Dear Community Members , In splunk cloud instance : I am trying to get VPN login and logout for users in a single table sorted by Username and Time. The query is as below: eventtype="my_eventtype_1" eventtype="my_eventtype_2" (((EventIDValue=gateway-auth OR EventIDValue=clientlessvpn-login) EventStatus=success SourceUserName!="pre-logon") OR Stage=logout) | stats list(EventIDValue) as Activity,list(_time) as Time by SourceUserName |rename SourceUserName as username|convert ctime(Time)|eval username=upper(username)|sort username,-Time The search is for a period of 24 hours. I am getting the data but along with it, I see junk characters (if I may call them so). Kindly help to understand how to resolve the same. I also tried adding limit=0 along with stats command but no use. Below is the screenshot of the fields. I have not shown the username field for security reasons. I have used a similar query for another VPN and it works fine there and I don't see these characters ! Regards, Abhishek Singh ... View more

Dear All, My question might seem naive and pardon me for that. I want to create an alert for data not being processed. The below was my query. An alert would be triggered, if the number of event are greater than 5000 or if the number of events are greater than 1000 and the change in events are more than 1000 between 2 hours. Used delta to get the difference. I am able to give the conditions and I am able to alert as well.  However, I wanted to check if we could extract a specific column from a specific row and column number and create another table. For example, please look at below table. I want to create a new table with number of event at 15:00:00 , number of event at 14:00:00 ,  Change in number of events.   Kindly let me know how to achieve the same. ... View more

Hi Team, I wanted to ask if it is possible to create one pdf file from two dashboards using one rest API call or multiple API calls. I tried individually and they work as below: curl -u user:password -k https://localhost:8089/services/pdfgen/render?input-dashboard=health_overview >> test1.pdf       (test1.pdf was created successfully) curl -u user:password -k https://localhost:8089/services/pdfgen/render?input-dashboard=sales_dashboard >> test2.pdf         (test2.pdf was created successfully) Now, I have tried the below but none of them seems to work. I am certainly doing something terribly wrong.  curl -u user:password -k https://localhost:8089/services/pdfgen/render?input-dashboard=health_overview >> test3.pdf curl -u user:password -k https://localhost:8089/services/pdfgen/render?input-dashboard=sales_dashboard >> test3.pdf (The result is that only sales_dashboard data is available and over writes health_overview) Then tried this : curl -u user:password -k https://localhost:8089/services/pdfgen/render -d input-dashboard=health_overview -d input-dashboard=sales_dashboard_clone_1 >> okdokey.pdf (The second paramerter(sales_dashboard) overwrites the first written pdf)   Then I tried this: curl -u user:password -k https://localhost:8089/services/pdfgen/render?input-dashboard=sales_dashboard_clone_1?input-dashboard=health_overview >> testClone2.pdf (And Of course, this was a terrible stupidity and didn't work as expected and threw error. ) I don't want to use any python external module (like pyPDF and pdfwriter) to combine the PDFs. Any help/workaround would be appreciated. Any out of the box technique would be highly appreciated. Thanks In Advance! Regards, Abhishek Singh ... View more

Hello Team, This is for Splunk Cloud Version 7.2 . I have a dashboard and by default it runs for a time range of last 24 hours. Time picker is also available on the dashboard (for the visualizations and reports). I need to generate a PDF and schedule it's delivery to a list of users every 3 months. The issue is that I want the time range for this dashboard to be for a period of 3 months instead of last 24 hours before publishing the PDF. Is it possible to achieve the same or do I need to create separate a dashboard for a period of 3 months to achieve the same? I tried looking up for answers over the community but I was unable to find the one which could answer my query. Any help/suggestion would be greatly appreciated.  Thanks !  ... View more