Hi, I am trying to establish a query that checks whether a random src IP is in a specific subnet. However, all the subnets and IP addresses are in String format and I am unable to establish any mathematical relationship between the conditions. Here is a part of my current query: | inputlookup ABC.csv | eval ip = 10.1.2.342 | eval AMERICAS =if(ip >= 10.0.0.1 OR ip <= 10.63.255.254,"NOK","OK") | table AMERICAS   Can you please help? Many thanks as always, ... View more

Hi, I have a dashboard on Dashboard Studio and since this morning, I have been unable to use the "Open in Search" icon for each search panel. I am also using a token for a text input on this dashboard. Why would this be as I made no changes to the respective JSON data of this dashboard?   Many thanks, Patrick ... View more

Hi, I have the following search that searches an index based on 2 textbook inputs: | inputlookup ABC | search src=$src_tok$ OR dest=$dest_tok$ I need to change this such that multiple src's or multiple dest's are inputted at a given time by a user. Something like the following if dest="10.175.96.146 10.175.96.147 10.175.96.148 0.175.96.149 10.175.96.150 10.175.96.183": | inputlookup ABC | search src=* OR (dest=10.175.96.146 AND dest=10.175.96.147 AND dest= 10.175.96.148 AND dest=10.175.96.149 AND dest=10.175.96.150 AND dest=10.175.96.183) How can I change my current search to search on multiple inputted values? Thanks as always 🙂 ... View more

Hi, I have a dashboard where the data is coming from a lookup called "ABC" which has 2 fields called "src_ip" and "dest_ip", respectively. On the same dashboard, I now need to add a textbook such that a user inputs 1 or more IP addresses, searches against BOTH the "src_ip" and "dest_ip" fields on the lookup, and this filters the final results on the dashboard.   The issue I am having is all the IP address are string values and I am having trouble refining the search as this is the error I am currently getting:  Error in 'where' command: The expression is malformed. An unexpected character is reached at '*) OR like(dest_ip,*)'. So, a search like this works for me: | inputlookup ABC | where like (dest_ip,"10.175.96.146 10.175.96.147 10.175.96.148 10.175.96.149 10.175.96.150 10.175.96.183").   I am unable to search against both these "src_ip" and "dest_ip" when using a token though for an input like this: <query>| inputlookup ABC | where like(src_ip,$srcip_tok$) OR like(dest_ip,$srcip_tok$) </query>   Can you please help? Thanks as always ... View more

On Splunk, I have the following 2 searches: 1) `ABC_logs(traffic)` user != "unknown" src_ip IN (*) dest_ip IN (*) | stats values(src_ip) values(src_zone) values(dest_ip) values(dest_port) values(app) values(transport) values(session_end_reason) values(user) by host rule action | rename values(*) as * | dedup src_ip, dest_ip | rename src_ip as device_ip_address | fields device_ip_address, dest_ip, user, host [search index=DEF sourcetype = asset_registry_2 | dedup device_ip_address | fields device_ip_address, host ] AND 2) | inputlookup laso_lab_networks.csv | join type=inner LAB_ID [| inputlookup laso_lab_firewalls.csv | eval Firewall = split(Firewall, ",") | mvexpand Firewall] | dedup Firewall | eval Firewall = mvindex(split(Firewall, "."), 0) | fields LAB_ID, Lab_Mgr, Firewall I need to write a single query that would LINK both these queries such that the field "Firewall" from search 1 is joined to the field "host" from search 2.  I appreciate any help you can offer ... View more

Hi, On Splunk, I have a macro called `ABC` . I use this macro in the first search like this: `ABC` | stats values(src_ip) values(src_zone) values(dest_ip) values(dest_port) values(app) values(transport) values(session_end_reason) by host rule action | rename values(*) as * | rex field=host "(?<host_new>[^\.]+?)(?:\.[01]|\.02)?\." I also have a second Splunk search as follows: | rex field=Device_FQDN "(?<Device_FQDN>[^\.]+?)(?:\.[01]|\.02)?\." I need to JOIN BOTH searches using the field "host_new" from the first search and the field "Device_FQDN" from the second search as the common fields to perform the JOIN on. What would the Splunk query be in this case, using both searches I have supplied and where the first search uses a macro? Many thanks, P ... View more

Hi, When running models on the machine learning toolkit, I am currently receiving the following error: Error in 'fit' command: (AttributeError) module 'time' has no attribute 'clock' How can I resolve this issue? Thanks ... View more

Hi, I need to set a condition in Splunk for how the business quarters are set up in my place of work. In my job, the new financial year starts each year on February 1st. The 1st quarter is between February to April inclusive, the 2nd quarter is May to July inclusive, the 3rd quarter is August to October inclusive, and the 4th quarter is November to January inclusive. Currently I have this Splunk query: index=_internal earliest=-1y latest=now | eval month=strftime(_time, "%m") | eval quarter = case( month>=2 AND month<=4, "Q1", month>=5 AND month<=7, "Q2", month>=8 AND month<=10, "Q3", month>=11 OR month<=1, "Q4" ) | eval year = if(month>=2, strftime("%y", relative_time(now(), "@y")+1."y"), strftime("%y", now())) | eval quarter = "FY" . year . quarter However, I am receiving the following error: Error in 'eval' command: The expression is malformed. Expected ).   How can I set a new field called "Quarter" with this information  this in a Splunk command or query? Many thanks as always! ... View more

Hi, In Splunk, I have a dashboard with 2 separate searches. I need to connect both these searches such that the first search has a drilldown that, on click by the user, it runs the 2nd search. The first search finds the number of "dv_parent" events for last quarter and it outputs a bar chart of the number of "dv_parent" events per quarter. The 2nd search shows the individual events per "dv_parent" events for last quarter. Currently, both searches are not connected and I need to connect both with the drilldown. Here is the XML for the dashbord: <form> <label>FCR Peer Review Dashboard</label> <fieldset submitButton="false"> <input type="time" token="timeframe"> <label></label> <default> <earliest>-7d@d</earliest> <latest>@d</latest> </default> </input> <input type="text" token="assign_tok"> <label>Name Assigned to Ticket</label> <default>*</default> <initialValue>*</initialValue> <prefix>businessemail ="</prefix> <suffix>"</suffix> </input> </fieldset> <row> <panel> <title>Number of FCR changes per quarter</title> <chart> <search> <query>index=servicenow sourcetype="snow:sc_task" dv_assignment_group="SECURITY-NETWORK-L3" description="Request for Dell firewall changes." earliest=-3mon@mon latest=@mon | stats latest(*) as * by dv_parent | eval _time = strptime(dv_sys_updated_on, "%Y-%m-%d") | eval Quarter=strftime(_time,"%Y" . "Q" . ceil((tonumber(strftime(_time,"%m"))+12)/4)) | stats count by Quarter</query> <earliest>-3m@y</earliest> <latest>now</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <table> <title>FCR Peer Review</title> <search> <query>index=servicenow sourcetype="snow:sc_task" dv_assignment_group="SECURITY-NETWORK-L3" dv_state="Closed Complete" description="Request for Dell firewall changes." | table _time, description, dv_parent, dv_state, dv_assigned_to | dedup dv_parent | eval assigned_user=round(random() % 74, 0)+1 | lookup id_lookup.csv businessemail as businessemail | lookup temp_id.csv dv_parent OUTPUT dv_assigned_to as already_assigned | eval assigned_user=coalesce(already_assigned, user)</query> <earliest>-1y@y</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> Can you please help by altering this dashboard with the necessary drilldown with the "dv_parent" fields as token for the drilldown???? Many thanks, ... View more

Hi, I currently has a barchart like this which shows the number of requests per business quarter: Here is the respective query: index=servicenow sourcetype="snow:sc_task" dv_assignment_group="SECURITY-NETWORK-L3" description="Request for Dell firewall changes." | stats latest(*) as * by dv_parent | eval _time = strptime(dv_sys_updated_on, "%Y-%m-%d") | eval Quarter=strftime(_time,"%Y" . "Q" . ceil((tonumber(strftime(_time,"%m"))+1)/4)) | stats count by Quarter I need to alter this query to ONLY show the previous quarter, i.e. FY23Q4, After 1 week from today, the next quarter will start, so the bar chart will change to ONLY FY24Q1. Can you please me with this updated query? Many thanks, ... View more

Hi, I have the following query to detect outliers in eps: index=_internal sourcetype=splunkd component=metrics group=per_source_thruput series="*syslog-ng*" host=*hf* | eval hfgroup=substr(host, 0, 5), eps=eps/2, NodeName=UPPER(mvindex(split(host, "."), 0)) | lookup Cybersecurity_Infrastructure NodeName OUTPUT NodeID | bucket _time span=1h | timechart span=1h sum(eps) as Eps | eval HourOfDay=strftime(_time, "%H") | eval BucketMinuteOfHour=strftime(_time, "%M") | eval DayOfWeek=strftime(_time, "%A") | streamstats avg(Eps) as avg stdev(Eps) as stdev by HourOfDay BucketMinuteOfHour DayOfWeek | eval AbsDev = abs(Eps - avg) | streamstats avg(AbsDev) as MAD stdev(AbsDev) as MADStdev by HourOfDay, BucketMinuteOfHour, DayOfWeek | eval UpperBound = avg + (3 * MAD) | eval LowerBound = avg - (3 * MAD) | eval isOutlier=if(Eps > UpperBound OR Eps < LowerBound, "true", "false") | where isOutlier="true" However, I need the output to be just 1 trend line, representing Time, with outliers represented as red dots at the time of occurence. Currently, I am receiving all these unnecessary ;ine with no red dots representing outliers: Can you please help? Many thanks! ... View more