@rbal_splunk   ... View more

Can you brief more how its possible to reorder the col of viz  by xml if possible.   ... View more

yeah its generates. but my table is ( |table 300 200 hi  ). The viz comes in the format as 300    200     hi     --- number first followed by alphabets.... but i want to sort the viz format something like hi  200 300.   ... View more

Tried using table command to sort the visualization. The required format is not reflect in Parallel Co ordinates visualization. The numerical comes first , as before. ... View more

Hi , Would you please help me , how to change the time interval in threat Intel Management. ... View more

it didn't worked XD.. let me brief in detail !! Look at the Sample log: Event1: test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you" Event2:  test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you" if trying to extracting the field Splunk (set as required) with its value "siem" from the above log the field is perfectly extracted in event 1with its correct value siem but in the second event the field  splunk is extracted where the value is keypair not siem...     Add tags     ... View more

I have integrated some log in Splunk... Need to extract the fields The log has two different set of  events Using the Regular expression i have tried to extract the field .. the Regular expression pick the field name and the value correctly on one set of events.. but for the another set of event the expected field name and value is not extracting properly.....   Sample log: test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you" test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you" test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you" test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you" test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you" test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you" test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you" test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you" test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you" test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you" test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you" ... View more

Thanks ! @richgalloway  Does it collects network relative issues from the endpoints ..  And will errors that occur during forwarding data will be recorded on _internal index The query is really a basic which bring up all the error events in the _internal index... Looking and working on some nice SQL like to calculate all the errors based on its type (parsing , Time Stamp,etc..) during the integration And  by analyzing the _internal index , there's a field named component with lot values which seems to be interesting .. if possible can you brief this field values.....   ----------- RestinLinux    ... View more