Thanks, converted to answer - feel free to accept it 🙂 cheers, MuS ... View more

Your regex is technically correct, but the example shows "(?<host>[ies|wv|inn].*.mentorg.com)" as regex where it will capture either its,wv, or inn followed by anything followed by mentors.com. In other words it captures the FQDN not just the host. Does that make sense? ... View more

Hi nadlurinadluri, you can configure the maps viz using format : Also you can use other maps, like a Choropleth maps https://docs.splunk.com/Documentation/Splunk/latest/Viz/choroplethmaps or any other map tiles like in this example https://answers.splunk.com/answers/368073/how-to-use-custom-tiles-in-splunk-maps-offline-wit.html#answer-368127 or in this one https://sideviewapps.com/2871/custom-maps/?cn-reloaded=1 Hope this helps to get you started ... cheers, MuS ... View more

check for typos did you restart Splunk after the change? check $SPLUNK_HOME/bin/splunk btool props list --debug and $SPLUNK_HOME/bin/splunk btool transforms list --debug to see if your config is used Make sure the host name in the props stanza matches the entire name, not just a substring (and it is case sensitive 😉 ) Should not be a show stopper, but in the regex use a \. to match a . Beside that, out of ideas right now ¯\_(ツ)_/¯ ... View more

and also check the broswer's inspect tool to see what happens, and check Splunk's internal logs for any error message. ... View more

I know it's a lame question, but did you try a different browser? ... View more

Did you just upgrade to a newer version of ES? If so, clear the browser cache and try again. cheers, MuS ... View more

Hi splunkhan, untested and just making this up, but something like this should work: | lookup host_email.csv | search "error1" OR "error2" OR "error3" OR "error4" OR "exception1" OR "exception2" OR "exception3" | stats count values(_raw) by host | search action.email=1 action.email.to=email_address | map maxsearches=0 search="stats count | fields - count | sendemail from=buttercup@splunk.com to=$action.email$ subject=$alert.subject$ message=$alert.message$ sendresults=true" You might need to modify to work correct, and read about the sendemail command here https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sendemail and the map command here https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map Hope this helps ... cheers, MuS ... View more

Hi JoshuaJohn, you should not use join for reasons. You can use a multireport to do this, and this SPL is un-tested so you might have to modify it to match 😉 | multireport [ search index=nitro_prod_loc_server earliest=-4h | stats values("locId") as All_Locs ] [ search index=nitro_prod_loc_server appName="nitroCheck" bdy.addInfo{}.key="Serial Number" | stats values("locId") as "Checked_Locs" ] | streamstats count(index) AS c_idx | where c_idx < 2 AND isnull(appName) This would assume you have no appName field returned from the first search. Hope this helps ... cheers, MuS ... View more

Hi LeeSart 😉 Search splunkd.log or index=_internal for the bucket ID to see if there are more messages related to this bucket. cheers, MuS ... View more

The buckets will age out once the latest event in the buckets is older than frozenTimePeriodInSecs , that said you will always have events that are actually older than frozenTimePeriodInSecs . cheers, MuS ... View more

Hi djkj957, Don't use join for reasons. Use a stats instead and you will not hit any hidden limits: [code] OR ( index=os s_ip=10.x.x.x | stats values(*) AS * by ip _time Hope this helps ... cheers, MuS ... View more

I'm pretty sure it would if you could provide more context, and some sample events 😉 ... View more

Hi pench2k19, best option is to forget about join completely for reasons. Just use a plain stats instead: query1 OR query2 | stats values(*) AS * by SOR this works best, and you will not hit any hidden limits 😉 Learn more over here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html cheers, MuS ... View more

Hi JPaule, give this a try: | makeresults | eval foo="s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz" | rex field=foo "(?<s3BucketName>^s3:\/\/[^\/]+\/[^\/]+\/AWSLogs\/)" Hope this helps ... cheers, MuS ... View more

Seriously if you have to set this value, you are best to either @#$@#$#$% or point your devs to this http://dev.splunk.com/view/logging/SP-CAAAFCK Or use black magic or cough cribl cough to make the events useable 😉 cheers, MuS ... View more

ou peut-être j'appelle @yannK pour aider 😉 ... View more

Hi mvagionakis, mon français n'est pas très bon, but I try my best 😉 You can create a dynamic extraction using props.conf and transforms.conf like this; first add a props.conf stanza to match your sourcetype: [le type de source d'analyse de bureau] REPORT-001_mon-entrée-uniq-ici = extraireDesPairesDeValeursDeClésDynamiques next you need to configure a transforms.conf stanza: [extraireDesPairesDeValeursDeClésDynamiques] REGEX = \<(\w+)\>([^\<]+)\< FORMAT = $1::$2 this will create a dynamic search time extraction of the XML tags as field and their value. You must excuse my for trying to add some french to the answer, it might not have worked out in the end but check this answer https://answers.splunk.com/answers/319646/how-to-write-the-regex-to-extract-data-inside-squa.html to get an idea how it is done 🙂 Hope this helps anyway ... à votre santé, MuS ... View more

Hi moizmmz, need to trick Splunk for this, because if there are no events Splunk will show No results found . So you need to add fake events and do some logic around. Try this run everywhere search: index=_internal sourcetype!=splunkd_* baz | append [| makeresults | stats count(foo) AS count | eval _raw="Nothing to see here, move along!"] | streamstats count AS line_num | eval head_num=if((line_num > 1),(line_num - 1),1) | where (true() XOR ((count == 0) AND (head_num < line_num))) | fields - column, count, head_num, line_num | sort -_time | table * The benefit of this search is that if there are no events it will only show one column with the message 😉 Hope this helps to get you started ... cheers, MuS PS: another example can be found here https://answers.splunk.com/answers/704513/how-do-i-show-0-when-no-results-are-found-in-a-rep.html ... View more

Hi leejaeyong, you can try this: | makeresults count=100 | streamstats count AS foo | eval factor1_min=(random() % 100) /2, factor1_hierarchy_flag=(random() % 100) +2 | rename comment AS "This ^^^ just creates dummy data" | eval factor1_prev=factor1_min+factor1_hierarchy_flag*(foo-1), factor1_pv=factor1_min+factor1_hierarchy_flag*foo, factor1_next=factor1_min+factor1_hierarchy_flag*(foo+1), factor1_hierarchy=case(factor1_prev < factor1_pv AND factor1_pv <factor1_next, foo, factor1_pv>factor1_max, 0, true(), "unknonw") Everything up until the rename command creates just dummy events, and the last eval will be your loop over the 100 events. In this example foo is your i in your code. Hope this helps ... cheers, MuS PS: I noticed that in your example factor1_max is missing that's why the last case() statement never will match. ... View more

Can you please add some anonymised event samples? ... View more