add |convert ctime(_time) at the end ... View more

adding to this, if you want email alert for each url result, select action on "each result" in email settings ... View more

I will catch you Splunker ... View more

Hey, Intruder, you can't escape Splunker ... View more

We detect you Splunker ... View more

try this | stats sum(timediff) by process _time OR | chart values(timediff) over _time by process ... View more

index=wineventlog sourcetype=WinEventLog:Security [| inputlookup last_logon_lookup_20180928.csv | fields Account_Name] | lookup last_logon_lookup_20180928.csv Account_Name output Account_Name LASTLOGON |eval sourcefile="last_logon_lookup_20180928.csv" | table Account_Name LASTLOGON sourcefile ... View more

First group all events together, don't use joins. Pull transaction start and end, If you have these two events in different index OR sourcetypes, then append transaction start events to end using append command | transaction custID startswith="something which is in transction start events" endwith="something which is in transction end events" go through Transaction command in Splunk doc, you get to know how to use this command ... View more

add at the end |sucursal_id=$sucursal_id$ click on "add input" on your dashboard and select the text box and give the token name "sucursal_id" If this not you are expecting, explain your question clearly. ... View more

try adding at the end | bin _time span=3s | stats values(channel), values(duaration) ... View more

what is "any results", do you mean "no results found try expanding time range" Try this index="ai-wkst-windows-fr" sourcetype="tools:flags" filename=* | dedup host | eval filename=if(filename=="ACV-TOUPDATE.$w$", "YES", "NO") | table filename ... View more

| table src_ip dest_ip megabyte | addcoltotals megabyte labelfield=total(megabytes) label="src_ip" ... View more

this site is hiding some characters, that is why you are not able to see the whole regex (fieldnames), look at this https://www.regular-expressions.info/refext.html , you can see named capturing groups (3 ways) ... View more

Try something like this index=a | map search="| inputlookup lookupname | where ProductIDStart> $ProductID$ AND $ProductID$ < ProductIDEnd| table ProductName "| table type,productid,ProductName index=a | map search="| inputlookup lookupname | where ProductIDStart>\" $ProductID$\" AND \"$ProductID$\" < ProductIDEnd| table ProductName "| table type,productid,ProductName ... View more

use map command ... View more

remove join and see you get the same results (why you are using join), try this, I think you are expecting below the search index=main | search trainId=acggalladks" | stats earliest(cpu) as total_cpu sum(cpu) as MB by job | eval pct = round((MB/total_cpu)*100, 2) | table pct job ... View more

place " if(date_wday==lower(strftime(time(),"%A")),date_wday,"drop")" in macro defination and try, I think you don't want ro provide day(like tuesday) manually. ... View more

I am sorry, I want to find hosts which are down using logs. we are getting huge data sometimes and processing queues get blocked. Alert looks for the last 15 min and it doesn't find any data when queues are blocked and consider host is down and sending an email alert which is not expected. I want to stop alert using some conditions when indexer stops indexing. we get lookup data even indexing queues are blocked, when we run search we will have hostname and event count will be null because indexer stops indexing. I used metadata command, we get lasttime and recenttime, if indexer queues are blocked, it doesn't index data and doesn't show current time as recenttime (because not indexing) ... View more

I set up an alert, looks for the last 15 min data for every 15 min. I have a list of hosts in the lookup table, when the hosts in the lookup table is not reporting sends and an email alert. When indexing is stopped, or indexers are stopped, or indexing latency is more than 15min I am receiving alert for every host. I want to stop receiving alerts when environmental issue occurred |inputlooup host.csv | join host type=left [search index=* [|inputlooup host.csv]| stats count by host ] | fillnull value=0 | where count=0 I have a query something like this ... View more