Hi I want to execute different SPL query in Dashboard studio panel on the basis of dropdown value. Drop down have two item only, if we select "Item1" in dropdown then in particular panel of Dashboard should execute "Query1" if selected "item2" in dropdown then in same panel of Dashboard studio should execute "Query2" item1 = "Aruba NetWorks" Item2 = "Cisco" Query1 = index=dot1x_index sourcetype=cisco_failed_src OR sourcetype=aruba_failed_src| | eval node= if(isnotnull(node_vendor),"Cisco","Aruba NetWorks")| search node = $<dropdown token>$ | table  node_dns node_ip region Query2 = index=dot1x_index sourcetype=cisco_failed_src OR sourcetype=aruba_failed_src| eval node= if(isnotnull(node_vendor),"Cisco","Aruba NetWorks")| search node = $<dropdown token>$ | table  Name Kindly Guide. Thanks Abhineet Kumar ... View more

Hi I have main dashboard "MFA Compliance Rate" as shown below in screenshot.   I have enabled drilldown feature in "MFA Compliance Rate Per Country" panel of main dashboard. Drilldown dashboard name is "Country_Compliance" in same splunk app.  Able to pass country data from main dashboard to drilldown dashboard below mentioned screenshot have on click config. I want to pass dropdown field value from main dashboard to drilldown dashboard.   For Example : I want to pass "Business-Unit" Dropdown value to drilldown dashboard along with "country" value after clicking on particular country bar from "MFA Compliance Rate Per Country" panel of main dashboard. Help me out how to pass dropdown value to drilldown dashboard. Thanks Abhineet kumar     ... View more

Hi,  Looking to get 1 month report for all alert generated from a splunk app. My "FSS" app have around 60 alerts configured. want to generate report in last one month which all alert get triggered by splunk with date time.   Thanks Abhineet Kumar ... View more

Hi, Below red highlighted is sample log file. Sample LogFile 12:08:32.797 [6] (null) DEBUG Bastian.Exacta.AMAT.ImportAdapter.Wcf.AMATWcfImport - JSON received for product import: {"records":[{"lgnum":"407","entitled":"4070","owner":"4070","product":"0205-02304","prd_descr":"PACKAGING, RUNNING BEAM GRIPPERS, REFLEX","base_uom":"EA","gross_weight":"0.000","net_weight":"1.000","weight_uom":"KG","volume":"6480.000","volume_uom":"CCM","length":"40.000","width":"18.000","height":"9.000","dimension_uom":"CM","serial_profile":null,"batch_req":null,"cycle_count_ind":"C","alternative_uom":"EA","shelf_life_flag":null,"shelf_life":null,"req_min_shelf_life":null,"req_max_shelf_life":null,"std_cost":"10.61","matnr":"0205-02304","suffix":null,"rev_level":"01","extension":null}]} 12:08:32.797 [6] (null) DEBUG Bastian.Exacta.Business.Xml.XmlEntity - Started saving XML entity of type 'ProductImportData' 12:08:32.844 [6] (null) DEBUG Bastian.Exacta.Business.Xml.XmlEntity - Finished XML entity of type 'ProductImportData'. Result: <?xml version="1.0" encoding="utf-16" standalone="yes"?> <PROD NAME="0205-02304"> 14:54:00.242 [8] (null) DEBUG Bastian.Exacta.AMAT.ImportAdapter.Wcf.AMATWcfImport - JSON received for order line cancel import: {"records":[{"Header":{"lgnum":"407","who":"47708597","canrq":"X"},"Detail":[{"tanum":"97908517"}]}]} 14:54:00.242 [8] (null) DEBUG Bastian.Exacta.Business.Persistance.SessionFactory - Opening NHibernate session using the production factory... 14:54:00.258 [8] (null) DEBUG NHibernate.SQL - select order0_.ORDER_TYPE as col_0_0_ from ORDER_HEADER order0_ where order0_.ORDER_NAME=@p0 ORDER BY CURRENT_TIMESTAMP OFFSET 0 ROWS FETCH FIRST 1 ROWS ONLY;@p0 = '47708597' [Type: String (4000:0:0)] 14:54:00.273 [8] (null) DEBUG Bastian.Exacta.Business.Persistance.SessionFactory - Closing NHibernate session... 14:54:00.273 [8] (null) INFO Bastian.Exacta.AMAT.ImportAdapter.Wcf.AMATWcfImport - Creating order cancellation transaction for order 47708597, OrderType : 0 14:54:00.289 [8] (null) DEBUG Bastian.Exacta.Business.Persistance.SessionFactory - Opening NHibernate session using the production factory... 14:54:00.320 [8] (null) DEBUG NHibernate.SQL - select orderline1_.ORDER_LINE_ID as order1_236_, orderline1_.ORDER_LINE_TYPE as order2_236_, orderline1_.LINE_NUM as line3_236_, orderline1_.LOT_NUM_REQUESTED as lot4_236_, orderline1_.QTY_REQUESTED as qty5_236_, orderline1_.UOM_SPECIFIED as uom6_236_, orderline1_.SERIAL_NUM_REQUESTED as serial7_236_, orderline1_.SINGLE_LOT as single8_236_, orderline1_.DAYS_TO_EXPIRE as days9_236_, orderline1_.VAS as vas10_236_, orderline1_.KITTING as kitting11_236_, orderline1_.DEST_ZONE as dest12_236_, orderline1_.SOURCE_ZONE as source13_236_, orderline1_.SEQ_NUM as seq14_236_, orderline1_.RETURNED_INV as returned15_236_, orderline1_.WGT_REQUESTED as wgt16_236_, orderline1_.INVENTORY_GROUP as inventory17_236_, orderline1_.TOTAL_RECEIPT_QUANTITY as total18_236_, orderline1_.LOT_REVISION as lot19_236_, orderline1_.SERIAL_NUM_REQUIRED as serial20_236_, orderline1_.CAPTURE_COUNTRY_OF_ORIGIN as capture21_236_, orderline1_.SECONDARY_SCAN_TYPE as secondary22_236_, orderline1_.SUPPRESS_SCANS_AT_PICK as suppress23_236_, orderline1_.SHOULD_PICK_RESERVED_INVENTORY as should24_236_, orderline1_.QUAR_REASON as quar25_236_, orderline1_.INVOICE_NUMBER as invoice26_236_, orderline1_.INVENTORY_RESERVATION_KEY as inventory27_236_, orderline1_.SSU_VALUE_PER_ITEM as ssu28_236_, orderline1_.PROD_ID as prod29_236_, orderline1_.UOM_TYPE_REQUESTED as uom30_236_, orderline1_.ORDER_ID as order31_236_, orderline1_.WAVE_ID as wave32_236_, orderline1_.ROUTE_ID as route33_236_, orderline1_.DOCK_ID as dock34_236_, orderline1_.DEST_WAREHOUSE_ID as dest35_236_, orderline1_.SOURCE_WAREHOUSE_ID as source36_236_, orderline1_.DOCUMENT_ID as document37_236_, orderline1_.ADJUSTMENT_ORDER_ID as adjustment38_236_, orderline1_.BOM_ID as bom39_236_, orderline1_.BOM_LINE_ID as bom40_236_, orderline1_.BOM_PARENT_LINE_ID as bom41_236_, orderline1_.PREFERRED_CNTNR_PATTERN_ID as preferred42_236_, orderline1_.COUNTRY_OF_ORIGIN as country43_236_ from ORDER_LINE_DETAIL orderlined0_ inner join ORDER_LINE orderline1_ on orderlined0_.ORDER_LINE_ID=orderline1_.ORDER_LINE_ID inner join ORDER_HEADER order2_ on orderline1_.ORDER_ID=order2_.ORDER_ID where order2_.ORDER_NAME=@p0 and orderlined0_.DETAIL_TYPE=@p1 and (orderlined0_.DETAIL_VALUE in (@p2));@p0 = '47708597' [Type: String (4000:0:0)], @p1 = 1000 [Type: Decimal (0:10:29)], @p2 = '97908517' [Type: String (4000:0:0)] 14:54:00.336 [8] (null) DEBUG Bastian.Exacta.Business.Persistance.SessionFactory - Closing NHibernate session... 14:54:00.336 [8] (null) INFO Bastian.Exacta.AMAT.ImportAdapter.Wcf.AMATWcfImport - No order lines found for order 47708597 for order line cancellation request, cannot proceed with cancellation transaction. 14:54:00.352 [8] (null) WARN Bastian.Exacta.AMAT.ImportAdapter.Wcf.AMATWcfImport - Exacta Event <ORDER CANCEL="N" ORDER_NAME="47708600" TYPE="2"> <DETAIL TYPE="1005" /> <TRAILER_STOP>0</TRAILER_STOP> <ORDER_PRIORITY>1</ORDER_PRIORITY> <ORDER_LINE CANCEL="N" LINE_NUM="1"> <PROD_NAME>0010-01283</PROD_NAME> <PROD_COMPANY_NAME>4070</PROD_COMPANY_NAME> <PROD_VENDOR_NAME>4070</PROD_VENDOR_NAME> <QTY_REQUESTED>1</QTY_REQUESTED> <DETAIL TYPE="1000" VALUE="97908520" /> <DETAIL TYPE="1001" VALUE="1" /> <?xml version="1.0" encoding="utf-16" standalone="yes"?> <ORDER CANCEL="N" ORDER_NAME="47708563" TYPE="1"> <DETAIL TYPE="1000" VALUE="" /> <DETAIL TYPE="1001" VALUE="90000086570010-01283" /> <DETAIL TYPE="1002" VALUE="1" /> <DETAIL TYPE="1003" VALUE="1" /> <DETAIL TYPE="1004" VALUE="ZCON" /> <TRAILER_STOP>0</TRAILER_STOP>   we want to ingest only those line to splunk indexer which matches with below mentioned four green highlighted lines. <ORDER CANCEL="N" ORDER_NAME="XXXXXXXX" TYPE="1"> <ORDER CANCEL="N" ORDER_NAME="XXXXXXXX" TYPE="2"> Creating order cancellation transaction for order XXXXXXXX, JSON received for product import: {"records":[{"lgnum":"407","entitled":"XXXX","owner":"XXXX","product":"XXXX-XXXXX", Let me know how we can ingest only green highlighted matched lines to splunk indexer as single event.   Thanks Abhineet Kumar   ... View more

HI,  I am looking for splunk query which gives table having count field value greater than 5 in last 24 hr. if my name log count is greater than 5 in last 24 hr for specific search condition then it should be available in table, if tomorrow again in last 24 hr log count on my name is greater than 5 then again my name should be available in table for last two days time range. Below mentioned is query for last 24 hour. EXTERNAL_AUTH_COMPLETE deviceType=AnixisPPCProvider AND wsModel != "Microsoft Corporation / Virtual Machine" earliest=-24h@h latest=now | rex field=machineUserName "[A-Za-z-]+(?<empNo>\d+)" | rex field=machineUserName "(?<eMail>.*@.*)" | lookup WorkdayData.csv empNum AS empNo OUTPUTNEW country OCGRP OCSGRP name email | lookup WorkdayData.csv email AS eMail OUTPUTNEW country OCGRP OCSGRP name email | eval country = if (country == "Korea, Republic of","South Korea",country) | eval country = if (country == "United States of America","United States",country) | eval empType = if (like(email,"%@contractor.amat.com%"),"Contractor","RFT") | rename OCGRP as Department OCSGRP as BusinessUnit name as Name email as Email country as Country empType as EmployeeType | search Department = "*" AND Country="*" | stats count by Name Email Country Department BusinessUnit EmployeeType | where count > 5 Provide me query to get table where log count greaten than 5 on daily basis. Thanks Abhineet Kumar ... View more

Hi, Looking for splunk query to use field value of 1st search in join search query to filter event of search query inside join. Query: index=lsc_db2_qa_index sourcetype=lsc_db2_ewm_qa_outbound | dedup EDIDCDOCNUM | rex field=_raw "(?<dateTime>[\d\-\s:]+).\d{3}, TIME.*" | rename EDIDCDOCNUM as ewmIdoc EDIDCSTATUS as ewmIdocStatus MESTYP as ewmmesType dateTime as ewmCreateTime | table ewmIdoc ewmIdocStatus ewmmesType ewmCreateTime | join type=outer ewmIdoc [search index=webmethods_qa5555_index sourcetype=transactions_qa5555_src | search sender="AMAT_SAP_EWM" AND receiver="EXACTA" | rex field=_raw "(?<wmDateTime>[\d\-:\s]+) .*" | rex field=messageId "(?<docNum>\d+)\|\|(?<whoNum>.*)" | rex field=messageId "(?<docNum>\d+)" | eval wmcreateDateTime= if( like( message, "%request from EWM%" ), wmDateTime,"") | eval wmconfirmDateTime=if( like( message, "%request sent to Exacta successfully%" ), wmDateTime,"") | eval wmsentDateTime=if( like( message, "%ready to send to Exacta%" ), wmDateTime,"") | lookup wminterface_mapping.csv wmInterface as interface OUTPUT Interface | stats values(Interface) as Interface values(whoNum) as whoNum values(wmcreateDateTime) AS wmcreateDateTime values(wmconfirmDateTime) AS wmconfirmDateTime values(wmsentDateTime) AS wmsentDateTime by docNum | rename docNum as ewmIdoc] | eval ewmIdoc=ltrim(tostring(ewmIdoc),"0") | fields ewmIdoc ewmIdocStatus ewmmesType ewmCreateTime whoNum,Interface,wmcreateDateTime,wmconfirmDateTime,wmsentDateTime | join type=outer whoNum [search index=lsc_exacta_qa_index source="D:\\ProgramData\\Bastian Software\\Logs\\ExactaImportAdapter\\ExactaImportAdapter*" | rex field=_raw ".* ORDER_NAME=\"(?<imaWho>[\d-]+)\" .*" | rex field=_raw ".*JSON received for product import:.*\"product\":\"(?<imaWho>[\d-]+)\",.*" | rex field=_raw ".*JSON received for putaway import:.*\"who\":\"(?<imaWho>[\d-]+)\",.*" | eval exactaRecTime = strftime(_time,"%Y-%m-%d %H:%M:%S") | dedup imaWho sortby +exactaRecTime | eval exactaInfStatus = if(exactaRecTime != "","Success",NA) | table imaWho exactaRecTime exactaInfStatus | join type=outer imaWho [search index=lsc_exacta_qa_index source="D:\\ProgramData\\Bastian Software\\Logs\\ExactaImport\\ExactaImport.txt" | rex field=_raw ".* Order \[(?<imWho>[\d-]+) - .*\] successfully assigned.*" | rex field=_raw "\.* Bastian\.Exacta\.Interface\.Processes\.ExactaProductTranslatorBase - Validation of Message Successfull, Prepare to Insert\n.*ROWS ONLY;\@p0 = \'(?<imWho>[\d-]+)\'.*\[.*" | rex field=_raw ".*\/line id \[(?<imWho>[\d-]+) -.* was cancelled successfully.\n.*" | rex field=_raw ".*\[Import Pick Orders\].*ROWS ONLY;@p0 = \'(?<imWho>[\d-]+)\' \[[\S\s]*- Messages processed successfully.*" | eval exactaDocTime = strftime(_time, "%Y-%m-%d %H:%M:%S") | search imWho !="" | eval exactaDocStatus = if(exactaDocTime != "","Created",NA) | table imWho exactaDocTime exactaDocStatus | rename imWho as imaWho] | table imaWho exactaRecTime exactaDocTime exactaInfStatus exactaDocStatus | rename imaWho as whoNum] | search Interface = "*" | rename whoNum as "WHO/PRODUCT" | table ewmIdoc ewmIdocStatus ewmmesType ewmCreateTime "WHO/PRODUCT",Interface,wmcreateDateTime, wmsentDateTime, wmconfirmDateTime, exactaRecTime exactaDocTime exactaInfStatus exactaDocStatus     OUTPUT:  looking  to execute  above red highlighted search query on events whose "_time" field value is equal to or greater than field value "wmsentDateTime" which we got from search query highlighted in green.   Thanks Abhineet Kumar ... View more

Hi, Getting below mentioned error while executing splunk query.   QUERY: index=lsc_exacta_index source="L:\\ProgramData\\Bastian Software\\Logs\\ExactaImport\\ExactaImport.txt" | rex field=_raw ".* Order \[(?<imWho>[\d-]+) - .*\] successfully assigned.*" | rex field=_raw "\.* Bastian\.Exacta\.Interface\.Processes\.ExactaProductTranslatorBase - Validation of Message Successfull, Prepare to Insert\n.*ROWS ONLY;\@p0 = \'(?<imWho>[\d-]+)\'.*\[.*" | rex field=_raw ".*\/line id \[(?<imWho>[\d-]+) -.* was cancelled successfully.\n.*" | rex field=_raw ".*\[Import Pick Orders\].*ROWS ONLY;@p0 = \'(?<imWho>[\d-]+)\' \[.*(\n|.)*- Messages processed successfully.*" | eval exactaDocTime = strftime(_time, "%Y-%m-%d %H:%M:%S") | search imWho !="" | eval exactaDocStatus = if(exactaDocTime != "","Created",NA) | table imWho exactaDocTime exactaDocStatus   Help me to optimize regex used in above mentioned query to avoid error mentioned in screenshot. Thanks Abhineet Kumar ... View more

Hi, Require to combine events having one field value same and create single row . Query:  index=webmethods_dev5555_index 0000000001515185 | rex field=_raw "(?<wmDateTime>[\d\-:\s]+) .*" | rex field=messageId "(?<docNum>\d+)\|\|(?<whoNum>.*)" | eval wmcreateDateTime= if( like( message, "%request from EWM%" ), wmDateTime,"") | eval wmconfirmDateTime=if( like( message, "%request sent to Exacta successfully%" ), wmDateTime,"") | eval wmsentDateTime=if( like( message, "%ready to send to Exacta%" ), wmDateTime,"") | lookup wminterface_mapping.csv wmInterface as interface OUTPUT Interface | table whoNum,Interface,wmcreateDateTime,wmconfirmDateTime,wmsentDateTime   OUTPUT:       We Want output in below format   suggest query to get desired output. ... View more

HI,  I am looking for splunk query to use regex on the basis of if statement. Query:  index=jfrog_index "org.artifactory.security.AccessLogger" NOT "127.0.0.1" | rex field=_raw ".*AccessLogger \[(?<action>[\w\s]+)\].*"|dedup action|search action = "ACCEPTED*" | table action OUTPUT:  action ACCEPTED DOWNLOAD ACCEPTED LOGIN ACCEPTED DELETE ACCEPTED DEPLOY ACCEPTED UPDATE ACCEPTED PROPERTY_UPDATED ACCEPTED CONFIGURATION_CHANGE ACCEPTED BUILD_CREATE     i want to use separate regex on the basis of action value with if condition so event matches with action mentioned above apply particular regex and filter out the information. As on the basis of action event format is different. for example: if (action = "ACCEPTED DOWNLOAD",<regex1>) if(action = "ACCEPTED LOGIN", <regex2>) regex1 = .*[\s]+\d+ (?<time>[\d:]+) (?<HOST>[\w\d]+) \[(?<date>[\d-]+)T.*\].*AccessLogger \[.*\] (?<repo>[\w-]+):(?<package>.*) for client : (?<user>[\_\w\-\d]+) \/ (?<userIp>.*)\. Provide me Splunk query for above example to extract information for different format event for different action type. Thanks Abhineet Kumar   ... View more

Need splunk query to parse json Data into table format. raw data/event in splunk: <158>May 09 04:33:46 detailedSwitchData {'cnxiandcm1': {'Ethernet1': 'MAC ACL Enabled', 'Ethernet2': 'MAC ACL Enabled', 'Ethernet3': 'MAC ACL Enabled', 'Ethernet4': 'MAC ACL Enabled', 'Ethernet5': 'Dot1x Enabled', 'Ethernet6': 'Dot1x Enabled', 'Ethernet7': 'Dot1x Enabled', 'Ethernet8': 'Dot1x Enabled', 'Ethernet9': 'Dot1x Enabled', 'Ethernet10': 'Dot1x Enabled', 'Ethernet11': 'Dot1x Enabled', 'Ethernet12': 'Dot1x Enabled', 'Ethernet13': 'Dot1x Enabled', 'Ethernet14': 'Dot1x Enabled', 'Ethernet15': 'Dot1x Enabled', 'Ethernet16': 'Dot1x Enabled', 'Ethernet17': 'Dot1x Enabled', 'Ethernet18': 'Dot1x Enabled', 'Ethernet19': 'Dot1x Enabled', 'Ethernet20': 'Dot1x Enabled', 'Ethernet21': 'Dot1x Enabled', 'Ethernet22': 'Dot1x Enabled', 'Ethernet23': 'Dot1x Enabled', 'Ethernet24': 'Dot1x Enabled', 'Ethernet25': 'Dot1x Enabled', 'Ethernet26': 'Dot1x Enabled', 'Ethernet27': 'Dot1x Enabled', 'Ethernet28': 'Dot1x Enabled', 'Ethernet29': 'Dot1x Enabled', 'Ethernet30': 'Dot1x Enabled', 'Ethernet31': 'Dot1x Enabled', 'Ethernet32': 'Dot1x Enabled', 'Ethernet33': 'Dot1x Enabled', 'Ethernet34': 'Dot1x Enabled', 'Ethernet35': 'Dot1x Enabled', 'Ethernet36': 'Dot1x Enabled', 'Ethernet37': 'Dot1x Enabled', 'Ethernet38': 'Dot1x Enabled', 'Ethernet39': 'Dot1x Enabled', 'Ethernet40': 'Dot1x Enabled', 'Ethernet41': 'Dot1x Enabled', 'Ethernet42': 'Dot1x Enabled', 'Ethernet43': 'Dot1x Enabled', 'Ethernet44': 'Dot1x Enabled', 'Ethernet45': 'Dot1x Enabled', 'Ethernet46': 'Dot1x Enabled', 'Ethernet47': 'Dot1x Enabled', 'Ethernet48': 'Dot1x Enabled', 'Ethernet49': 'Dot1x Enabled', 'Ethernet50': 'Dot1x Enabled', 'Ethernet51': 'Dot1x Enabled', 'Ethernet52': 'Dot1x Enabled', 'Ethernet53': 'Dot1x Enabled', 'Ethernet54': 'Dot1x Enabled', 'Ethernet55': 'Dot1x Enabled', 'Ethernet56': 'Dot1x Enabled', 'Ethernet57': 'Dot1x Enabled', 'Ethernet58': 'Dot1x Enabled', 'Ethernet59': 'Dot1x Enabled', 'Ethernet60': 'Dot1x Enabled', 'Ethernet61': 'Dot1x Enabled', 'Ethernet62': 'Dot1x Enabled', 'Ethernet63': 'Dot1x Enabled', 'Ethernet64': 'Dot1x Enabled', 'Ethernet65': 'Dot1x Enabled', 'Ethernet66': 'Dot1x Enabled', 'Ethernet67': 'Dot1x Enabled', 'Ethernet68': 'Dot1x Enabled', 'Ethernet69': 'Dot1x Enabled', 'Ethernet70': 'Dot1x Enabled', 'Ethernet71': 'Dot1x Enabled', 'Ethernet72': 'Dot1x Enabled', 'Ethernet73': 'Dot1x Enabled', 'Ethernet74': 'Dot1x Enabled', 'Ethernet75': 'Dot1x Enabled', 'Ethernet76': 'Dot1x Enabled', 'Ethernet77': 'Dot1x Enabled', 'Ethernet78': 'Dot1x Enabled', 'Ethernet79': 'Dot1x Enabled', 'Ethernet80': 'Dot1x Enabled', 'Ethernet81': 'Dot1x Enabled', 'Ethernet82': 'Dot1x Enabled', 'Ethernet83': 'Dot1x Enabled', 'Ethernet84': 'Dot1x Enabled', 'Ethernet85': 'Dot1x Enabled', 'Ethernet86': 'Dot1x Enabled', 'Ethernet87': 'Dot1x Enabled', 'Ethernet88': 'Dot1x Enabled', 'Ethernet89': 'MAC ACL Enabled', 'Ethernet90': 'MAC ACL Enabled', 'Ethernet91': 'MAC ACL Enabled', 'Ethernet92': 'Dot1x Enabled', 'Ethernet93': 'Dot1x Enabled', 'Ethernet94': 'MAC ACL Enabled', 'Ethernet95': 'MAC ACL Enabled', 'Ethernet96': 'Dot1x Enabled', 'Ethernet97/1': 'Uplink Port', 'Ethernet98/1': 'Uplink Port', 'Ethernet99/1': 'Uplink Port', 'Ethernet100/1': 'Uplink Port', 'Ethernet101/1': 'Uplink Port', 'Management1': 'Uplink Port'}}   Output table :   ... View more

We have splunk event having field "eventdateTime"  in format mentioned below. for example eventdateTime 2023-04-17 06:45:55,405 2023-04-17 06:45:52,599 2023-04-17 06:45:52,446 2023-04-17 06:45:52,208   We want to create new field "duration" that will give difference of "eventdateTime" value with current date time value in Minute seconds format i.e( duration = 4Min:10.256Sec) For Example:  eventdateTime = 22023-04-17 06:51:19,950 current date time = 2023-04-17 06:53:39,000 duration = 2Min:19.050Sec ... View more

Hi,  looking for splunk query having field name similar to field in lookup file with respective value in lookup file. query have field "index" value is same as lookup file field "CAPNSplunk" value. if "index" field value matches with lookup file "CAPNSplunk" then "index" field value should get replaced with associated "RANSplunk" field value available in lookup file. lookup file: CAPNSplunk,RANSplunk "Pricing","Pricing Outlier" "Smart_Factory","Smart Factory BUCT" "SMARTFACTORY_LOGISTICS","Smart Factory Logistics" "SmartFactory_PM_Console","Smart Factory PM Console" "GCW_Dashboard","Global Contingent Worker Dashboard" "HRM_Spans_Layers","HRM - Spans & Layers" "Unity_Portal-Part_Aggregation","Unity Portal" "Blackbird_Dashboard","Blackbird" "WWops","WWOps" "AGS_metrology_AutoML","Metrology Auto ML Classification" "Action_Plan_Tracker","IDCL"   index: Pricing Smart_Factory SMARTFACTORY_LOGISTICS SmartFactory_PM_Console GCW_Dashboard HRM_Spans_Layers Unity_Portal-Part_Aggregation Blackbird_Dashboard WWops AGS_metrology_AutoML Action_Plan_Tracker   For example: if "index" field value is "Pricing" then it should get replaced with "Pricing Outlier" after looking into lookup file. ... View more

Looking for Splunk query to filter out event if "Attachment" field having extension .txt or .html or .jpg or .png if only above mentioned file extension available in "Attachment" field then only it should filter out. apart from that if any other file extension available with above mentioned then wee need to consider that event. Below mentioned is attachment field values in some of event.   red enclosed event should be filtered out as "Attachment" field have only ".txt",".html" and ".png". other two event have ".txt",".html",".docx" and ".txt",".ics" these two should not filterout. ... View more