Hello all,  since our Update to Splunk Enterprise 9.0.2 we experienced, that the Dashboard colors (Simple XML) changed completely. And the new colors are terrible! Did someone experience something similar after the update? And if yes: Were you able to get the colors back to the way they were? On 8.2.2.3   On 9.0.2 I would appreciate every hint. The new colors are something that cannot be presented to management 🙈 Thanks and best Regards   ... View more

Hello, I am experiencing an interesting Issue. I am trying to filter for a specific value in a numeric field. Following statement works finde:         index="IndexA" | eval A.distance=trim('A.distance',"'") | eval A.distance='A.distance'/100 | search A.distance=1         If I am trying to replace the search with a where, I am getting the Error "Error in 'where' command: Type checking failed. The '==' operator received different types."         index="IndexA" | eval A.distance=trim('A.distance',"'") | eval A.distance='A.distance'/100 | where A.distance=1         Event Coverage if this value is 100% and all the values get for typeof() the result "Number". All of the values do not have a digit after the comma. We are using Splunk Enterprise 8.2.3.3 . Does someone know, why the where statement is yielding an error in this case? Thanks ... View more

Hello,  i have a question regarding the usage of the results of a join within an eval if. I have a couple of responses, to which I am joining their preceeding requests (written in another source)   index="index1" sourcetype="sourcetype1" Response... |table rcvTime Command |join type=left left=response right=request usetime=true earlier=true where response.ID=request.ID [search index="index2" sourcetype="sourcetype2" Request ....|table rcvTime Command|sort _time-]   The issue is, that sometimes I get a wrong match, hence a request, that is not connected to the response and was a few days ago. The reason, why they are matched, is because it is the same device ID.  Thats why I am trying to have an eval for the timediff. If I am using the variable request.command within the if, I will receive empty results:   index="index1" sourcetype="sourcetype1" Response... |table rcvTime Command |join type=left left=response right=request usetime=true earlier=true where response.ID=request.ID [search index="index2" sourcetype="sourcetype2" Request ....|table rcvTime Command|sort _time-] |....(commands calculating timediff) | request.command=if(timediff<300,request.command,"")   If I am saving the value within a field that contains no point in the name, it works properly:   index="index1" sourcetype="sourcetype1" Response... |table rcvTime Command |join type=left left=response right=request usetime=true earlier=true where response.ID=request.ID [search index="index2" sourcetype="sourcetype2" Request ....|table rcvTime Command|sort _time-] |....(commands calculating timediff) |rename requestCommand as request.command | requestCommand=if(timediff<300,requestCommand,"")   Does someone have an idea, why I cannot use request.command within the eval (but on other commands I can use it)? Thanks and best Regards ... View more

Hello guys, does someone know, whether it is possible, to do a matching of search results with previous results of the same search? I have a machine, that can enter different modes. Just for the example lets say, the machine can enter mode A, B or C. I receive an heartbeat every few seconds of hundred of these machines, which leads to a very large dataset. But I am not interested in the heartbeat, I am interested in the transition of the modes. Example: Time Machine_ID Mode 10:00:00 1 A 10:00:01 2 C 10:00:02 2 C 10:00:03 1 B 10:00:04 2 B   So what I am basically interested in here is the transition of machine 1 from mode A to B and of machine 2 from C to B.  In other words: I am searching for heartbeats, where the mode is different than the mode of the previous heartbeat of the same machine_ID. At the end, my result would look something like this _time _time_old_Mode machine_ID new_mode old_Mode 10:00:03 10:00:00 1 B A 10:00:04 10:00:02 2 B C   I have tried subsearches, but I was not sucessful. The simplified search for getting the heartbeat is currently: index="heartbeat" | rex field=_raw "......(?P<MODE>.......)"| fields _time ID MODE Performance is not crucial, as it is planned to run this at night for a summary index. Thanks in advance!  Best Regards ... View more