| eval offset = mvappend("24", "16", "8") | eval segment_rev = mvrange(0, 3) | eval offset = mvappend("24", "16", "8") | eval segment_rev = mvrange(0, 3)         For the above, should the second set have been given a different value for the field?  Additionally, when I run the example, I received: 04-18-2024 13:36:06.590 ERROR EvalCommand [102993 searchOrchestrator] - The 'bit_shift_left' function is unsupported or undefined. I believe the function requires 9.2.0+   ... View more

Take a look at this solution:   https://community.splunk.com/t5/Splunk-Search/Convert-Hexadecimal-IP-v4-addresses-to-decimal/td-p/40938 You could use:  (?<d1>\d{1,3})\.(?<d2>\d{1,3})\.(?<d3>\d{1,3})\.(?<d4>\d{1,3}) for your particular example as the rex conversion. | makeresults count=1 | eval src_ip = "192.168.1.1" | streamstats values(src_ip) as src_ip by _time | rex field=src_ip "(?<d1>\d{1,3})\.(?<d2>\d{1,3})\.(?<d3>\d{1,3})\.(?<d4>\d{1,3})" | eval dec_src_ip = 'd1'*16777216+'d2'*65536+'d3'*256+'d4'+0 There is also an app that provides you a command to do the conversion:   https://splunkbase.splunk.com/app/512   ... View more

Have you considered this article:  https://community.splunk.com/t5/Splunk-Search/How-do-I-find-all-duplicate-events/m-p/9764 ... View more

Sorry, no I did not find a solution, the requirement changed, and we shifted gears. ... View more

Thank you @marnall.  You are the master! ... View more

Yes, I could.  However, this is going to be a report, and for a different timezone. ... View more

Try: | eval dct_domain=case(host.domain==prd, "Production", host.domain==uat, "Pre-Production", host.domain==dev, "Development", true(), "test" )   ... View more

Here is my contribution to this topic, since it now almost 2024. index="wineventlog" source="WinEventLog:Security" (EventCode=4624 AND Logon_Type=2) OR EventCode=4647 Account_Name=* action=success ComputerName=* earliest=-1d@d latest=@d | eval User=if(mvcount(Account_Name)>1, mvindex(Account_Name,1), mvindex(Account_Name, 0)) | eval User=lower(User) | search NOT User IN (*$, system) | transaction User maxevents=2 startswith="EventCode=4624" endswith="EventCode=4647" maxspan=-1 | eval Logontime=if(EventCode="4624",_time,null()) | eval Logofftime=Logontime+duration | eval Duration=round(duration/60/60, 2) | convert ctime(Logontime) as Logontime | convert ctime(Logofftime) as Logofftime | table User ComputerName Logontime Logofftime Duration EventCode Logon_Type | sort user, host, -Duration | rename duration AS "Duration (hours)" For my use case I was looking for interactive sessions or sessions initiated by the user.  The log off event is 4647.  The previous days events are being collected using the earliest and latest settings.   I converted my time to hours with two decimal places.  Lastly, I excluded the system account. Thanks to all those who contributed to the previous solutions they were really helpful. ... View more

I know of one file we have (multifix.js) We use it to modify the behavior of multi-select filters. /************************************************************************************* Multiselect Behavior Modification multifix.js v0.2 Automatically removes 'All' option in multiselect fields when a value is selected and remove individual values when 'All' is re-selected. Any multiselect with an CSS id of multi_1 - multi_15 will function in this way if the script is included or the app's dashboard.js or directly. *************************************************************************************/ require(['splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!'], function (mvc) { $(document).ready(function () { var selection = []; for (var i = 1; i < 16; i++) { multiFixer('multi_' + i); } function multiFixer(fieldId) { var multi = splunkjs.mvc.Components.getInstance(fieldId); if (typeof multi !== 'undefined' && multi !== 'undefined') { multi.on('change', function () { selection = multi.val(); if (selection.length > 1 && ~selection.indexOf('*')) { if (selection.indexOf('*') == 0) { selection.splice(selection.indexOf('*'), 1); multi.val(selection); multi.render(); } else { multi.val('*'); multi.render(); } } }); } } }); });   ... View more

It happens for all users. ... View more

@ITWhisperer thank you.  I was way overthinking this.  Much appreicated! ... View more

@richgalloway - thank you.  I think I have been staring at this screen too long.... ... View more

I changed my prost processing search to: | eval urgency = if(urgency=="-", "unknown", 'urgency') | stats count(eval(urgency="1 - High")) as "1 - High" count(eval(urgency="2 - Medium")) as "2 - Medium" count(eval(urgency=="3 - Low")) as "3 - Low" count(eval(urgency="unknown")) as "unknown" by urgency This puts the values in the key, and then the charting.fieldcolors works. ... View more

@jamie00171  So this snippet only works with the values in the key, which in my case is only count. 1 - High       ######################## 2 - Med       ########### 3 - Low        ############                                               count unknown    ###### If I use count in the charting.fieldcolors it works. Not if I use the actual field values. Still looking for how to work with the values. ... View more

Thank you, regarding this: each cell in a row has a different drilldown destination What would the XML look like if each cell had a different drilldown destination? ... View more

Very nice!  Thank you for this.   ... View more