Hello darlas, Was just refreshing my knowledge of the ISO 8601 timestamp format, and read your post from 5 years and 9 months ago.  Don't see that anyone ever responded to your question. "I also am trying to parse or reformat an ISO 8601 date into something more human friendly. Hope someone can help." ISO 8610 format: | eval newtime=strftime(_time, "%Y-%m-%dT%H:%M:%S.%3N%z") Here is something more human readable friendly without getting to far away from the ISO standard.  Like to change the year with century, %Y, to without century, %y, leave out the T separator and the time zone offset, %z, and add the milliseconds, %3N.  Also, like to add the @ between the date and time strings, but that can be added of removed depending on preference, and horizontal real estate available in the report or dashboard panel. Hope this helps - if you still need help.  😎 | eval newtime=strftime(_time, "%m/%d/%y @ %H:%M:%S.%3N")   ... View more

Typo correction: Hello Giuseppe, Noticed it's been over 8 years since you posted your question, but came across this post while searching on how to make a text box empty by default......same as you were looking to do. Was working on a dashboard today, and thought what character is not ever in event data, and is not a character used by SPL for any reason.  The answer was the:  ~ This worked for me, like a charm, in a dashboard text box:    <initialValue>~</initialValue> <default>~</default> Best regards,      Dennis ... View more

Hello bowesmana, The transaction command worked.  Memory was at 16% when the search was started, and the search ran for 72 hours with the transaction command, but memory utilization stayed at 16% every time checked. So the transaction command doesn't have the huge memory requirements issue that the dedup command has. The overall count needed was all the events in that 24-hour period, and then all the events in that same 24-hour period minus exact duplicate events. As mentioned, was able to get the count of all the events, minus the duplicates, using the transaction command. So all is good. The overall reason for this post was to find out if the dedup command possibly had a defect in SE 9.5.0, and you answered that the dedup command is designed that way.  Although, that means the dedup command is basically useless with larger data sets. ... View more

Great, thanks Rich. It would be good if Splunk could enable the new geo-location DB that ships with SE 9.0.0 or later, dbip-city-lite.mmdb, to be updated on a regular basis instead of having to replace the new DB with either MaxMind's, or some other vendor's DB. Splunk could build that update functionality in behind the scenes if divulging the new vendor is top secret for some reason.  😎 Otherwise, the update procedure for the new DB could be added to the iplocation page like for MaxMind's update procedure. ... View more

Thanks Rich! That answered all my questions, but brought up 2 new questions. We are running SE 9.0.5 so we have the new $SPLUNK_HOME/share/dbip-city-lite.mmdb  geo-location DB as you mentioned. The reason for this new question is I noticed an IP address yesterday whose City seems to be outdated against the results from iplocation.net. Guessing there is no way to update the new dbip-city-lite.mmdb DB after the initial SE install since Splunk has not divulged the vendor ? Went to the link you provided, and to the 9.0.5 page for iplocation which does state the new vendor's mmdb file name, but the data after that shows how to update MaxMind DB's, GeoLite2-City.mmdb & GeoIP2-City.mmdb , which as you said were replaced in 9.0.0, and are not shipped with version 9.0.5.  Is this an oversight in the documentation ?   iplocation - Splunk Documentation "Usage The iplocation command is a distributable streaming command. See Command types. The Splunk software ships with a copy of the dbip-city-lite.mmdb IP geolocation database file. This file is located in the $SPLUNK_HOME/share/ directory. Updating the IP geolocation database file Through Splunk Web, you can update the .mmdb file that ships with the Splunk software. The file you update it with can be a copy of one of the following two files. Only those two files are supported. To use these two files, you must have a license for the GeoIP2 City database. File name Description GeoLite2-City.mmdb This is a free IP geolocation database that is updated on its download page on a weekly basis. GeoIP2-City.mmdb This is a paid version of the GeoLite2-City IP geolocation database that is more accurate than the free version.   Replacing your mmdb file with one of these two files reintroduces the Timezone field that is absent in the default .mmdb file, but does not reintroduce the MetroCode field. Prerequisites You must have a role with the upload_mmdb_files capability. Steps Go online and find a download page for the binary .tar.gz versions of the GeoLite2-City or the GeoIP2-City database files. Download the binary .tar.gz version of the file (GeoLite2-City or GeoIP2-City) that is most appropriate for your needs. Expand the binary .tar.gz version of the file. The .tar.gz file expands into a folder which contains the GeoLite2-City.mmdb file, or the GeoIP2-City.mmdb file, depending on the download you selected. In Splunk Web, go to Settings > Lookups > GeoIP lookups file. On the GeoIP lookups file page, click Choose file. Select the .mmdb file. Click Save. The page displays a success message when the upload completes." ... View more

Thanks Rick! What Rich Galloway stated was that "Splunk recently changed geo-ip providers and no longer ships with a MaxMind database." If that is the case, I was asking what company is the new geo-ip provider that has taken over from MaxMind ? Also, what version of SE did the switchover over, and what directory is the new geo-IP DB in, and what is the new mmdb file name? Best regards, Dennis   ... View more

Hello Rich, "Furthermore, Splunk recently changed geo-ip providers and no longer ships with a MaxMind database." What company is now the Splunk geo-ip DB provider, in 2023, since Splunk no longer ships with a MaxMind database as you mentioned? Also, what is the new DB file name, what directory is it located in, and does the new iplocation DB get updated after the initial SE installation, or not ? Best regards, Dennis   ... View more

Would also like to see the answer to this question so as to fit all the field sizes properly in the email output especially when using the _raw field which can take up mostly the entire row of output. ... View more

Hello Log_wranger, Been a long time since you asked the question, but give this a try. Add the following file within the app.  Go to $SPLUNK_HOME/etc/apps/licensequotausage/local, and create the new file props.conf.  Then the 1 line to enter related to your TZ setting would be: TZ=UTC Then restart Splunk. ... View more

Hello Log_wranger, Been a long time since you asked the question, but give this a try. Add the following file within the app.  Go to $SPLUNK_HOME/etc/apps/licensequotausage/local, and create the new file props.conf.  Then the 1 line to enter related to your TZ setting would be: TZ=UTC Then restart Splunk.     ... View more