Hi, Thanks a lot for your help, it really helped. Regards, AKM ... View more

The name of splunk slack channel has changed, but you can access it with URL given by @ITWhisperer's. I suppose that you could was reactivation for your current account by http://splk.it/slack. There haven't been many people to manage those requests, so you must prepare to wait some time. ... View more

There is most probably a better way to achieve your goal. Try to describe the logic behind what you're trying to do. Anyway,  | dedup A | table A is usually _not_ the way to go. You'd rather want to do | stats values(A) as A | mvexpand A   ... View more

@livehybrid  "makecontinuous" - This is exactly what I need! I didn't know there is such useful command. My question is solved. Thank you! ... View more

If all these things were documented, there wouldn't be a need for Answers, Splunk Trust and .conf! 🤣 ... View more

Change the init block (solution updated) <init> <set token="rangeColors">"0x118832","0xd41f1f"</set> </init>   ... View more

Still not sure what you are expecting from this forum. ... View more

As @bowesmana diagnoses, default field extraction stops at 50K.  You can change this in limits.conf.  The stanza is [kv], property name is maxchars. I recommend that you fix another problem @livehybrid hinted at: You should extract id field from message field, not from _raw, i.e., | rex field=message "(SENDER|RECEIVER)\[(?<id>\d+)\]"   ... View more

Hi @RSS_STT  The predict command can take a number of fields, such as in this example below, allowing you to run the predict against all your drives. | makeresults count=5 | streamstats count | eval instance = case(count%3==1, "C:", count%3==2, "D:", true(), "E:") | eval Value = case(instance=="C:", 90 - count*5, instance=="D:", 80 - count*4, instance=="E:", 70 - count*3) | append [| makeresults count=5 | eval _time = relative_time(now(), "-1h") | streamstats count | eval instance = case(count%3==1, "C:", count%3==2, "D:", true(), "E:") | eval Value = case(instance=="C:", 880 - count*5, instance=="D:", 82 - count*4, instance=="E:", 70 - count*3)] | fields _time, instance, Value | timechart min(Value) as "FreeSpace" by instance | fillnull "C:" "D:" "E:" | predict "C:" "D:" "E:" algorithm=LLP5 future_timespan=180   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Ah @PickleRick yes spot on. Sorry hadnt seen your reply but seems like we are thinking along the same lines! ... View more

Then, where does the dashboard get those strings? In other words, what is the code in that dashboard that prints those strings? ... View more

I don't understand your objections vs. methods 1 and 2. Complexity of the json structure shouldn't matter as long as the event is a valid json and - in case 2 - doesn't exceed maximum number of fields handled by auto-kv. ... View more

Love the code but  it seemed to only do one value in the lookup. What if that event (comparing host in table to event) has 2 fields that don't have null values that need compared to the 2 in the lookup table.  Like in your example they all had the same columns, 3 fields were in the table and the event had 4 different fields. But I have something to start playing with. I will continue to play with this while onboarding other stuff. Look forward to hearing from you again. ... View more

Apart from what's already beem said, you're using the case() function where a simple if() would suffice. case() is good when you want to handle separate disjoint cases and still it's good to have a fallback case at the end. Since the conditions in case() are evaluated left to right and the first matching case is used, typical use for case is something like that: | eval field=(conditions1, value1, conditions2, value2,... , always_true, fallback_value) Per convention the always_true condition is usually 1=1 (this one is indeed always true). Without that fallback condition you might end up with the field not filled with any value if no conditions match your data. What's important with case() is that the conditions are evaluated from left to right so it can be used to narrow the scope of comparisons if used correctly. For example | eval result=case(x<0,"negative x", y>0, "non-negative x, positive y", 1=1, "non-negative x, non-positive y") As you can see, subsequent conditions do not reference x field at all because the first comparison already handled all negative x-es and there is no chance we'd get to those cases with negative x. But circling back to your search - unless you can have another value not handled by the case() (which you then should add to the conditions), it's sufficient to use a simple if() function. It might be a tiny bit faster since it only handles one simple boolean test and assigns the value based on whether the result is true or false. And you're guaranteed to have a value as a result because the condition can only evaluate to true or false. Whether this value is the correct one is a completely different story 😉 ... View more

@ITWhispererIt wasn't obvious at first glance for me either but if you scroll back "report_to_map_through_indexes" was actually a name of a saved search used in the solution. @PetermannAs you can see in the docs for the map command, it takes either a literal search as an argument or a name of a saved search. In this case @ejwade used the latter option. The map command references a report_to_map_through_indexes report definition of which is shown below in the original solution. ... View more

If you want for value to contain only those two values, you could modify @bowesmana 's solution like so | makeresults | fields - _time | eval value=split("ABC","") | where mvcount(value)=2 | search value=A AND value=C ... View more

I think you have your answer in other posts, but this is a good indication of asking the right question - including the "by day" also is an important point 🙂 ... View more

We have used it in RegexGames although I can't remember how many came up with a solution. Yes, regex may not be "pretty", but can be fun trying to solve regex puzzles! ... View more

Hi @goudas  The discrepancy likely stems from differences in the search execution context between Postman and your JavaScript fetch call, such as the timeframe used for the search job or the app context. When not explicitly defined in the API request, Splunk might use default values that could differ based on user settings or how the API call is authenticated. Ensure you are searching the same earliest and latest time, and that you are using the same app context between your WebUI searches and API searches. Also, check that any backslashes/quotes etc are appropriately handled in your API requests.  To investigate any differences, in the web UI go to Activity (top right) -> Jobs to open the Job Manager and then locate the two searches - check that the search, earliest/latest/app all match. This should hopefully highlight if there is a discrepancy. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

<row> <panel> <input type="link" token="needed"> <label>Show missing hosts from:</label> <choice value="link1">Splunk</choice> <choice value="link2">Tanium</choice> <choice value="link3">Tenable</choice> <choice value="link4">Forescout</choice> <choice value="link5">Fireeye</choice> <choice value="link6">SCCM</choice> <choice value="link7">SentinelOne</choice> <choice value="link8">Multiple Tools (3 or more)</choice> <default>Multiple Tools (3 or more)</default> <change> <condition value="link1"> <set token="show_splunk">true</set> <unset token="show_tanium"></unset> <unset token="show_tenable"></unset> <unset token="show_forescout"></unset> <unset token="show_fireeye"></unset> <unset token="show_sccm"></unset> <unset token="show_sentinelone"></unset> <unset token="show_multiple3"></unset> </condition> <condition value="link2"> <unset token="show_splunk"></unset> <set token="show_tanium"></set> <unset token="show_tenable"></unset> <unset token="show_forescout"></unset> <unset token="show_fireeye"></unset> <unset token="show_sccm"></unset> <unset token="show_sentinelone"></unset> <unset token="show_multiple3"></unset> </condition> <condition value="link3"> <unset token="show_splunk"></unset> <unset token="show_tanium"></unset> <set token="show_tenable"></set> <unset token="show_forescout"></unset> <unset token="show_fireeye"></unset> <unset token="show_sccm"></unset> <unset token="show_sentinelone"></unset> <unset token="show_multiple3"></unset> </condition> <condition value="link4"> <unset token="show_splunk"></unset> <unset token="show_tanium"></unset> <unset token="show_tenable"></unset> <set token="show_forescout"></set> <unset token="show_fireeye"></unset> <unset token="show_sccm"></unset> <unset token="show_sentinelone"></unset> <unset token="show_multiple3"></unset> </condition> <condition value="link5"> <unset token="show_splunk"></unset> <unset token="show_tanium"></unset> <unset token="show_tenable"></unset> <unset token="show_forescout"></unset> <set token="show_fireeye"></set> <unset token="show_sccm"></unset> <unset token="show_sentinelone"></unset> <unset token="show_multiple3"></unset> </condition> <condition value="link6"> <unset token="show_splunk"></unset> <unset token="show_tanium"></unset> <unset token="show_tenable"></unset> <unset token="show_forescout"></unset> <unset token="show_fireeye"></unset> <set token="show_sccm"></set> <unset token="show_sentinelone"></unset> <unset token="show_multiple3"></unset> </condition> <condition value="link7"> <unset token="show_splunk"></unset> <unset token="show_tanium"></unset> <unset token="show_tenable"></unset> <unset token="show_forescout"></unset> <unset token="show_fireeye"></unset> <unset token="show_sccm"></unset> <set token="show_sentinelone"></set> <unset token="show_multiple3"></unset> </condition> <condition value="link8"> <unset token="show_splunk"></unset> <unset token="show_tanium"></unset> <unset token="show_tenable"></unset> <unset token="show_forescout"></unset> <unset token="show_fireeye"></unset> <unset token="show_sccm"></unset> <unset token="show_sentinelone"></unset> <set token="show_multiple3"></set> </condition> </change> </input> <table depends="$show_splunk$"> <title>Splunk Missing Hosts</title> <search base="asset_explorer"> <query>| table hostname Splunk_LastSeen | where Splunk_LastSeen = "X"</query> </search> <option name="drilldown">none</option> </table> <table depends="$show_tanium$"> <title>Tanium Missing Hosts</title> <search base="asset_explorer"> <query>| table hostname Tanium_LastSeen | where Tanium_LastSeen = "X"</query> </search> <option name="drilldown">none</option> </table> <table depends="$show_tenable$"> <title>Tenable Missing Hosts</title> <search base="asset_explorer"> <query>| table hostname Tenable_LastSeen | where Tenable_LastSeen = "X"</query> </search> <option name="drilldown">none</option> </table> <table depends="$show_forescout$"> <title>Forescout Missing Hosts</title> <search base="asset_explorer"> <query>| table hostname Forescout_LastSeen | where Forescout_LastSeen = "X"</query> </search> <option name="drilldown">none</option> </table> <table depends="$show_fireeye$"> <title>Fireeye Missing Hosts</title> <search base="asset_explorer"> <query>| table hostname FireEye_LastSeen | where FireEye_LastSeen = "X"</query> </search> <option name="drilldown">none</option> </table> <table depends="$show_sccm$"> <title>SCCM Missing Hosts</title> <search base="asset_explorer"> <query>| table hostname Sccm_LastSeen | where Sccm_LastSeen = "X"</query> </search> <option name="drilldown">none</option> </table> <table depends="$show_sentinelone$"> <title>SentinelOne Missing Hosts</title> <search base="asset_explorer"> <query>| table hostname SentinelOne_LastSeen | where SentinelOne_LastSeen = "X"</query> </search> <option name="drilldown">none</option> </table> <table depends="$show_multiple3$"> <title>3 Tools or More Missing</title> <search base="asset_explorer"> <query>| where Missing_Tools >= 3 | table hostname Splunk_LastSeen Tanium_LastSeen Tenable_LastSeen Forescout_LastSeen FireEye_LastSeen Sccm_LastSeen Missing_Tools | sort 0 -Missing_Tools +hostname</query> </search> <option name="drilldown">none</option> </table> </panel> </row> Thanks! ... View more

Main problem with this limitation is the lack of feedback about this truncation. Dashboard users will wrongly assume all entries are in the list. ... View more