I want to create a drilldown that searches for the timezone displayed by the Timechart command. How should I create the time range specification for the drilldown setting item? ... View more

I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard. Is there a good idea? The time picker is also used in another panel, so it is in response to the request that I didn't want to place multiple time pickers. === This SPL did not pass. === index = _internal earliest = $ field1.earliest $ --600 latest = $ field1.earliest $ + 600 ... View more

I want to find the difference between the maximum value and the minimum value in the multi-value field that has been lumped together with the transaction command. Specifically, group the web access logs by ID, and then I would like to find the time that the ID was operating from login to operation to logout. Do you have an idea for SPL? ... View more

Is there an SPL idea that allows you to specify multiple conditions with "OR" and assign a control number to the search results for each condition? =====SPL===== index=xxxx sourcetype=yyyy (ip=10.1.1.10 url=google.com earlest=1642899600 latest=1642900200 ) OR (ip=10.1.1.20 url=facebook.com earlest=1642849200 latest=1642849800 ) OR (ip= ・・・・ =====The expected search results===== NO,ip,url,_time 1,10.1.1.10,google.com/xxx,2022-01-23 10:04:30 2,10.1.1.20,facecook.com/xxxxx,2022-01-22 20:01:00 2,10.1.1.20,facecook.com/xxxxx,2022-01-22 20:01:30 3,・・・・ ... View more

Dear ALL, Is it possible to display a "yes" or "no" pop-up window before performing a search from the dashboard drilldown? To prevent operational mistakes, I would like to stop opening the search SPL if there is a problem. ... View more

Dear ALL, I want to insert a value into a subsearch using the search result as a variable. Do the following search to get your own username Is there a way to search again with my username? ========================================= | rest / services / authentication / current-context | table realname ========================================= rlaname ------------------------------------------ M_sugiyama                               ← Use this value as a variable ========================================= index=AD "M_sugiyama"      ← I want to search by assigning variables to the next subsearch ========================================= Do you have a good idea? ... View more

I was asked if IOC information from Splunk Enterprise Security could be used as a dataset. For example, is it possible to use it as follows? ・ Call SplunkES IOC information with SPL and display a list ・ Detect SplunkES IOC information by comparing it with IPs or domains included in various logs. And,What kind of IOC information does SplunkES have (IP address, UserAgent, domain information, etc.)? Can you tell me if there is a description somewhere? Thank you. ... View more

APIから送られるjsonファイルで24時間・毎分のデータを取得し、 データの取り込みでデフォルトのソースタイプ：_jsonを指定しました。 任意の形でテーブルを作成することができましたが、 一つのフィールドに表示されるデータは42行分しかありませんでした。 （24hｘ60min=1440count） 上限値を修正し、1440行分を完全に表示することは可能でしょうか？ ... View more

下記のように、ファイル名から日を取り出し、timechartコマンドなどで集計したいです。 source="C:\\weekly2020-08-*.csv" | eval week=replace(substr(source,9,10),"-","/") | table week,_raw サーチ結果 week,_raw 2020/08/14, xxxxx 2020/08/14, xxxxx 2020/08/21, xxxxx 2020/08/28, xxxxx   ソースデータの前処理なしで、サーチで作成したweekを_time代わりにできればと思うのですが・・・ ... View more