Hey Team I have events which contains a field "job_code".  index=default source=jobfeed  I have a lookup (jobs.csv) which has the list of allowed job codes.  jobCode jobDesc 000 EX 001 PT   My requirement is to generate an alert every day,  If any of the jobCode available in lookup didn't show up at all on the events for past 2 days. For instance,  for past 2 days if splunk didn't receive event with job_code as 000 , then i need an alert. I need this check for all the jobCode in the lookup table. Can you please help me with a query for this? Thank you ... View more

My events are as below:  Mon Nov 23 09:21:57 2020 6 10.0.0.3 3783 /root/A/P2/source1/POL.IDM b s i r kumar ssh 0 * Mon Nov 23 09:21:58 2020 5 10.0.0.4 3783 /root/A/P2/.stfs/objects/8a/32bcb75c884c00175c989636000ba/b14fbda4-6857-4910-9a74-9789b6165b7f/52925c56-3ae2-4f75-bb3a-97622e9223b0/8a332bcb75c884c00175c989751500c3/POL.IDM b n o r kumar ssh 0 * Mon Nov 23 09:15:25 2020 7 10.0.0.2 68 /root/A/P1/.stfs/objects/8a/325cc74705abd017472f907ce0155/12763075-66b1-4a1b-b080-0c5d0a5a0c11/d8c5486a-57ab-4798-a8cc-2bf45f3b975b/8a3325cc74705abd017472f9bbc701c7/WEB.dat a s o p ftp 0 * If i extract the fields i need the below.: event1 field values in RED, event 2 field values in PINK, event 3 field values in BLUE current_time=Mon Nov 23 09:21:57 2020, Mon Nov 23 09:21:58 2020, Mon Nov 23 09:15:25 2020 transfer_time=6, 5, 7 remote_host=10.0.0.3, 10.0.0.4, 10.0.0.2 file_size=3783, 3783, 68 file_path= /root/A/P2/source1/POL.IDM, /root/A/P2/.stfs/objects/8a/32bcb75c884c00175c989636000ba/b14fbda4-6857-4910-9a74-9789b6165b7f/52925c56-3ae2-4f75-bb3a-97622e9223b0/8a332bcb75c884c00175c989751500c3/POL.IDM, /root/A/P1/.stfs/objects/8a/325cc74705abd017472f907ce0155/12763075-66b1-4a1b-b080-0c5d0a5a0c11/d8c5486a-57ab-4798-a8cc-2bf45f3b975b/8a3325cc74705abd017472f9bbc701c7/WEB.dat ->        Few extracts on this field file_path with / as delimiter: --> This i don't know how to handle                 3rd index extracted as account=P2, P2, P3                  last index extracted as file_name= POL.IDM, POL.IDM, WEB.dat                  last but one index (if start with starts with 8a) extracted as route_id = <null, empty>, <null, empty>, 8a3325cc74705abd017472f9bbc701c7 transfer_mode=b, b, a transfer_security=s, n, s transfer_status=i, o, o access_mode=r, r, p user_name=kumar, kumar, <null,empty> --> This i don't know how to handle protocol=ssh, ssh, ftp Can you please help on Field extractions /Search query for this? Thank you ... View more

Hi Team: Here on the Extraction for Event 2, the MESSAGE field is extracted as empty as its not multiline. How should i extract MESSAGE for both multiline and single line.? Query: index=abcd sourcetype=fallback | rex field=_raw "^(?P<DATETIME>[^,]+),\d+\s+\[(?P<DAEMON>[^\]]+)\]\s+(?P<SEV>[^ ]+)\s+(?P<CLASS>[^ ]+)\s+\-\s+(?P<MESSAGE>(.*[\r\n]+)*)" | table DATETIME, DAEMON, SEV, CLASS, MESSAGE Event 1: 2020-12-07 17:43:02,075 [ABCD_Daemon1] WARN ABCD_CLASS1 - Failed to process java.lang.InterruptedException at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.reportInterruptAfterWait(AbstractQueuedSynchronizer.java:2014) at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.await(AbstractQueuedSynchronizer.java:2048) at java.util.concurrent.ArrayBlockingQueue.take(ArrayBlockingQueue.java:403) at db.$EmailNotifierDaemon.run(asdasd.java:1133) Extracted as: DATETIME : 2020-12-07 17:43:02 DAEMON: ABCD_Daemon1 SEV: WARN CLASS: ABCD_CLASS1 MESSAGE: Failed to process java.lang.InterruptedException at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.reportInterruptAfterWait(AbstractQueuedSynchronizer.java:2014) at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.await(AbstractQueuedSynchronizer.java:2048) at java.util.concurrent.ArrayBlockingQueue.take(ArrayBlockingQueue.java:403) at db.$EmailNotifierDaemon.run(asdasd.java:1133) Event 2: 2020-12-07 16:12:14,273 [ABCD_Daemon2] INFO ABCD_CLASS2 - Got notification for external configuration change, cleaning caches. Extracted as: DATETIME : 2020-12-07 16:12:14 DAEMON: ABCD_Daemon2 SEV: INFO CLASS: ABCD_CLASS2 MESSAGE: Thank you ... View more

lookup_file.csv has the data as below dId,count,perc Usecase : User to select dropdown based on lookup dId field. Once select, I want to populate count and perc for that dId selected as a html text. So that user known the count and perc for the dropdown selected dId       <panel> <input type="dropdown" token="lookup_Id" searchWhenChanged="true"> <label>Select ID</label> <fieldForLabel>id</fieldForLabel> <fieldForValue>dId</fieldForValue> <search> <query>| inputlookup lookup_file.csv</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <prefix>"</prefix> <suffix>"</suffix> <change> <condition value="$lookup_Id$"> <set token="count"><query>|inputlookup lookup_file.csv | where dId="$lookup_Id$" | table count</query></set> <set token="perc"><query>|inputlookup lookup_file.csv | where dId="$lookup_Id$" | table perc</query></set> </condition> </change> </input> <html> <i>$lookup_Id$: Count is $count$, Percentage is $perc$</i> </html> </panel>         Currenlty i get "001": Count is |inputlookup lookup_file.csv | where dId="$lookup_Id$" | table count, Percentage is |inputlookup lookup_file.csv | where dId="$lookup_Id$" | table perc Meaning the dId is populated correctly, but other 2 tokens under change/condition is not not evaluating rather printed as-is query string. Please help me on this. ... View more

I am new to splunk.  I have a need to get the visualization which shows the field of the corresponding stats value.  Data looks like  I want show.: stat_date and min(Size), stat_date and max(Size)  stat_date and min(Files), stat_date and max(Files) Below query gets me the stats value, but i don't know how to get the corresponding stat_date for each of this.   | stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date | stats min(Size) as min_size max(Size) as max_size min(Files) as min_file max(Files) as max_file   Thank you ... View more