Did you ever circle back to this issue and discover the actual cause? I have something similar where a script that runs via CLI as root or user splunk works as expected, but when executed via Splunk application, the behavior is different. I can workaround by outputting to a logfile and then using Splunk to ingest the content. ... View more

@to4kawa, thanks for the answer. I modified it slightly just for formatting purposes and to grab the "latest" instead of "last" event. Final query follows: my_search | multikv forceheader=1 | table _time host Name Status | stats latest(_time) as _time latest(Status) as Status dc(Status) as SC by host Name | where SC > 1 | table _time host Name Status ... View more

Aren't host and _time native parameters splunk includes as part of every event ingested? There is no logfile; the powershell script calls the Get-IISAppPool object and the output of that is directly ingested, which is the output I originally included. I've modified your suggestion like this but it's kludgy: host=xyz sourcetype=IISAppPool earliest=-5m | multikv forceheader=1 | table host _time Name Status | append [ search host=xyz sourcetype=IISAppPool earliest=1h| multikv forceheader=1 | stats dc(Status) AS SC BY host,Name | where SC > 1 ] | table host _time Name Status It shows all the AppPools on a given host when I really only want to display the status of the AppPools where SC > 1. Ideally instead of showing the impacted AppPool twice, it would just show once, and include the time of the last change and the current status. ... View more

Your solution does identify situations where dc(Status) > 1, so it correctly finds situations when the service state has changed over a given period. But how would I still display the host, time of last change, and current status? I can add "host" to my display parameter stats dc(Status) AS Status_change BY host,Name but if I add the other columns the dc count becomes invalid. ... View more

For my issue I discovered I needed to create a [kvstore] stanza in server.conf for FIPS to work. [kvstore] caCertFile = path serverCert = path sslPassword = password ... View more

Having the same problem and yes, on a STIG-ed machine. The error started when enabling FIPS mode, including new SSL certificate (generated w/FIPS enabled and using the "splunk cmd openssl" commands). Any recommendations? ... View more

I think that because of other posts in the community, seems like a subsearch is the way to accomplish what I want. The first query does not yield any results. 'nowstr' is defined by my statement above. Using today's date, its value is (serial 2019102402). No quotes. ... View more

Also works with either "makeresults" or "gentimes start=-1". I don't know the difference, if one is better (more economical for search). ... View more

Trying that "Error in 'search' command: Unable to parse the search: unbalanced parentheses.". But I did not know about the return command, using that I was able to get it to work. There's likely a better, more elegant solution, but it returns the results expected! 🙂 ... View more