I have a query which is a lookup and I have assigned the out to "Report" as I want to send the entirety of the report via teams but im struggling to send it as a table its just the entire and its not readable. here's the output in teams and this is my query  index="acoe_bot_events" unique_id = * |lookup "LU_ACOE_RDA_Tracker" ID AS unique_id |search Business_Area_Level_2="Client Solutions Insurance" , Category="*", Business_Unit = "*", Analyst_Responsible = "*", Process_Name = "*" |eval STP=(passed/heartbeat)*100 |eval Hours=(passed*Standard_Working_Time)/60 |eval FTE=(Hours/127.5) |eval Benefit=(passed*Standard_Working_Time*Benefit_Per_Minute) |stats sum(heartbeat) as Volumes sum(passed) as Successful avg(STP) as Average_STP,sum(FTE) as FTE_Saved, sum(Hours) as Hours_Saved, sum(Benefit) as Rand_Benefit by Process_Name, Business_Unit, Analyst_Responsible |foreach * [eval FTE_Saved=round('FTE_Saved',3)] |foreach * [eval Hours_Saved=round('Hours_Saved',3)] |foreach * [eval Rand_Benefit=round('Rand_Benefit',2)] |foreach * [eval Average_STP=round('Average_STP',2)] | eval row = Process_Name . "|" . Analyst_Responsible . "|" . Business_Unit . "|" . Volumes . "|" . Successful . "|" . Average_STP | stats values(row) AS report | eval report = mvjoin(report, " ") ... View more

index="intau" host="server1" sourcetype="services_status.out.log" service="HTTP/1.1" status=* | chart count by status | eventstats sum(count) as total | eval percent=100*count/total | eval percent=round(percent,2) | eval SLO =if( status="200","99,9%","0,1%") | where NOT (date_wday=="saturday" AND date_hour >= 8 AND date_hour < 11) | fields - total count   I have the above Query and the above result , how can i combine 502 and 200 results to show our availability excluding maintenance time of 8pm to 10pm every Saturday, how can i make it look like the drawing I produced there ... View more

I'm sure someone here has worked on a powershell script to install splunk to different windows hosts remotely. Can I get help with that? my powershell skills are really weak. ... View more

My regular expression has been working fine.. but now theres data with "[]" and it is being skipped   here is the regex  | rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)" | search Log_level="ERROR" this log entry is being skipped 13:42:21 [gaming-run-9999999-hit-99999991-step-6129] [[FALSE] Gaming Cans Gaming Redesigned API v.2.6.3] [Consolidated Card Refund Business Process  (Gaminggaming)] [] GameTask [ERROR] Do I need to update my reg expression?   ... View more

I have the below SPL with the regex, which i was using as a horse shoe visualization, but im trying to convert it to a stacked bar graph with the log level per process log level should have different colours for the different log levels red-ERROR, green for info blue for debuf etc.. should be trellis visual.. index="intau_workfusion" sourcetype=workfusion.out.log host=* | rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)" | search Log_level="ERROR" | where Process != "" | eval hour=strftime(_time,"%H") | where hour >= 5 AND hour < 18 | eval day=strftime(_time,"%w") | where day >= 1 AND day <= 5 | bin _time span=1d | stats count AS ERRORS by Process | sort - count asc ... View more

Good day everyone, I have the below dashboard in my splunk, I have an automation set for it using html but it doesnt look like this, is it possible to get the screenshot as it is and automate it to a teams chat or via email every morning.   ... View more

I have current search  index="intau_workfusion" host=* sourcetype="services_status.out.log" service="HTTP/1.1" status=* | chart count by status   when I run it and save as pie chart I am able to get the percentage of the different status code status's, but I want it in table format and I cant divide by total when doing my eval status as all the other status codes still fall under "status" how can I solve this? ... View more

i have below result, how can I do a regex to extract the fields, first being DateTime, username, Action, Entity 2022-11-21 15:44:13,ea186520,CREATED,USERSESSIONLOG ... View more

| rex "^(?\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?[^\]]*)\]\s*\[(?[^\]]*)\]\s*\[(?[^\]]*)\]\s*[^\[]+\s\[(?[^\]]+)" | search Log_level="ERROR" | where Process != "" | stats count AS ERRORS by Process | sort - count asc     i have above query to help get ERROR count of our processes, but I want to get the daily average of the number of errors generated by each process between a certain time interval.. lets say from 6am to 6pm from monday to friday, How can I achieve this ... View more

2022-05-08 19:55:05 [machine-run-433303-hit-7496951-step-5389] [ATMX Logs Request/Extraction/Attach 2.5.2] [Business Process-Fraud Logs Card v2.5.2 (ATMXLogAttach)] [C806968] MachineTask [ERROR] UnsupportedCommandException: unknown command: Cannot call non W3C standard command while in W3C mode 2022-05-08 19:55:03 [machine-run-333503-hit-7496951-step-5389] [ATMX Logs Request/Extraction/Attach 2.5.2] [Business Process-Fraud Logs Card v2.5.2 (ATMXLogAttach)] [C806968] UiRobotCapabilities [ERROR] JavascriptException: javascript error: Unexpected identifier (Session info: chrome=94.0.4606.71) 2022-05-08 19:35:37 [machine-run-43333-hit-7496952-step-5389] [ATMX Logs Request/Extraction/Attach 2.5.2] [Business Process-Fraud Logs Card v2.5.2 (ATMXLogAttach)] [C806966] MachineTask [ERROR] TimeoutException: Expected condition failed: waiting for element to be clickable: [unknown locator] (tried for 60 second(s) with 500 MILLISECONDS interval) I have above extract from our logs I would like to write a regex to get the text in red  as "ErrorType" ... View more

Is it possible to send screenshot of my table to a microsoft teams channel? and how? ... View more

I have this table and I'm trying to send it as a report/alert every morning to our teams chat group   This is how it's getting sent out, its only showing the first result of every row heres the Query  | webping http://CTXSDC1CVDI041.za.sbicdirectory.com:4444/grid/console | append [ webping http://CTXSDC1CVDI042.za.sbicdirectory.com:4444/grid/console ] | append [ webping http://CTXSDC1CVDI043.za.sbicdirectory.com:4444/grid/console ] | append [ webping http://CTXSDC1CVDI044.za.sbicdirectory.com:4444/grid/console ] | append [ webping http://CTXSDC1CVDI045.za.sbicdirectory.com:4444/grid/console ] | append [ webping http://CTXSDC1CVDI046.za.sbicdirectory.com:4444/grid/console ] | append [ webping http://CTXSDC1CVDI047.za.sbicdirectory.com:4444/grid/console ] | append [ webping http://CTXSDC1CVDI048.za.sbicdirectory.com:4444/grid/console ]| append [ webping http://ctxsdc1cvdi013.za.sbicdirectory.com:4444/grid/console ] | append [ webping http://CTXSDC1CVDI049.za.sbicdirectory.com:4444/grid/console ]| append [ webping http://CTXSDC1CVDI050.za.sbicdirectory.com:4444/grid/console ] | eval timed_out = case(timed_out=="False", "Machine On", timed_out=="True", "Machine Off") | eval response_code=if(response_code==200, "Hub and Node Up", "Hub and Node Down") | rex field=url "http:\/\/(?<host_name>[^:\/]+)" | table host_name response_code timed_out total_time   ... View more