Hi, I have a bar graph which is not showing full y-axis value when the value have more words. Is there a way we can force dashboard to display full value   Example: Instead of "Monthly Patch Update" it is displaying as "Month...pdate" ... View more

Hi, I have below search, i have clubbed 3 searches into 1. Each individual search is working fine but when i clubbed its not able to pull data from previous year and the table shows empty values fore few months   index=dev AND "alpha" | dedup _time| eval Month=strftime(_time,"%m %b %Y")|stats count by Month| rename count as alpha | appendcols [search index=DEV AND "[beta]" | dedup _time|eval Month=strftime(_time,"%m %b %Y")|stats count by Month| rename count as beta] | appendcols [search index=dev AND "gamma" | dedup _time| eval Month=strftime(_time,"%m %b %Y")|stats count by Month| rename count as gamma]   ... View more

Hi, I have 2 searches where the dedup strategy is different, i want to combine the 2 searches but need help with dedup strategy.  Search 1: index=prod sourcetype=error AND "IOS" | dedup notification, source  Search 2: index=prod sourcetype=error AND "Android" | dedup _time -> For "IOS" i need to dedup with only notification, source  and for "Android" i need to dedup only with _time index=prod sourcetype=error AND ("IOS" OR "Android") | dedup ?????   ... View more

My Query:  index=test sourcetype=true AND private AND beta |rex field=_raw "\[private]\s(?<category>\S+\s+\S+\s+\S+)" |dedup category, source|eval category=upper(category)| stats count by category |rename count as count1| appendcols [search index=test sourcetype=true AND private AND alpha |rex field=_raw "\[private]\s(?<category>\S+\s+\S+\s+\S+)" |dedup category, source|eval category=upper(category)| stats count by category |rename count as count2]| eval Total=(count1-count2) So when the 2nd query doesn't have any events i am not getting the Total column Current output if the 2nd search doesn't have any events: category      count1       xxxx                  5   Desired output: category      count1         count2     Total xxxx                  5                    0                  5 ... View more

Hi, I have below log file, I would like to build a table out of it (Line1, Line2,Line3,Line4 are just for understanding) Line1: 2022-05-22 02:02:20 PM UTC False [Android] Password Expiration Notice Line2: 2022-05-22 06:05:49 PM UTC True [Home] [Android] Password Expiration Notice Line3: 2022-05-29 04:24:52 AM UTC False [Android] High Memory usage Google Line4: 2022-05-29 06:05:49 PM UTC True [Android] Password Expiration Notice Desired Table: Issue                                                             True      False Password Expiration Notice                     2          0 High Memory usage Google                     0           1   Caluclating False: Line1-Line2 i.e. i need to Subtract count of events with "True [Home]" from "False" Caluclation True: Number of events with "True" ... View more

Hi, I need help to extract the 3 words after [yyy] using regex,  True [xxx] [yyy] Issue with ios phone 11 False [yyy] Issue with android phone True [yyy] Issue with windows phone     ... View more

Hi, I have my current search giving below output, I want to have stats listed by Month. Can someone help on this one Current Search:  my search |  eval True=(total1-total2) | eval False=round(False/(True+False)*100,2) | table False Output:        False                         42.12   Desired Output:  Month      False August    42.12 July           xx.xx june           xx.xx . . . ... View more

Hi, My search is giving below output, Month  FieldA    FieldB Jan         285      1410 Feb         247      1934 Mar         215      2197 Can we create a new column with FieldA% and FieldB%, below is the example Month  FieldA    FieldB   FieldA% FieldB% Jan         285      1410        20%           80%       Feb         247      1934         22%          78% Mar         215      2197         15%           85% Eventually i will only be using Month and FieldA% in a column chart ... View more

Hi, So i am trying to index the log file data.log, log file is 2 days old and splunk is indexing only the latest events. Is there a way i can index the older events in data.log ? ... View more

Hi, I have configured my windows forwarder to use the custom CA and Server certificate. Below is the configuration and the forwarder is able to connect to indexer fine. File: C:\Program Files\SplunkUniversalForwarder\etc\system\local\outputs.conf [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = XXX:9998 clientCert = C:\Program Files\SplunkUniversalForwarder\etc\auth\mycerts\testCertificate.pem sslPassword = XXX useClientSSLCompression = true sslRootCAPath = C:\Program Files\SplunkUniversalForwarder\etc\auth\mycerts\myCAcertificate.pem [tcpout-server://XXX:9998] But still in the splunkd.log file i am seeing below message, X509Verify [14596 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates   Any idea if I am missing any configs here? ... View more

Hi, I have the below log entry, can you help with the regex to extract the line in Red. The regex i have is not working properly in props.conf   2021-09-23 19:03:40.802 INFO 1 --- [sdgfsdgsdfgsdfg] asdfasdfasdfasfasfgfdhdfhdf : Response --> { "claimId" : asfdasdfadf, "claimFilerId" : "sadfasdf", "vendorName" : "asfasfadfadf. ", "vendorId" : "aefadf", "vendorAddressId" : "asfafsd", "vendorAddress" : "sdfgsdgsfg", "preparedDate" : "09-22-2021", "receivedDate" : "09-22-2021", "enteredDate" : "09-22-2021", "assignedTo" : { "employeeId" : "sdfasdf ", "firstName" : "asfasf", "lastName" : "zsdfdf", "adUserIdentifier" : "zsdfvzdv" }, "correspondence" : { "type" : { "code" : 5947, "shortName" : "EOB", "longName" : "EOB" }, "dispatchCode" : { "code" : 5947, "shortName" : "NtRqd", "longName" : "Not Required" }, "emailAddress" : "abcd@g.com,       dgfh@a.in" } ... View more

Hi, I have the below source, values in Red will keep changing source="/Application/logs/b80be40606aa7860f7de0c7ffa6b9d740581ec6035bc450ff5dfa3/apply-service/example.google.local:9818/Application-services/applyy-service:build-000/apply-service-464-xmp/system-out-dev.stdout"   in props.conf i tried below definitions but it is unable to pickup, how can i use wild cards to pick the correct source? 1) [source::/Application*] TRANSFORMS-anonymize = address-anonymizer 2) [source::/Application/logs/*/apply-service/*/Application-services/*/*/system-out-dev.stdout] TRANSFORMS-anonymize = address-anonymizer     ... View more