Hello, we are ingesting data on multiple indexes for different departments. we want to create an alert when any index is not receiving logs from host should send and email to specific department mail address.  we created a lookup .csv file and mention indexname and email address. below is the query which i am trying to execute but no results.   | tstats latest(_time) as latest where index=* earliest=-6h by host | eval recent = if(latest > relative_time(now(),"-45m"),1,0), realLatest = strftime(latest,"%c") | where recent=0 | outputlookup weblogs-index.csv | stats values(useremail) AS emailToHeader | mvexpand emailToHeader | map search="index | inputlookup weblogs-index.csv | where useremail=\"$emailToHeader$\" | fields - useremail | sendemail sendresults=true inline=true server=\"Your.Value.Here\" from=\"Your.Value.Here\" to=\"$emailToHeader$\" subject=\"Your Subject here: \$name\$\" message=\"This report alert was generated by \$app\$ Splunk with this search string: \$search\$\"" | appendpipe [|inputlookup weblogs-index.csv] ... View more

Hi, how to build a search to check  endpoint agent is installed on windows/linux host by running a query. Scenario : i have a all the assets in a lookup.csv and now i want to run the search query comparing the on-baorded logs(symantec.exe) with lookup file which is have assets name, whether Symantec agent is installed or not on the host. Thanks in advance ... View more

Hi Everyone, i want to parse the below custom Application logs, Need your help and advises. 12084( 14140) 11/02/2020 15:39:09 RTE I Base login Response: 0.999 -- RAD: 0.000 JS: 0.313 Log:0.000 Database: 0.686(00910) LDAP: 0.000 LoadBalancer: 0.000 (CPU 0.171) application:login,cleanup 12084( 14140) 11/02/2020 15:39:09 RTE I -Memory : S(4638608) O(809484) MAX(5448092) - MALLOC's Total(143004) 12084( 14140) 11/02/2020 15:39:08 RTE I User integration has logged in and is using a Named license ( 17 out of a maximum 50 ) 12084( 14140) 11/02/2020 15:39:08 JRTE I GUID=b2125754-dcca-41a2-846f-f7783841fd8e 12084( 14140) 11/02/2020 15:39:08 RTE I SQL Server default schema is dbo 12084( 14140) 11/02/2020 15:39:08 RTE I MS SQL Server collation 'Arabic_100_CI_AS', varchar codepage 1256, comparison 196609: case insensitive, accent sensitive 12084( 14140) 11/02/2020 15:39:08 RTE I Connected to Data source 'SM' SQL server 'JUSTQQ-HPSQL01' version: 12.0.6329 through SQL driver version: 10.0.14393 using database 'SMPP' as user 'dbo' 12084( 14140) 11/02/2020 15:39:08 RTE I Connection established to dbtype 'sqlserver' database 'SM' user 'sm' 12084( 14140) 11/02/2020 15:39:08 RTE I API=SQLConnect 12084( 14140) 11/02/2020 15:39:08 RTE I Info: SQL State: 01000-5703 Message: [Microsoft][ODBC SQL Server Driver][SQL Server]Changed language setting to us_english. 12084( 14140) 11/02/2020 15:39:08 RTE I Info: SQL State: 01000-5701 Message: [Microsoft][ODBC SQL Server Driver][SQL Server]Changed database context to 'SMAPP'. 12084( 11436) 11/02/2020 15:39:08 JRTE I Webservice API session - Thread ID: 7C5ACF86B350A4A66FA0B58E083; Client IP: 192.168.1.1; session timeout: 45 seconds 12084( 14140) 11/02/2020 15:39:08 RTE I Total sessions since process began: 53144 12084( 14140) 11/02/2020 15:39:08 RTE I Thread 7C5ACF86B350A4A66FA795130B58E083 initialization done. Thread 1 of 50. 12084( 14140) 11/02/2020 15:39:08 RTE I Thread attaching to resources with key 0x61E13C00 12084( 14140) 11/02/2020 15:39:08 RTE I Host network address: 10.10.1.1 12084( 14140) 11/02/2020 15:39:08 RTE I Process sm 9.64.1003 (P1) System: 14080 (0x61E13C00) on PC (x64 64-bit) running Windows (6.2 Build 9200) Timezone GMT+03:00 Locale en_US from JUSTQR-SM01 12084( 14140) 11/02/2020 15:39:08 RTE I Using "utalloc" memory manager, mode [0] 12084( 11436) 11/02/2020 15:39:08 JRTE I Creating new worker thread 7C5ACF86B350A4A66FA0B58E083 t@52 9048( 19280) 11/02/2020 15:39:08 RAD I [INFO][urlCreator]: ====>https://xxxx.domain.com/src?ctx=docEngine&file=probsummary&query=number%3%22IM363572%22&action=&title=%D8%A7%D9%D8%AD%D8%AF%D8%AB%20IM572&queryHash=e33d06a15491712affa08b149ae19d699f58d665bd1e1abf3d53bfbe9 15984( 20140) 11/02/2020 15:39:07 RAD I [INFO][urlCreator]: ====>https://xxxx.domain.com/src?ctx=docEngine&file=probsummary&query=number%3%22IM363572%22&action=&title=%D8%A7%D9%D8%D8%AF%D8%AB%20IM572&queryHash=e33d06a15491712affa08b149ae19d699f58d665bd1e1abf3d53bfbe9/src?ctx=docEngine&file=probsummary&query=number%3D%22IM363588%22&action=&title=Incident%20IM363588&queryHash=2a2036befaa7c31d4c9b2ca74cbfa5535994125ecf77037a490cf55 15984( 20140) 11/02/2020 15:39:06 RAD I [INFO][urlCreator]: ====>https://xxxx.domain.com/src?ctx=docEngine&file=probsummary&query=number%3%22IM363572%22&action=&title=%D8%A7%D9%D8%AF%D8%AB%20IM572&queryHash=e33d06a15491712affa08b149ae19d699f58d665bd1e1abf3d53bfbe9/src?ctx=docEngine&file=probsummary&query=number%322IM363588%22&action=&title=Incident%20IM363588&queryHash=2a2036befaa7c31d4c9b2ca74cbfa5535994125ecf77037a4955 7440( 11732) 11/02/2020 15:39:05 RTE A Performance-7-$G.imAreas, Globallist $G.imAreas contains too many items! num=705 ; application(display), panel(show.rio) 7440( 11732) 11/02/2020 15:39:05 RTE A Performance-7-$G.imAreas.local, Globallist $G.imAreas.local contains too many items! num=705 ; application(display), panel(show.rio) 7440( 11732) 11/02/2020 15:39:05 RTE I -Memory : S(12882272) O(3118468) MAX(16000740) - MALLOC's Total(781539) 6984( 192) 11/02/2020 15:39:05 RAD I [INFO][urlCreator]: ====>https://xxxx.domain.com/src?ctx=docEngine&file=probsummary&query=number%3%22IM363572%22&action=&title=%D8%A7%D9%D8%D8%AF%D8%AB%20IM572&queryHash=e33d06a15491712affa08b149ae19d699f58d665bd1e1abf3d53bfbe9/src?ctx=docEngine&file=probsummary&query=number%3D%22IM362922%22&action=&title=Incident%20IM362922&queryHash=e06d549b1934cd837c5e5cd261d3003ca5f9281376f3251b72   ... View more