yes it doesn't work . shows nothing ! ... View more

Hi in Edit Alert ->"Trigger Conditions" -> Trigger you must select "Once" option instead of "For each result" ... View more

index=MyIndex  EventCode IN (4728,4729,4730) user=* | eval time=_time | convert ctime(time) | eval msg="A user "+user+" was "+action+" on the host "+host+" by "+src_nt_domain+"\\"+src_user+" at "+time |table msg,EventCode,action,user,signature,status ... View more

|mvexpand fieldA  |mvexpand fieldB |eval flag=if(match(fieldA ,fieldB),1,0) OR  |mvexpand fieldA  |mvexpand fieldB |eval flag=if(match(fieldB ,fieldA),1,0) ... View more

|mvexpand Account |eval flag=if(match(Account,user),1,0) |search flag=0 ... View more

|mvexpand Account |eval flag=if(match(Account,user),1,0) |search flag=0 ... View more

Hi you can use mvappend command to append 3 different fields as a fields: | inputlookup CUCM_lboro_assigned_numbers_27_6_22.csv | rename DN AS phone | search NOT [ search index=cucm  cdrRecordType=1 duration>0 |eval phone=mvappend(callingPartyNumber ,originalCalledPartyNumber , finalCalledPartyNumber ) |table phone] but I doubt that "search NOT" works for you ! ... View more

Hi I suppose that you need join command for example : index=index1 abc=123-678  def=678+943 , ghi=678-123 | fields abc,def,ghi | join type=inner abc,def,ghi  [| search index=index2] ... View more

Hi you should add append=T to tour outputlookup command  |outputlookup append=T test.csv did you di that ? ... View more

Hi, this must work  |rex field=a "stopped: "(?<pause>.*)" seconds," |where pause> 0 ... View more

OK. if you want to follow just creation, I have a best solution for you with lookup , to recognize new correlations : 1- first run this query just 1 time, to primitive lookup update:  | rest /services/saved/searches splunk_server=local count=0 | search author!="admin" AND action.correlationsearch.enabled=1            | table title,author            | eval flag=1            | outputlookup test2.csv 2-then make an alert or report and define a time schedule for that with this query to recognize new correlations created during alert/report time period (all titles that there is no flag=1 for them in lookup)  : | rest /services/saved/searches splunk_server=local count=0 | search author!="admin" AND action.correlationsearch.enabled=1             | table title,author             | lookup test2.csv title as title output flag             |search NOT flag=*             | eval flag=1             | outputlookup append=T test2.csv as a result this query list for you just new correlations , for example if your time schedule is every day at 7 AM, it lists for you all correlation searches were create between yesterday 7 AM - today 7 AM ... View more

Hello I checked It for new rules, it shows the date of creation  ... View more

Hi please put a picture or screenshot  ... View more

Hello Im working with splunk version 7.2.3 and I suppose that this query can help you : (instead of author!= admin ypu can list your favorite authors) | rest /services/saved/searches splunk_server=local count=0 | search author!="admin" AND action.correlationsearch.enabled=1            | stats values(updated) as updated , values(action.correlationsearch.enabled) by title,author            | sort - updated ... View more

Hi how many rows do your table have ? (6 rows ? or more ?) please put a screen shot hear (I think you must change Format visualization in your dashboard panel with replacing very smaller value) ... View more

dear friend your query doesn't show different conditions : one hand: (process="view.exe" OR netproc_process="remotemks.exe") and the other hand (process=*) !! first condition is a subset of second condition but I suppose that this must work for your target: | eval flag=if(process="view.exe" OR netproc_process="remotemks.exe",1,0) | stats sum(returnts_bytes) as returns_bytes by site,flag ... View more

for _internal index for example: | rest /services/saved/searches splunk_server=local count=0 | search cron_schedule!="* *" AND search="*index=_internal*" when there is no cron schedule for a saved search, it cant execute . ... View more

this must work : index=firewall |lookup my_special_lookup.csv  Field1 as firewall_string_field ... View more

this must work for you : |your code ... |search process="view.exe" OR netproc_process="remotemks.exe" | stats sum(retrans_bytes)  as retrans  by site ... View more