I have some saved Splunk reports. I am calling these reports every hour by JAVA API call. If any hour due to some issue my query failed, I am updating that entry in table. Next hour, while running this query, i want to run for last 2 hour time range, instead of 1 hour. Is there any way, I can control time range of saved search. I didn't have any time field in my report. I am using Splunk Enterprise Security 7.2.5.1 . ... View more

I have some reports saved under search app. I want to access these report output via Splunk REST API in a java program. I am trying below rest API for accessing output in java program. API: https://hostname:8089/services/saved/searches/report_name I can get all related details of this report but unable to get actual output. Can anyone help me getting the output of this report in json format. ... View more

I am getting my input in json format like below, {"message":{"SID":"DEV","TIMESTAMP":1563095600,"PARAMS":[{"PROC_CODE":"10110","PROC_VALUE":" 2","SYS_NAME":"ALL"},{"PROC_CODE":"10010","PROC_VALUE":"20190712","SYS_NAME":"sapbcsdev_DEV_00"},{"PROC_CODE":"10020","PROC_VALUE":"125853","SYS_NAME":"sapbcsdev_DEV_00"},{"PROC_CODE":"10030","PROC_VALUE":"9","SYS_NAME":"sapbcsdev_DEV_00"},{"PROC_CODE":"10040","PROC_VALUE":"1","SYS_NAME":"sapbcsdev_DEV_00"} I am printing this value in table by using below query. index="test_data" sourcetype="SAP:data" | rename message.PARAMS{}.PROC_CODE as PROC_CODE, message.PARAMS{}.PROC_VALUE as PROC_VALUE, message.PARAMS{}.SYS_NAME as SYS_NAME, message.SID as SID, message.TIMESTAMP as TIMESTAMP | eval TIMESTAMP=strftime(TIMESTAMP, "%Y-%m-%d %H:%M:%S") | eval mvf1 = mvzip(PROC_CODE, PROC_VALUE, ";") | eval mvf2 = mvzip(mvf1, SYS_NAME, ";") | mvexpand mvf2 | eval n=split(mvf2,";") | eval PROC_CODE=mvindex(n,0), PROC_VALUE=mvindex(n,1), SYS_NAME=mvindex(n,2) | lookup PROC_DETAIL PROC_CODE OUTPUT PROC_CODE PROC_NAME PROC_PARA PROC_TYPE | search SYS_NAME="*" PROC_TYPE=* PROC_PARA=* | table TIMESTAMP SID SYS_NAME PROC_TYPE PROC_PARA PROC_CODE PROC_NAME PROC_VALUE Below is the output of this query. TIMESTAMP SID SYS_NAME PROC_TYPE PROC_PARA PROC_CODE PROC_NAME PROC_VALUE 2019-07-14 08:48:20 DEV ALL KPI ALL 10110 Number of App Servers 2 2019-07-14 08:48:20 DEV sapbcsdev_DEV_00 INFO INSTANCE 10010 INSTANCE START DATE 20190712 2019-07-14 08:48:20 DEV sapbcsdev_DEV_00 INFO INSTANCE 10020 INSTANCE START TIME 125853 2019-07-14 08:48:20 DEV sapbcsdev_DEV_00 KPI INSTANCE 10030 Workprocess Dia Active Count 9 2019-07-14 08:48:20 DEV sapbcsdev_DEV_00 KPI INSTANCE 10040 Workprocess Upd Active Count 1 Now when I am trying to publish some trent using timechart like avg/ min/ max on PROC_VALUE, i am not getting proper output. I assume that still PROC_VALUE is behaving like multi value field. ... View more

I am trying to create a time series chart but not getting any data in visualization tab. index="test_data" sourcetype="SAP:data" | lookup PROC_DETAIL PROC_CODE OUTPUT PROC_CODE PROC_NAME PROC_PARA PROC_TYPE | search SYS_NAME="*" PROC_TYPE=* PROC_PARA=* PROC_CODE=10130 | timechart span=5m max(PROC_VALUE) as "Max Value" I am getting data in statistics tab like below. But in visualization tab not showing any chart. _time Max Value 2019-07-06 05:15:00 2 2019-07-06 05:20:00 2 2019-07-06 05:25:00 2 ... View more

I have 3 different searches. All are printing separate tables. I want to configure the single alert, which will contain all 3 table one after other. Is this feature available in Splunk 7.1? I want the email content like below. table 1 **col1 col2 col3** row1 row1 row1 row2 row2 row2 table 2 **col1 col2 col3** row1 row1 row1 row2 row2 row2 table 3 **col1 col2 col3** row1 row1 row1 row2 row2 row2 ... View more

I have a tabular data like below. **EventTime SQL CPU Utilization Other Process CPU Utilization Total CPU Utilization** 2019-02-24 10:00:48.0 0 3 3 2019-02-24 10:01:48.0 0 2 2 2019-02-24 10:02:48.0 0 1 1 2019-02-24 10:03:48.0 0 1 1 2019-02-24 10:04:48.0 0 2 2 2019-02-24 10:05:48.0 0 2 2 2019-02-24 10:06:48.0 0 2 2 2019-02-24 10:07:48.0 0 3 3 2019-02-24 10:08:48.0 0 5 5 2019-02-24 10:09:48.0 0 3 3 i tried to use the line chart and print EventTime on X-axis and rest values on Y-axis. I am able to get the values on Y-axis but X-axis not displaying the data of EventTime field. I used below query. index=main sourcettype="SQL" host=ABC | eval Total_CPU_Utilization=(SQLCPUUtilization+OtherProcessCPUUtilization) | chart latest(SQLCPUUtilization) as "SQL CPU Utilization", latest(OtherProcessCPUUtilization) as "Other Process CPU Utilization", latest(Total_CPU_Utilization) as "Total CPU Utilization" by EventTime Do I need to make any changes in my query? ... View more