Hi all! Hoping you can help me out. We are setting up an alert in splunk that will feed into servicenow, that when triggered will allow us to reach out to our users whenever they lock themselves out instead of them calling through to IT desk. We don't want a snow alert to trigger every time they show up in the splunk seach however, instead if they have had an alert created in the last 4 hours for example they are not included and it only checks for new people in that time frame. After the time period has elapsed they can then be included in the alert again. I have the search to a point where it is finding the users with issues and creating a transaction so we are getting them at the point they would be calling us, just stuck on that last bit.  index=prd_example sourcetype=LogSource "host=Host* | transaction UserID EventDescription maxspan=4h | table UserID EventDescription LockoutTime FirstName LastName EventCode eventcount | where eventcount >= 3 | sort -_time Any help would be greatly appreciated. I'm not even sure if this can be done at the splunk level or needs to be done at the SNow end ... View more

Hey all! Hoping you can help. I am currently building a dashboard that will allow users to select a option from a dropdown menu, and then type in a username in order to see all events for that input for that user. I am in a bind however as the dropdown has several hundred options (unfortunately no way to slim that down) and I was wondering if there was a way to quickly and painlessly add the labels and inputs from a spreadsheet I have over into the dropdown, or if I have to go through and copy each of them individually. Any help would be greatly appreciated! ... View more

Hi all! I have been absolutely stumped by this and hoping you can help me out. I am trying to find users that have 2 different, distinct events that happen on the same day. One event can occur at any time of the day, and the second event occurs between 6-8 am. The closest I have gotten is: index=Info source=Trustme (EventCode=X OR EventCode=Y) | eval hour=tonumber(strftime(_time,"%H")) | where hour>=8 OR hour<0 | stats values(EventCode) as Event_Codes by User | search Event_Codes=X Event_Codes=Y This is clipping out users who have Event Y occur outside of that range, which I would like to avoid. Also, I want to cast this over a large period to test and make sure I'm capturing the right people, then I can hopefully set it up as an alert. Any help would be greatly appreciated! ... View more