the docs link seems to be broken,.. hence replying link again.. https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/CommonEvalFunctions   strftime's "Date and time format variables" docs link... https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Commontimeformatvariables   ... View more

Hi @neilfajardo15, if you have few hosts is possible to insert them in the search, even if I always hint to use the lookup to have a more maintenable object. so, if you have three hosts, you could run something like this: | metasearch index=_internal | eval host=lower(host) | stats count BY host | append [ | makeresults | eval host="host1", count=0 | fields host count ] | append [ | makeresults | eval host="host2", count=0 | fields host count ] | append [ | makeresults | eval host="host3", count=0 | fields host count ] | stats sum(count) AS total By host | where total=0  Ciao. Giuseppe P.S.: next time, please, open a new question. ... View more

Good to know that!!!.. Happy Splunking 🙂 ... View more

Not sure if understand the question properly , but the the usual search NOT will work right ..? | metadata type=hosts index=xx_prod| search NOT (host=host1 OR host=host2) |eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn | eval age=tostring(age,"duration") | eval host = upper(host) | table host age LastActiveOn status | rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status ... View more

Many thanks!!! Success! Your configuration is rigth. ... View more

Hey there, This should grab all the errors per event into one single field. | rex "Transitioned\sto\sError\sState\s+(?<ALL_ERROR_LINES>[\n\r\s\S\d]+)" If you want to extract those errors individually. | rex max_match=10 "^(?<AA>[A-Z]+\sError:\s[^\n]+)" Or something more granular like field=value (ie: error_type=NECU msg="[0x0] _SynchronizationSGCUTimeout : Timeslice: 163 Submap: 83"), something like this should work. props.conf [your_sourcetype] REPORT-multi_errors = multi_error_values transforms.conf [multi_error_values] REGEX = ^(?<_KEY_1>[A-Z]+\sError):\s(?<_VAL_1>[^\n]+) REPEAT_MATCH = true CLEAN_KEYS = 1 Hope it helps. ... View more

What version of Splunk are you running?? Not sure why you are looking at the url... You can see the searches under saved searches...The search they use is not slow...its | tstats . | tstats count min(_time) as firstTime, max(_time) as lastTime, max(_indextime) as recentTime where _index_earliest=-10m@m _index_latest=-5m@m (`meta_woot_host_filter`) (`meta_woot_sourcetype_filter`) (`meta_woot_index_filter`) by host, sourcetype, index | eval host=lower(host) | eval _time=now()-300 | collect sourcetype=meta_woot index=`meta_woot_summary` | fields - _time count | eval hash=md5(host.sourcetype.index) | lookup meta_woot hash OUTPUTNEW _key as _key, firstTime as firstTimekv | eval firstTime=if((isnotnull(firstTimekv) AND firstTimekv I don't think you should re-invent the wheel here, especially if your reason for not using meta woot is that are on an old version, so just start simple with this | tstats count WHERE index=* by index, host, sourcetype ... View more

Hi Ravan, i tried your suggestions and when i try to search and getting below error index=netstat [|hsmsys] Error in 'hsmsys' command: Cannot find program 'hsmsys' or script 'hsmsys'. ... View more

Is it being read by a Universal Forwarder? Do they experience a performance issue that they are trying to work around or do they just think that a 30 minute interval will be better? If this log file is very busy then you could have a larger performance impact if you try to ingest it in larger 30 minute amounts. Little bites versus big bites. Please describe the performance issue and show us the inputs.conf stanza. ... View more

FYI may be worth creating a new question for the next question around this, I only bumped this old question to advise it was now possible to use a dynamic subject! ... View more

Hi jonuwz, i have field input_source_file and I need to make it a comma separated field, i followed your instruction but not able to get the result. data in input_source_file is : aaaa bbbb desired: aaaa,bbbb My query is: sourcetype="mslogs" ("MPSVCCMN_10081" OR "DBG_21430") earliest="12/5/2012:16:08:00" latest="12/5/2013:16:16:00" | rex field=_raw "Mapping service is running [(? (.+))]\sdep" | transaction source|search mapping_name=src_join_tgt_cachetuned*| rex mode=sed field=input_source_file "s/ /,/g" |* table mapping_name,input_source_file. sample event: 2012-12-05 20:19:17 INFO: [MPSVCCMN_10081] Mapping service is running [xxxx] deployed in [yyyy] 2012-12-05 20:19:17 INFO: READER_1_1_1, DBG_21430, Reading data from input source file [aaaa] 2012-12-05 20:19:17 INFO: READER_1_2_1, DBG_21430, Reading data from input source file [bbbb] ... View more

Hi there, I am assuming that you want to extract the hostname into a new field (since 'host' is a field that is always set). Just getting the host part of a FQDN is pretty straightforward (assuming that your field is called "FQDN"); ... | rex field=FQDN "(?<host_name>[^.]+)\." | table host_name and you can start using the new field straight away, as indicated above. hope this helps, Kristian ... View more

This (should be) fairly trivial as part of your scheduled search that creates your lookup. I assume that your lookup is created roughly as follows: some_search_terms | inputlookup append=true lookup.csv | some_other_stuff | outputlookup lookup.csv Following this paradigm, you can insert something like this before the outputlookup : | where _time >= now() - (86400 * 45) ... View more

In transforms.conf just define something like [mylookup] filename = mylookup.csv then you can just search with search | outputlookup mylookup You will need to restart splunk for this change to take effect ... View more

On the off chance that your SQL Database vendor is MYSQL , then you can perform lookups directly against the DB: http://splunk-base.splunk.com/apps/36664/splunk-mysql-connector ... View more

Above Query working fine , but in few results i found reporting date's as 2013/14 year ... Is it problem from splunk server OR clients end ..? ... View more

define a field extraction in props.conf and transforms.conf for your sourcetype see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf by example, if your sourcetype is mysourcetype in .../local/props.conf [mysourcetype] TRANSFORMS-extractmyfields=extract_mysourcetype in .../local/transforms.conf [extract_mysourcetype] DELIMS = "|" FIELDS = "InstantType","DateAndTime", "Hostname, "pid", "dbservername", "user", "name", "errno", "Event", "Other" ... View more

Coalesce is woefully underutilized and a great suggestion. However, as you have it here, it will produce a significantly different result than what the if(isnull()) commands I posted above will do, and significantly different than what atornes was looking for. Again though, props for remembering coalesce. If you really want to use coalesce in this situation you would need: | eval field1=coalesce(field1, 0) | eval field2=coalesce(field2, 0) | ... View more

Hi, This depends on our authentication method are you using local or LDAP/AD logins? Either way I think you'd need to use a subsearch that first looks for the user logins and then determines if they are part of the admin group "like" this: source=<login events> user=* [source=<table or log that determines admin group membership> | fields user] | stats count by user ... View more

Do you have any data in any indexes currently that includes information on what users are members of what AD groups and/or what users are members of what groups on each local machine? Your first step will be gettign that data into Splunk. ... View more

i just added (?m) to the regular expression; see if that will get all the privileges. If not, try (?ms) at the beginning of the regular expression. ... View more