All them commands have some limitations. Some more explicitly configured, some implicitly derived from operating system limits. Anyway. Simply replacing eventstats with streamstats obviously won't do. With streamstats you'd need some copying over values and I don't have a ready solution. I have a hunch it's possible but will be ugly and possibly even less efficient than eventstats based one. ... View more

1. We still have no idea what your raw data looks like. For example - how are we supposed to know whether the log.message path is the right one? I suppose it is because you're getting _some_ result but we have no way to know it. 2. Your initial search is very ineffective. Wildcards in the middle of search terms can give strange and inconsistent results and generally wildcards in a place other than the end of a search term slow your search. 3. You're getting some result but you're not showing us anything. How are we supposed to even understand what you're getting? 4. Don't get involved in this "177 events" number. It's just all events that have been matched by your initial search. 5. There are two main techniques of debugging searches - either you start from the start and add commands one by one until the results stop making sense or you start with the whole search and remove commands one by one until the results start making sense. 6. Honestly, I have no idea what you're trying to achieve with this mvzip/mvexpand/regex magic. ... View more

Splunk will do aggregations on the fields you tell it to as long as you have those fields extracted. Until then, they are not fields, they are just some parts of the raw data. You must define proper ways to extract the fields you want to either aggregate or split your aggregations on. One way is what @yuanliu has already shown. Another way is to define extractions at sourcetype level. Anyway, your data seems a bit "ugly" - it seems to be a json structure with a string field containing some partly-structured data. It would be much better if the data was actually provided in a consistent format so that you don't have to stand on your head in a bucket full of piranhas to get the values you need. ... View more

1) I'm honestly not sure what will Splunk do if there is a whitespace-filled value. Try and see 🙂 You're not changing your indexed data after all - you can search it every way you want (if you have too much data to search, just narrow your time range for quick tests). 2) You could try using some streamstats tricks as long as you can make some assumptions on your data (like it being sorted the right way) but that will be bending over backwards. True, eventstats has some limitations when it comes to data set size. You can have however as many eventstats within a single search as you want 🙂 See https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventstats#Usage and https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventstats#Functions_and_memory_usage   ... View more

Yes. Define exception in Nessus. ... View more

Json is a structured format so the order of fields should not matter for the recipient. After all you will be addressing the fields by their names. Unless you're manipulating that json on the receiving end using something not fit for json processing. In that case maybe json is not the best format choice. ... View more

You can help yourself and check how many distinct values are there in the name field. | eventstats dc(name) as dc | where name!="name0" OR (name=="name0" AND dc=1) Then you can | dedup name f needed ... View more

Then just filter out all events with name="name0" | where name!="name0" or even | search name!="name0" Then you can dedup if needed. ... View more

Actually that is an interesting train of thought. You could do this to conditionally create a set of "easily not-fulfillable" conditions. Like some non-existent sourcetype being set only on those days you don't want the search to run. ... View more

This looks like simple | dedup ip If there is some other logic involved, please explain. ... View more

Yes, that's some approach to the problem but while it might not make a big difference for a simple and lightweight search if your search is a big and heavy report you'd still be running it and stressing your servers. It's just that you wouldn't get any results back. ... View more

Alternatively you could just to a very ugly hack and name your field so it will be iterated over at the end and knowing it will be added to itself just divide it in half 😁 ... View more

Right you are. As usual, forgot about it. Here's fixed version. | makeresults format=csv data="ServerName,UpgradeStatus Server1,Completed Server2,Completed Server3,Completed Server4,Completed Server5,Completed Server6,Completed Server7,Pending Server8,Pending Server9,Pending Server10,Processing Server11,Processing" | stats count by UpgradeStatus | transpose 0 header_field=UpgradeStatus | fields - column | eval Total=0 | foreach * [ eval Total=Total+if("<<FIELD>>"=="Total",0,<<FIELD>>) ] ... View more

Don't stats. Just look for raw events. If you have them, the problem is probably in parsing. If you don't, search why you didn't get them ingested properly. ... View more

There isn't a search that can't be made uglier with foreach XD | makeresults format=csv data="ServerName,UpgradeStatus Server1,Completed Server2,Completed Server3,Completed Server4,Completed Server5,Completed Server6,Completed Server7,Pending Server8,Pending Server9,Pending Server10,Processing Server11,Processing" | stats count by UpgradeStatus | transpose 0 header_field=UpgradeStatus | fields - column | eval Total=0 | foreach * [ eval Total=Total+<<FIELD>> ]  As an alternative you can also use appendpipe | makeresults format=csv data="ServerName,UpgradeStatus Server1,Completed Server2,Completed Server3,Completed Server4,Completed Server5,Completed Server6,Completed Server7,Pending Server8,Pending Server9,Pending Server10,Processing Server11,Processing" | stats count by UpgradeStatus | appendpipe [ stats sum(count) as count | eval UpgradeStatus="Total" ] | transpose 0 header_field=UpgradeStatus ... View more

It's impossible to answer such question without knowing your data and your environment. You can start debugging by checking which jobs were started and verifying if you can find a corresponding job completed event for them. If so check if the data is in different format or if your extractions properly match the fields. If not check your ingestion pipeline to see why there are missing events. ... View more

You can do the more or less same thing with rex alone https://regex101.com/r/KFMlCd/1 EDIT: Ready Splunk version: | makeresults | eval origData="<?xml version='1.0' encoding='UTF-8'?><BAD_MSG><violation_masks><block>58f7c3e96a0c279b-7e3f5f28b0000040</block><alarm>5cf7c3e97b0c6fdb-7e3f5f28b0000040</alarm><learn>5cf2c1e9730c2f5b-3d3c000830000000</learn><staging>0-0</staging></violation_masks><response_violations><violation><viol_index>56</viol_index><viol_name>VIOL_HTTP_RESPONSE_STATUS</viol_name><response_code>500</response_code></violation></response_violations></BAD_MSG>" | rex field=origData mode=sed "s/<([^\\/][^>]+)>(?=.*<\\/\\1>)/\n<\1>/g" | rex field=origData mode=sed "s/><\//>\n<\//g" It doesn't indent though. ... View more

The mockup data contains events from both index1 and index2 (the first column of the dummy data). It is assumed to be an equivalent of searching over (index=index1 OR index=index2). Did you copy-paste my example search raw or did you modify it? And which Splunk version are you using? ... View more

Wait a second. "We have our virtual environment and S3 as well" - does that mean that you're using smartstore or this S3 is unrelated to Splunk? ... View more

There are two possible approaches: 1. Migrate existing installation to a new OS and then "upgrade" it to cluster. 2. Do the cluster first adding new components with a new OS. Both have their pros and cons. Theoretically, Splunk advises that all components run "the same OS and version" whatever that means. Practically, of course that's impossible to keep this requirement throughout the whole system lifecycle if not for any other reason, just because mid-upgrade you have some part of your cluster with an earlier version, some with later. Also since Splunk doesn't really rely on too many components of the OS itself, it shouldn't matter that much as long as you're in the supported OS range. (but yes, it can cause issues with support involvement should you need their help). OTOH, if you try to fiddle with your only existing installation (as in "migrate first, clusterize later") you have of course additional risks from manipulating your only instance. If you feel confident in your backups 😉 that might be better from the supportability point of view. But of course it involves possibly longer downtimes. ... View more

This actually looks OK-ish. You probably have some json data which gets parsed into those "multilevel" fields. ... View more

Well, not everything can be solved just by joined community wisdom. Sometimes you simply have to raise support case. ... View more

You're thinking in wrong order. That's why I'm saying it's not possible with Splunk alone. If you don't know this one, it's one of the mainstays of understanding of Splunk indexing process- https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platform-the-Masa/m-p/590774 As you can see, line breaking is one of the absolute first things happening with the input stream. You can't "backtrack" your way within the ingestion pipeline to do SEDCMD before line breaking. And, as I wrote already, it's really a very bad idea to tackle structured data with regexes. ... View more

Try enclosing your search term with quotes. "\"TOPIC_COMPLETION\"" ... View more