Where did you find the Power Automate IP`s that need adding to the Splunk API allow list ? ... View more

rex "<Channel [^>]+>(?<Channel>[^<]+)" ... View more

thank you! ... View more

wow thanks I was doing stats by Country but not getting anywhere. Never heard of nomv command. Thank you so much. ... View more

you are the guru! thank you!!! ... View more

Hmmm. Then a custom script might be a better option. May be in Python which can use search results (available in compression file, file path is sent to alert script as parameters) to generate necessary json (should be some libraries to do that) and send it to destination URL. ... View more

My answer does exactly that. It is a complete walk-through. Just give the code a try. ... View more

Since your question is resolved, please accept somesoni2's comment/answer that led to the resolution. ... View more

thanks. that helped me understand the logs. they were all SUCCESS. I was relying on the Splunk UI and it was not showing me anything Under the Alerts. it was always ZERO. Go figure. ... View more

@maximusdm, I am glad Advanced XML worked for you. However, you should also consider HTML panel with use of Background Image, icons and CSS to plot several outputs. Option 1 and Option 3 are not using Single Value visualization (only the name has been used to imply the kind of element being plotted). You should also keep SPL commands like transpose handy so that the results are converted to single row to be picked up by result.<fieldName> ... View more

thank you. that worked nicely. ... View more

aww I see it. Thanks for the explanation!!! Cheers! ... View more

thank you! ... View more

Thanks again! ... View more

eval amount= "$" + tostring(amount, "commas") ty ... View more

This resolved my problem by replacing the " i " with pipes before the next reg.exp. | rex field="Site Section" mode=sed "s,\sI\s, | ,g" | rex field="Site Section" ".|\s(?.)\s|" I want to thank you for pointing me to the right direction. ... View more

Convert your dashboard to html and add below &lt/heade&gt &ltstyle&gt .single-value .single-result { font-size: 1000px !important; } &lt/style&gt ... View more

This works for HTML dashboards not XML. Not quite so simple I don't think if you want to keep it as XML ... ... View more

I think your comments was the answer for your question. You can just vote up/like all the comments that helped you to resolving the issue. ... View more

Insert this into your search before you do the timechart - | eval MyDay = relative_time(_time,"-0d@d") | eval MySun = relative_time(_time,"-0d@w") | eval MySat = MySun+518400 | eval SkipWeekend = case(MyDay==MySun,1,MyDay==MySat,1,true(),0) | search SkipWeekend=0 Translation of the above code - set MyDay to the epoch time of the day portion of _time set MySun to the epoch time of the current/prior Sunday of _time set MySat to the epoch time of the Saturday which follows MySun. (518400 is the number of seconds in six days.) set SkipWeekend to 1 if MyDay is either MySat or MySun search for events where SkipWeekend is 0 The above code will work even if you plan your weeks to be Monday thru Sunday -- or even Wednesday thru Tuesday -- because regardless of what fiscal week a day might be in, it's still a Saturday. ... View more

Hope this works out: your query to return events | bucket _time span=1d | eval date=strftime(_time, "%Y-%m-%d") |eventstats dc(ID) as TEC | stats latest(duration) as Latest, values(TEC) as TotalEventsChecked by ID, date | search Latest>=20 | stats count(Latest) as Count_GreaterThan_20, values(TotalEventsChecked) as Total_Events_Checked, values(date) as Date ... View more

How about you use the relative_time to calculate when it happened and then chart using it. Let's say that the dates above are coming in a field called test in epoch time then try something like: your query to return events earliest="-21d" | eval myTime=case(test >= relative_time(now(), "-7d"), "CurrentWeek", test >= relative_time(now(), "-14d") AND test < relative_time(now(), "-7d", "PriorWeek", test >= relative_time(now(), "-21d") AND test < relative_time(now(), "-14d", "ThirdWeek", 1=1, "Other") | stats count("100_ of Ads Viewed") AS Total by myTime Assumption above is "-7d" means "seven days prior to now" and not exactly "Current Week starting from Monday" If test field has date as a string then take out the epoch time from it first, using strptime , before the case statement in above search as follows: ...| eval epochTest=strptime(test, "%Y-%m-%d") | eval myTime=case(epochTest >= relative_time(now(), "-7d"), "CurrentWeek",... and so on ... View more

You can add just a single data file to see preview. When you are adding multiple files you have to Turn Preview Data on. In any case, if it has worked once for you on any machine, all you are interested in, is exporting the props.conf file with the properties. Based on the name of the sourcetype you have selected. By default in your case it was [csv] however you can create any custom sourcetype like [mycustomcsv]. All you would need is to add the following properties to the props.conf file, under specific sourcetype, manually if you can't do the same through preview mode. TIME_FORMAT=%m/%d/%Y TIMESTAMP_FIELDS=Event_Date Like I had mentioned it would be most effective if you can ingest the data the way you want rather than modify things afterwards in the SPL. ... View more

That actually worked. I was comparing the data with an Excel spreadsheet and Splunk had a filter. All good. Thank you so much! ... View more