval field1= "f%23has%2Bofh%20a" | eval field1 = urldecode(field1) with string: For example you already have field value then, | rex mode=sed field=field1 "s/ / /g" | eval a=urldecode(field1) ... View more

add this to your base search date_wday IN (monday,tuesday,wednesday,thursday,friday) date_hour>=0 date_hour<=12 you might need to tweak the <=12 depending on your requirements index=dcsdjc host=awer THREAD_WALL_MS!=null date_wday IN (monday,tuesday,wednesday,thursday,friday) date_hour>=0 date_hour<=12 | bin _time span=1h | streamstats count as Req by host, _time | eval RequestsPerMin=Req/60 | eval RequestsPerSec=RequestsPerMin/60 | stats avg(RequestsPerMin) as AvgRequestsPerSec, max(RequestsPerMin) as MaxRequestsPerSec, p95(RequestsPerMin) as P95RequestsPerSec by host | eval AvgRequestsPerSec=round(AvgRequestsPerSec,2), MaxRequestsPerSec=round(MaxRequestsPerSec,2), P95RequestsPerSec=round(P95RequestsPerSec,2) | sort -MaxRequestsPerSec, -P95RequestsPerSec ... View more

Hey, Thank you ill give this a shot 🙂 ... View more

@vpurushottam I have convered comment by @pkeenan87 to answer. Please accept the answer to mark this question as answered! @pkeenan87 while posting SPL, Code, Data on Splunk Answers you should use the code button i.e. button with 101010 or Shortcut Ctrl+K to ensure that the special characters do not escape. ... View more

This helped clarify a lot! Thank you for linking that! ... View more

Will give it a try, thank you! ... View more

First of all, always store your times as time_t values (AKA epoch , which is an integer); never as a formatted time. When you pull the data back in, DO NOT convert it with eval , instead use fieldformat so that when you write it back out, it is still a time_t . Better yet, just keep the time value as _time which has an implied fieldformat already. This makes the math and other work very easy, like this: index=foo sourcetype=bar | other command stuff here | inputlookup append=t YourLookupHere | dedup YourByFieldsHere | where _time >= relative_time(now(), "-30d@d") | outputlookup YourLookupHere ... View more

Look at this too: https://docs.splunk.com/Documentation/Splunk/7.2.4/Indexer/Updatepeerconfigurations ... View more

This did the trick. Thank you very much. ... View more

Thanks nickhillscpl ... View more

Yeah, the problem with this search is that return an hosts that are offline for months. Strange. ... View more

You can have a list of sourcetypes which you want to monitor in a lookup along with max allowed delay time and using metadata, you can monitor them. https://answers.splunk.com/answers/730503/query-to-see-the-forwarder-does-not-send-logs.html#answer-729766 ... View more

It is. index="_internal" shows events from all the servers, including the licence masters. ... View more

Try this: In props.conf: [YourSourcetypeHere] TRANSFORMS-set = setnull, setkeep In transforms.conf: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setkeep] REGEX = \,\d{3}\s*\w+\s*\[type=(?:SYSCALL|EXECVE)] DEST_KEY = queue FORMAT = indexQueue ... View more

What's the query you tried? Also could you share your full query with additional filters? (mast anything sensitive) ... View more

Thank you so much for the quick answer. ... View more

Thank you pkeenan87. it really helps. ... View more

ok, the query i provided first is a dummy query that creates fake data and shows that the regex works try it top make sure its fine. on your real data, use this: index=YOUR_INDEX_NAME_HERE host=YOUR_HOST_NAME_HERE source=//mls-ingest-logs/ingest-mls-summary*.log| rex field=_raw "taken:\s+(?[^\s]+)" ... View more

reltime is the command available to get "The number of hours/days" from the _time field. https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/SearchReference/Reltime#Examples ... View more

Thanks @pkeenan87, that seems to be exactly what I was after! ... View more