Hi everyone, I want to create an hourly alert that logs the multiple server's CPU usage, queue length, memory usage and disk space used.  I have managed to create the following query which helps me lists out my requirements nicely in the following image. (Note that in the image, the log is set to output every 5 minutes only, hence the null values in the image below)   index=* host=abc_server tag=performance (cpu_load_percent=* OR wait_threads_count=* OR mem_free_percent=* OR storage_free_percent=*) | eval cpu_load = 100 - PercentIdleTime | eval mem_used_percent = 100 - mem_free_percent | eval storage_used_percent = 100 - storage_free_percent | timechart eval(round(avg(cpu_load),2)) as "CPU Usage (%)", eval(round(avg(wait_threads_count), 2)) as "Queue Length", eval(round(avg(mem_used_percent), 2)) as "Memory Used (%)", eval(round(avg(storage_used_percent), 2)) as "Disk Space Used (%)"       For the next step however, I am unable to insert the host's name as another column. Is there a way where I can insert a new column for Host Name in a timechart as shown below? Host name _time CPU Usage Queue Length Memory Usage Disk Space Usage abc_server 2022-07-21 10:00:00 1.00 0.00 37.30 9.12 efg_server 2022-07-21 10:00:00 0.33 0.00 26.50 8.00 your_server 2022-07-21 10:00:00 9.21 0.00 10.30 5.00 abc_server 2022-07-21 10:01:00 1.32 0.00 37.30 9.12 efg_server 2022-07-21 10:01:00 0.89 0.00 26.50 8.00 your_server 2022-07-21 10:01:00 8.90 0.00 10.30 5.00   Thanks in advance.  ... View more

Hi everyone. I am a new user to Splunk.  Recently, I have met some trouble with trying to extract a certain message out from a field I want. I have a field called Message, which logs the message sent to a web server. However, I only want to retrieve a specific field when the message contains the desired field that I want.  Example: I want to retrieve the user's name when service is invoked.  Time Message 2021-05-15T01:51:52.321Z Session ID 1234 has been created 2021-05-15T01:51:52.321Z Invoked by user David from IP 127.256.25.16 2021-05-15T01:51:52.321Z Configuration Reading - Start   Hence, I only want to extract the name David, when that specific message log containing the name appears. Does anyone have any clue how I can extract that field specifically when it appears? Thanks in advance.  EDITED: Hey Splunk Users,  If you met the same problem as I did, where the message logs change constantly, do make sure to search for the message you are looking for first, before drilling down for the specific field.  In my case: | search Message="Invoked by user *" | rex field=Message "Invoked by user (?<user>\w+)" ... View more