Alerts do not record when they were created or updated.  You should be able to get that information from the _configtracker index, however. ... View more

Hi @johnansett ,   The auto kv for JSON won't kick in unless the event is a JSON event (not a syslog event). The simplest way to automate this is with "2". Especially if your timestamp is "in" the JSON event and not the one in the syslog header. Another way to do this at search time is to use a Macro or eventtype instead of classic index=abc searches. As a last resort (if you dont want to change the event from syslog to JSON) you can even manually extract the field that you use the most and then make it a JSON event at search time when you need something that's not commonly used. Let me know if that helps. Cheers, David       ... View more

Thanks - that helped a lot. One note: At least since Splunk 7.x you can use `trim` instead of `rex`: ... | foreach Every Field That Might Be Empty or Have Only Whitespace Listed Here [ eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(trim(<<FIELD>>))==0, "0", <<FIELD>>) ] Also, in case you want to apply it for all fields, you can use `*`: ... | foreach * [ eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(trim(<<FIELD>>))==0, "0", <<FIELD>>) ]   ... View more

first: one minor change to the REGEX for the 404 status events:  if you use REGEX =  .*404.* it takes up events that have maybe a status 200 followed by 404 also. To prevent this you could use this REGEX instead:    "\s404\s    that way it only takes the first number after a quotation mark and a blank space also if you try to change the index AND the sourcetype for one input you might run into problems since splunk could potentially first address the new sourcetype and then try to send events into new indexes given the regex above. BUT when this happens they are already sourcetype=access_combined and not weblog anymore so it won't work or only one of those transforms.  the solution is as follows:  in props.conf your stanza shouldn't address the sourcetype "weblog" but rather the source from which your data originates.  [source::access_combined_no_breaks.log] this way it doesn't matter what happens first with your data cause the source will always stay the same.    hope this helps anyone who might run into the same problems. if so, pls consider thumbs up 🙂  ... View more

Are you using SAML?  If so, you may NOT have SLO configured correctly.  Double check the SLO URL and if you still have the issue, please create a Splunk Case. ... View more

Hi bnichols024, I think your REGEX is incorrect....you made the capture group a named group called event_type, rather than looking for the string. Try this: [setnull] REGEX = (event_type = SETXATTR) DEST_KEY = queue FORMAT = nullQueue ... View more

source="*WinEventLog:Security" sourcetype="*wineventlog:security" EventCode=4624 OR 4625 |timechart count(EventCode) by EventCode |untable _time EventCode Count |trendline sma5(Count) as trends |eventstats sum(Count) as total by EventCode ... View more

I see, I fix a mistake. please confirm updated answer. ... View more

Hi, Based on your requirement could you please try the below. |makeresults |eval _raw= "input_field DATA_ACE_CHE_Team FdTest@Labcatr DATA_ACE_CADD_Team DATA_ACE_CAM_Team DATA_ACE DATA_ACE_CSS_Team FG_sam Check@#$values checkme Data D&*fuse Data*now" |multikv forceheader=1 |table input_field |rex field=input_field "(?P<extracted_field>.*)(?:\_.+\_)" Also, could you please give expected input and output fields if this is not your requirement? ... View more

Thanks Dindu for replying, I tried using the changes your suggested : adding type="inner" and max=0 keeping the common field from the outer search ( nodeTrackingId) and rename the src_ip field from other search and also select all fields in the along with nodeTrackingId in the search in brackets but this did not change the result ... View more

If you want to install 8.0 on new server and import all data and configuration it will be longer task. Also there are few changes in indexes, I don't know in which version it introduced but during upgrade there was message about "Migrating Indexes" which means splunk is doing some work on existing indexes. So I'll suggest to upgrade as per splunk recommendation (6.5 -> 7.0 -> 8.0). ... View more

Like this: index="index" AND sourcetype="sourcetype") AND 'message.account'="account name" AND "message.title"="name" | rename message.account as Account | eval _time = 'message.timestamp' / 1000 | bin span=1m _time | dedup _time message.title | timechart span=1m sum(message.concurrent_sessions_minus_new60s) AS "Concurrent sessions" BY Account ... View more

Like this: | tstats max(_indextime) AS time_event_was_indexed max(_time) AS time_event_happened WHERE index="*" AND sourcetype="WinHostMon" BY host | sort 1 - time_event_was_indexed ... View more

Hi, If you are using the summary index and the data is stored as table.You could directly fetch from the summary index later. index=retention |table earliest,latest ,user ,host,day Read more about summary index - https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usesummaryindexing https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Configuresummaryindexes OR if you want the raw data to be persisted to the index "retention". Deploy the above index.conf in indexer and direct the Splunk forwarder to inject data to the "retention " index. ... View more

CAPS LOCK??? ... View more

Thanks for confirming!!!!!!! Could you please upvote so that it may help others. ... View more

Hi, I think your issue is mainly due to port associated with snmp. Splunk user does NOT normally have access to operate ports below 1024. Check inputs.conf, whether the trap port is set to a value below 1024. If so re-assign a free port in range of 80** Modify input.conf in the apps local and assign trap_port = 80** Please let us know whether this helped or not. ... View more

Setting it to 100.000 did not help (message is under 40.000 chars). ... View more

Hi, You could add a multi-select input in the dashboard. This will allow you to choose multiple values and use them anywhere on the dashboard. Click on the "Edit" button on the Top Right corner. Then click on "Add Input" and choose Multiselect. Give token a name like multi_input. The value can be retrieved anywhere in the dashboard by calling the variable $mulit_input$. Give static values and view the preview to add delimiters or so. ... View more

Hi Govind, You need to parse the JSON logs to achieve this. To parse the logs - you need to trim down the events to make it as exact JSON Splunk expects. Use regex or replace functionality for that. You could use the below query after that. |your_query |search documentType="ANNUAL_STATEMENT" |stats list (reference),list(name),list(mimeType),list(documentType),list(creationDate) |where mvcount(documentType)>1 ... View more

| makeresults | eval _raw ="2019-12-03 17:31:27.633 INFO ,aabbe872bbf3f848,aabbe872bbf3f848,false] 15 --- [nio-8080-exec-5] c.u.f.p.api.impl.: InfoLogging Operation=MakePayment, RequestSourceCode=ZBL, PaymentResponse=class PaymentResponse { responseCode: AB0000 responseMessage: Declined - Do not Honor orderId: 269107641 }" | rex mode=sed "s/(\w+): (.+?)(?= \w+\:| })/\"\1\": \"\2\",/g" | rex "(?<json>\{.+\})" | spath input=json make JSON by force. ... View more

How does this create 0's? I have a lookup (YearVM) that creates a list of all VM's existing for a year (which Is what I think you are doing ad-hoc for the append command per below) Let’s use our lookup to add in the missing items sourcetype=access_combined action=purchase | stats sum(price) as revenue by productID | inputlookup append=true productIDs | chart sum(revenue) as revenue by productID When I try it on a "Year to Date" on a VM that was created in July it simply lists all the values, no 0's. | lookup YearVM NAME1 as name OUTPUT NAME1 as lookupname | stats values(disk_space_used) as Start by lookupname | chart min(Start) by lookupname lookupname min(Start) vm1 3 vm1 should have a minimum of 0 since Jan 1, it was not created yet. ... View more

Hi, Please check whether the below snippet is what you are looking for. index=avb source="blue" |eval Blue_Green="Blue" |stats count as "Service_Call Count" by Service, Call_count ,Blue_Green |append [ search index=avb source="Green" |eval Blue_Green="Green" |stats count as "Service_Call Count" by Service, Call_count,Blue_Green] |fields - Service,Call_count ... View more

The search ID was a typo in my question and I have updated it to remove confusion. Removing the condition tag did improve the reliability but I'm still getting the error some of the time. I'm wondering if there is a problem with long running queries. ... View more