I dunno.  I have somewhat of the same issue.  A search result shows while its searching and will stay if lower than a certain number of days but then disapears when the search completes over a number of days that is not consistant.  So seems related to the length of time of the search.  My search has no dedup in it. ... View more

Hi @michaeler, this solution permits to bypass retentio issue, obviously it cannot solve access limitations for your role. Ciao. Giuseppe ... View more

The options available in the built-in visualizations are listed in the Dashboard and Visualizations Manual (https://docs.splunk.com/Documentation/Splunk/9.0.5/Viz/ChartConfigurationReference) .  Add-on visualizations should have their own documentation. ... View more

Hi a good tool to create a regex is regex101.com. You could create regex here and see immediately how it works. If there is something which you cannot solve by yourself, you could save it and share that link to another people to help you. https://regex101.com/r/H9vuAk/1 here is your sample and how it was handled with PCRE2 engine. As you see it match more than splunk rex as default max_match=1. In splunk this is working as normally rex match only first one. But time by time you need to use max_match=0 and then it didn't work. But if you add ^ into first character then it work and actually it's little bit efficient than without it (https://regex101.com/r/fD0J9e/1).  r. Ismo ... View more

Try using starttime and endtime with strings as values. index=main sourcetype=mysourcetype | eval start=$dd_earliest$ | eval end=start+86399 | eval earliest="\"".strftime(start, "%m/%d/%Y:%H:%M:%S")."\"", latest="\".strftime(end, "%m/%d/%Y:%H:%M:%S")."\"" | search Domain=$selected_domain$ starttime=earliest endtime=latest | rest of search.....   ... View more

I was certain I tried this already and received an error about redefining 'depends' but I tried it again anyways it it worked!  I'm glad the answer is simple and easy to implement but disappointed I didn't try this already... ... View more

Hi @michaeler, it isn't so easy, but if you install the timeline app (https://splunkbase.splunk.com/app/3120) and you follow the instructions and samples, you can have what you're serching. Ciao. Giuseppe ... View more

Follow up question: Can I use modal popups in the way I'm requesting or would I need to either covert the dashboard to HTML or use the separate javascript file? ... View more

I can't share the results because it's on a different system but here is part of the search: index=meetings ... ..... | rex field=field1 ".*\((?P<Date>\d[^\)]+)" | eval current = strftime(now(), "%d %b") | where Date=current | rex field=field2 "(?<Details>.*)\((?<Ztime>.*)\)" | rex field=Ztime "(?<sT>\d{4})" | rex field=Ztime "\d{4}\s?[-]\s?(?<eT>\d{4}[Z])" | eval Date=Date." ".date_year, startTime=Date." ".sT."Z", endTime=Date." ".eT | eval start=strftime(strptime(startTime, "%d %b %Y %H%MZ"), "%d %b %Y %H:%M %Z"), end==strftime(strptime(endTime, "%d %b %Y %H%MZ"), "%d %b %Y %H:%M %Z") | table Details start end field1 Results example: Details                start                                              end                                                  issue Meeting 1         16 Mar 2023 12:00 EDT       16 Mar 2023 13:30 EDT          Meeting (16 Mar) * K Meet            16 Mar 2023 10:00 EDT       16 Mar 2023 12:00 EDT          Meeting (16 Mar) When I put it into an Enhanced Timeline it looks as expected and works correctly, I just want to highlight the * meetings or make them standout somehow ... View more

I came across this post during my searches for Roxio/WinZip SecureBurn event codes. From my research I have found that this is what each event code means, based off the additional text contained in the Windows Event log: 1001: Blank disk inserted 1003: Writing event started (can correlate with Windows System logs, EVID 133, look for 'cdrom' in the log) 1004: Disk burned, finalized. Key terms from data fields to look for are "Finalized,Closed session" I have not been able to consistently replicate event 1001 at the beginning and end of the event, but I can consistently replicate event 1003 and 1004, so I've decided to focus on those. Hope that helps someone!   ... View more

Looks like a bug - try like this: | eval Node_ID=if(like(issue, "WC SVR%"), "WC SVR", Node_ID) | eval Node_ID=if(like(issue, "EU SVR%"), "EU SVR", Node_ID) | eval Node_ID=if(like(issue, "SE SVR%"), "SE SVR", Node_ID) | eval Node_ID=if(like(issue, "NE SVR%"), "NE SVR", Node_ID) | where Node_ID=="WC SVR" or this | eval Node_ID=case(like(issue, "WC SVR%"), "WC SVR", like(issue, "EU SVR%"), "EU SVR", like(issue, "SE SVR%"), "SE SVR", like(issue, "NE SVR%"), "NE SVR") | search Node_ID="WC SVR" ... View more

Sorry, I forgot the Z, try this | rex field=issue ".+(?<time>\d{4})Z\s(?<date>\d{2}\s[A-Z][a-z]{2})" | eval Issue_Began=strptime(time." ".date." ".date_year,"%H%M %d %b %Y") ... View more

Thanx good to remember! ... View more

You can do that using CSS and HTML.  See "Custom Decorations" in the Splunk Dashboard Examples app. ... View more

Unless the "rule" you want is based on a regex, which given the DW->DWnet requirement, it seems unlikely, then as you have found, an eval to create the desired domain name is simplest, but you can use a case statement | eval domain=case(domain="DW", "DWnet", domain="WIC/UPnet", "WIC, UPnet", domain="WIC/DWnet", "WIC, DWnet" true(), domain) or if you have a lot of these, then a different solution is to create a lookup with all the possible variants and the form you want to see in the form domain_in, domain_out DW,DWnet WIC/UPnet,"WIC, UPnet" WIC/DWnet,"WIC, DWnet"  and then in the SPL do | lookup my_lookup domain_in as domain OUTPUT domain_out | eval domain=coalesce(domain_out, domain) which means you only have to put the different variants in the lookup, as the coalesce will then take the found form in the lookup (domain_out) and use that if present. Note that if using a CSV, make sure you use quotes for the values that have commas in them  ... View more

You have probably already worked out that you had not included the "*" after the "\s" for both days and hours. ... View more

Hi it's just like @somesoni2 said. It depends based on your needs. Personally I like to keep those as long as possible online to check what has happened when there are some errors or weird behaviour. Of course you must think about risk if you haven't those in your hands when/If needed. Probably this is not so big issue.  One option is to archive those thawed files e.g. to tapes and if needed then retrieve those if needed. Probably biggest use for those are getting better understanding what has happened on splunk environment based on statistics. Of course you could get most of this with summary indexes etc. Which leads that no need to keep those actual files on your hands. One conf presentation which could help you to figure out how you should proceed https://conf.splunk.com/files/2021/slides/PLA1410C.pdf From Noob to Ninja: Growing and Managing Splunk Enterprise as a Team of One  PLA1410C Dan Burras r. Ismo ... View more

I forgot to add the final " at the end of each. regex101.com doesn't like them so I removed for the purpose of troubleshooting. ... View more