Hello,  I have lookup table which contain fields as below.   user                       shortname email 1                     name1 email 2                     name2 I wanted to search specific index and find whether the users in the lookup table logged in to any app for past 1 month.   I am trying something like this and not getting exact match with users in the lookup table. Please help here.   | inputlookup users_list.csv |join user type=outer [|search index="my_index" sourcetype="my_sourcetype" | fields app action signinDateTime user shortname ] |table app action signinDateTime user shortname ... View more

Hello Team,    How to search specific app user successful and failure events by month for Jan to Dec? Base search,   index=my_index app=a | table app action user |eval Month=strftime(_time,"%m") |stats count by user Month I am not getting any result by above search.     ... View more

Hello all, When we try to create a Cisco AMP4ep input, it is not allowing us to create one. The save button isn't working, see attached. I tried to create the input, but it is not working either. See the attachment. Splunk Version : 9.0.4.1 Cisco AMP for endpoints input version : 3.0.0 Current input(created manually) ------------------------------------------- [amp4e_events_input] api_host = api.amp.cisco.com api_id = API pin disabled = 0 eai_app_name = search eai_user_name = admin rcvbuf = 1572864 [amp4e_events_input://SPLUNK] api_host = api.amp.cisco.com api_id = api pin index = my_index source = amp4e_events_input://cisco_amp sourcetype = cisco:amp:event stream_name = Splunk_amp4ep   Can anyone help with the correct input? Regards, Nav ... View more

Hello All, I want to create an alert to find certain actions done by users from same Index. Index= myindex sourcetype= mysourcetype action = "session Start" and action=user added Note : From the above actions, the common field are "SessionID"  and user information is only in action=user added.  How to find who started the session based on time?  |table sessionID user src_host  src_ip _time ... View more

Hi All, How to find more than 3 heartbeat failure with failure reason from same host in a day  and put in a table? I am currently using below search, Index="my index" sourcetype="my sourcetype" action="heartbeatfailure"  |bucket _time span=day |stats count by _time host action failure_reason |where count>2  As the failure reason is different i am unable to get result for the same host in  past 24 hrs.  How to get stats count by _time, host, action with failure_reason in same table? ... View more