Well, |sort sorts all rows by the specified columns so I don't understand what do you mean by "sorts only first column". ... View more

Well, this event is in a completely different format. So I suppose you should first work on your data input - providing proper clasification of events into sourcetypes and parsing rules (extractions).   ... View more

There is probably another way. But I'd do your initial search index="test" sourcetype="csv" | stats count as numColor by color Then I'd add eventstats to have sum of the counts in every row |eventstats sum(count) as totalcolors So now you can simply evaluate | eval percentage=numColor/totalcolors ... View more

You might just add another condition to your initial search. _raw!=*your_text_to_filter_out* It ain't very pretty nor very efficient but should work. But generally you'd be better off filtering by values of parsed fields. So in this case, assuming that the even parses the fields from the event, you would just filter by "http_method!=POST restEndPoint!=/v1/whatever" and so on. ... View more

It's a typical mistake to want to have knowledge about _what_ was done earlier "down the road" whereas Splunk doesn't work that way. After a pipe you get only a _result_ of the command from before the pipe. So if any command is supposed to look for - let's say - one of three different values but finds only two of them, the result will only have two of those values and any subsequent command won't have the knowledge that you wanted to search for the third value as well. You only get the results. So the most obvious workaround in such case as yours is - as @ITWhisperer showed - creating an initial set of "empty" (with a value of zero) result set and then sum this set with your actual result. That way if you don't have any other results, you'll just stay with your static results of zero hits. ... View more

Depends on what you mean by "prevent from showing up". Do you want to filter out whole events that match some criteria? If so, then you can use |search or |where. But this one you would typicaly use much further down the processing pipeline since instead of filtering simple search results you should probably just add another condition to your initial search. Or maybe you want to limit your processing to only a subset of files - for that you can use |fields. Of course for this you should have parsing rules for given event in place. ... View more

OK, So you defined extraction by using Event Action -> Extract Fields, you defined the regex, checked it further down the process, saved it but now it "won't work" for the events you want it to parse, right? Two quick questions: 1. Are the events you're trying to parse of the same sourcetype you created the extraction for? 2. Do you use for searching the same user you defined the extractions with? (or did you share the extractions for other apps) ... View more

Well, that's strange because as an admin you should have additional entries in Settings dialog. Especially the links to manage roles and users. See for yourself: https://docs.splunk.com/Documentation/Splunk/8.2.2/Search/NavigatingSplunkWeb Look at the screenshot of the Settings menu. In a larger (not all-in-one) environment some settings might not be available but the ones we're talking about should definitely be there (for an admin). Properly, you should have your email sending mechanism configured under Alert Actions. Then when defining alert you only need to chose the defined Alert Action. ... View more

For log_level you're trying to capture everything that's not a closing bracket. Are you sure that's what you want? Because I'm not 😉 In uri_path you have two pluses and you might stop capturing short of the pipe character (and you don't need to escape question mark in the character class here). Curly brackets in the last part should be escaped, otherwise they are interpreted as repetition counters. Finally, you're capturing error_description with the backslash escaping the quotation marrk, and the error without it (and you'll have problems if any of these fields contains those fields further escapes). ... View more

As the message says, you have too little memory in your machine for the load you want to impose on it. Splunkd process (or some other process running in the system) tries to allocate memory up to the point of exhaustion. Firstly, make sure that you're not running other memory-intensive processes on that machine and secondly, check in monitoring console which searches use up most of memory. You might then decide whether to lower the memory limits for splunk (which might cause some searches to fail) or lower search concurrency limits (which might cause searches to be delayes or skipped). Or just add memory to the machine. ... View more

(?<method>\S+)\s(?<path>/[^?]*)(\?(?<query>\S*))? Typing on my phone, didn't verify it 😉 ... View more

Desired location of props.conf depends on the effect you want to achieve. If you want search-time extractions, you need props.conf and transforms.conf on search-heads (either put there directly or distributed from the deployer). If you want indexed field extraction, you need to put the files on the server(s) in the ingest path (indexers and/or heavy forwarders). There would be no point in defining search-time extraction on indexers as there is no point of defining ingest time indexed field extractions on search heads. Of course you can make "common" props.conf and transforms.conf containing both types of configurations and put them on both layers of your environment. This way only settings relevant to the appropriate layer would be in effect, the rest of the settings would be ignored. ... View more

Just extract the appropriate fields from the URI and split the parameters into a multivalued field. | makeresults | eval _raw="msg: abc.asia - [2021-08-23T00:27:08.152+0000] \"GET /facts?factType=COMMERCIAL&sourceSystem=ADMIN&sourceOwner=ABC&filters=%257B%2522stringMatchFilters%2522:%255B%257B%2522key%2522:%2522BFEESCE((json_data-%253E%253E'isNotSearchable')::boolean,%2520false)%2522,%2522value%2522:%2522false%2522,%2522operator%2522:%2522EQ%2522%257D%255D,%2522multiStringMatchFilters%2522:%255B%257B%2522key%2522:%2522json_data-%253E%253E'id'%2522,%2522values%2522:%255B%25224970111%2522%255D%257D%255D,%2522containmentFilters%2522:%255B%255D,%2522nestedMultiStringMatchFilter%2522:%255B%255D,%2522nestedStringMatchFilters%2522:%255B%255D%257D&sorts=%257B%2522sortOrders%2522:%255B%257B%2522key%2522:%2522id%2522,%2522order%2522:%2522DESC%2522%257D%255D%257D&pagination=null\"" | rex "\"(?<req>\S+)\s(?<uri>\S+)\"" | eval uri=urldecode(uri) | rex field=uri "(?<reqpath>.*)\?(?<query>.*)" | makemv delim="&" query | search query="factType=COMMERCIAL"  Then you can extract the "filters=something" value from the query field and process it apropriately (probably passing it through another urldecode()). ... View more

Well, yes, and no 🙂 I'd advise against formating time to text whenever possible. If possible - keep the time as unix timestamp, only format it on output with | fieldformat. That way any time manipulation is much easier (you just add/substract appropriate number of seconds) without the need of recalculating the date to/from the string representation. ... View more

If you do at - let's say - 10:35:15 a |timechart with span=1m over last 5 minutes, you'll get data from 10:30:15 to 10:35:15 split into a minute-long buckets, aligned at full minutes. So you'll get 6 buckets - one containing events from 10:30:15 to :10:31:00, another one from 10:31:00 to 10:32:00 and so on up to 10:35:00-10:35:15. Obviously, the first and last buckets will be smaller than the rest of them. That's the default behaviour of the |timechart You can however use partial=f option for |timechart wich will omit the not-full first and last buckets from the result. In our example case you'd get only four buckets - 10:31-10:32, 10:32-10:33, 10:33-10:34 and 10:34-10:35. ... View more

Ahhh... I thought you wanted to have a value from last minute compared to an average of previous values. But you simply want a moving average over a sliding window. Just use the timechart (as I wrote before - it's a dedicated command for analysing time series so there's no need to fiddle manually with buckets) and do a streamstats. <<your_search>> | timechart count span=1m | streamstats window=10 avg(count) Alternatively you can use |trendline <<your_search>> | timechart count span=1m |  trendline sma10(count) Remember than with time aligned to full minutes you might want to set your search time range to full minutes otherwise you'll get "not-full" values at the ends of the range since they correspond to only fractions of a minute. ... View more

Well, you can have an action "send email" in alert definition but the email settings for your Splunk Enterprise instance must be specified by the admin. If your Splunk instance was not configured for sending email, it's either an ommision by the admin or a deliberate choice not to use this functionality. Either way - you should consult your Splunk admin about this. And it's overally a good idea - a normal user shouldn't be able to (ab)use email sending functionality by trying to send emails via random servers. ... View more

I don't understand 🙂 I thought you wanted a value of count of events from the last minute and the average per-minute value from some previous minutes. That's what this does. Firstly it calculates per-minute statistics with |timechart. Then it adds a field containing a timestamp of the latest minute (so we can differentiate between the latest minute and the previous ones). Then it rewrites the timestamp for the remainding minutes so they can be aggregated with stats. And finally | stats avg(count) gives you two values - one is an "average" value from a single value from last minute and the other is an average calculated from previous minutes. Is that not what you wanted?   ... View more

"Prettier" solution probably could be made using a lookul translating from one set of codes into another set of categories. But even with a simple eval, instead of a multi-or-ed conditon I'd rather use a case statement - that's a bit more flexible and easy to maintain IMHO. ... View more

As a one-off search, you can just use | rex to extract the data from the event but in general it'd be better to write a proper parsing rules for this sourcetype so you have the data extracted automatically into the fields. ... View more

What do you mean "don't use an index"? You can quite easily find searches which don't have said index literarily entered as a part of the search but what if the searches reference that index in another way? A macro, for example. Or a subsearch? BTW, just because a search doesn't use a "index=something" condition, doesn't mean that it's "bad". You might - for example have searches populating lookups by performing ldapsearch. Or you might use a search to check a dynamicaly created lookup for its validity of some kind. Or any other legit reason not to have an index explicitly included i  the search. ... View more

How do you decide what constitutes a non-working dashboard? One thing is that a query populating widgets might be syntacticaly wrong or might be referencing a non-existing object. Maybe with some deal of painful work you could (semi)automaticaly detect such ones. But what about the ones that simply return wrong values? How would you be able to decide which values make sense and which don't without understanding what they represent? ... View more

To define roles (add capabilities to a role) you have to be an admin. ... View more