Yes. You can name multiple capture groups in one rex statement.  e.g. | rex field=my_field "foo:\s+\"(?<first_capture>[^\"]+)\",\s+bar:\s+(?<second_capture>[^\"]+)" ... View more

The CSV is not structured as a lookup table. The structure should be that, given a value for CPU1 (e.g. "process_a"), what are the (first matching) values for CPU2 ("process_b") and CPU3 ("process_c"). What you seem to be looking for is given a value for some CPU (e.g. "process_a"), to what CPU category does it belong ("CPU1"). Are you able to restructure the test.csv to be more like: Process CPU Class process_a CPU1 process_b CPU2 process_c CPU3 process_d CPU1 process_e CPU2 process_f CPU3 process_g CPU1 process_h CPU2 process_i CPU3   IF you can't restructure that file, something like this would work:   | makeresults | eval CPU=mvappend("process_a","process_a","process_b","process_a","process_c","process_a","process_b","process_d","process_a","process_e","process_a","process_b","process_c","process_a","process_a","process_b","process_d","process_a","process_c","process_a","process_b","process_e","process_a") | mvexpand CPU ``` The above is to generate sample data and can be ignored in your SPL ``` ``` uncomment the line below and notice the change from CPU1 to CPU ``` ```index=custom | eval SEP=split(_raw,"|"), eval CPU=trim(mvindex(SEP,1))``` ``` These two lines create aliases to map in the CPU group for each class in turn ``` | eval myCPU1=CPU | eval myCPU2=CPU ``` These next lines assume that a process will only appear once in the test.csv file. ``` ``` If that is the case, then CPU2 and CPU3 will be non-null when CPU1 matches, ``` ``` otherwise that process does not belong to CPU1 (and ditto for the CPU2 case.) ``` | lookup community CPU1 as myCPU1 | eval myCPU1=if(NOT isnull(CPU2),CPU,NULL) | lookup community CPU2 as myCPU2 | eval myCPU2=if(NOT isnull(CPU1),CPU,NULL) ``` Now create your stats on the two CPU classes. ``` | bin _time span=1m | stats count(myCPU1) as CPU1_COUNT count(myCPU2) as CPU2_COUNT by _time     ... View more

I believe that your scenario could be accomplished with Ingest Actions: https://docs.splunk.com/Documentation/Splunk/9.2.1/Data/DataIngest This should support cloning data and applying different filtering rules and routing to the two streams. ... View more

One possible solution would be to use a lookup (status_lookup) to keep track of the last known state.  This solution adds a host field so it can work for more than one host. Step 1: Create a KVStore (or file based) lookup with the fields "host", and "current_status" (Note: the solution below will also add an alert message field, but that 's more of a side effect.) Step 2:  Add the "host" group by clause, and lookup commands to your SPL: index=xyz sourcetype=xyz host=* | eval RespTime=time_taken/1000 | eval RespTime = round(RespTime,2) | bucket _time span=2m | stats avg(RespTime) as Average perc80(RespTime) as "Percentile_80" by _time host | eval Current_Server_Status=if(Percentile_80>=5, "Server Down", "Server Up") | lookup status_lookup host | eval alert=case(Current_Server_Status="Server Down",$host$+" is down", (Current_Server_Status="Server Up" AND Server_Status="Server Down"),$host$+" is back up") | rename Current_Server_Status AS Server_Status | table host Server_Status alert | outputlookup status_lookup You'll end up with a serach that outputs something like this (and updates the lookup for the next alert run): +---------------+--------------+------+ | Server_Status | alert | host | +---------------+--------------+------+ | Server Down | a is down | a | | Server Up | b is back up | b | | Server Up | | c | | Server Down | d is down | d | +---------------+--------------+------+ Note that host c has no alert message because it went from "up" to "up" with the sample data I used. ... View more

Retracted. @richgalloway 's solution will work. ... View more

In conditionals, use "like" instead:   | makeresults | eval msg.message=mvappend("Work Flow Passed | for endpoint XYZ","STATUS - FAILED") | mvexpand msg.message ``` SPL above is to create sample data only ``` | rename msg.message as message | eval Status=if(like(message,"%Work Flow Passed | for endpoint XYZ%"),"SUCCESS", "FAIL") | table _time, message, Status   It also helps to rename fields with paths to avoid the need for quoting them.  ... View more

There might be a more fluid way to do this, but one idea would be to make your alert a two-step process: 1) Add " | addinfo " to your search to get the search SID, and have the alert log an event with that SID instead of sending email.  2) Create the alert and make your alert decision by searching for the new event log, and either using the " | rest /services/search/jobs/<SID> ", or searching the _internal or _audit indexes to get metadata about that search. ... View more

Better late than never:  Sample data would be helpful here.  The request is a bit confusing since you seem to want the top 5 urls per status code, but your URL count stops at 10. With 3 status codes, the top 5 could go to 15, right? For the second point, what UserID  would that be? Presumably each URL could be hit by multiple users, and the top 5 codes for each URL would differ per user.  ... View more

Better late than never: This needs more information on what you consider month and week boundaries. Does "January, Week 1" mean the first 7 days of January, January 1st to the last day of the week (e.g. Saturday), or the Sunday before January 1st, to the following Saturday? When you say by week and month together, do you just want a label for the month in front of the 52 weeks?   ... View more

Better late than never: Assuming your windows host monitoring polls the hosts at regular intervals and logs a success or failure, and if you want a simple line chart with values 1 for up and 0 for down in some interval (say 10 minutes), you could do this: sourcetype=WinHostMon |  eval status_num=if(Status="up",1,0) |  timechart span=10m min(status_num) by Host ... View more

In the "better late than never" category of answers (and I realize this answer might not have been available in previous versions of Splunk)... It's unclear, from the original question, if the "ip:port" belongs to the service, or the client. If it belongs to the service, then every timeout uniquely identifies the service, and all that needs to be done is to count the timeouts, and then map in the service name: | makeresults | eval data="CONNECTION-1.1.1.1:1: connect() timeout,[service_with_2_timeouts] tearing down tcp connection [1.1.1.1.1],CONNECTION-1.1.1.2:2: connect() timeout,[service_with_1_timeout] tearing down tcp connection [1.1.1.2.2],[service_with_no_timeouts] tearing down tcp connection [1.1.1.3.3],CONNECTION-1.1.1.1:1: connect() timeout,[service_with_2_timeouts] tearing down tcp connection [1.1.1.1.1]" | eval mvdata=split(data,",") | mvexpand mvdata ``` Everything above this is to generate sample data ``` | eval is_timeout=if(like(mvdata,"%connect() timeout%"),1,0) | rex field=mvdata "CONNECTION-(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<port>\d+): connect\(\) timeout" | rex field=mvdata "\[(?<service_name>[^\]]+)\] tearing down tcp connection \[(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\.(?<port>\d+)\]" | stats first(service_name) as service_name, sum(is_timeout) as timeout_count by ip, port   If, on the other hand, the "ip:port" belong to the client accessing the service, this is a bit more complicated, with too many potential solutions depending on details not available here. ... View more

If I'm reading this right, you have data that has events with pods and their phases. In your example query, you appear to be using decimal values to create your ranges, but can we assume that the actual pos states fall on specific integers? Something like this might work:   | makeresults count=25 | eval phase=(random()%5)+1 ``` Everything above here is just to create sample data ``` ``` The following statement groups and counts phases. | stats count by phase ``` The following statement maps phases to a string equivalent ``` | eval label=case(phase=1,"A (Pending)", phase=2,"B (Running)", phase=3,"C (Succeeded)", phase=4,"D (Failed)", phase=5,"E (Stopping?)", 1=1,"Unknown")   If the phase values are not discreet, and the range you mention is necessary, then you can use a case statement like this:   | makeresults count=25 | eval phase=((random()%50)/10)+1 | eval phase_group=case(phase<1.5,1, phase<2.5,2, phase<3.5,3, phase<4.5,4, phase<5.5,5) | stats count by phase_group | eval label=case(phase_group=1,"A (Pending)", phase_group=2,"B (Running)", phase_group=3,"C (Succeeded)", phase_group=4,"D (Failed)", phase_group=5,"E (Stopping?)", 1=1,"Unknown")     ... View more

Joining the two searches would require some common field to join on. Since none exists in your example, you'll need to either add an identifier to all related logs at the source, or get creative with a solution based on time that could get finicky. For example, in your sample data, you have 3 events. The transaction ID in event 1 occurs 2 seconds before the error log. If there can be more than one concurrent transaction, then there doesn't appear to be a way to be certain that the correct transaction ID will be found that corresponds to error. e.g. 240614 04:35:50 Algorithm: Al10: <=== Recv'd TRN: AAA (TQ_HOST -> TQ_HOST) 240614 04:35:51 Algorithm: Al10: <=== Recv'd TRN: BBB (TQ_HOST -> TQ_HOST) 240614 04:35:52 Algorithm: TSXXX hs_handle_base_rqst_msg: Error Executing CompareRBSrules Procedure. 240614 04:35:52 Algorithm: TSXXX hs_handle_base_rqst_msg: Details of ABC error ReSubResult:-1,FinalStatus:H,ErrorCode:-1,chLogMsg:SQL CODE IS -1 AND SQLERRM IS ORA-00001: unique constraint (INSTANCE.IDX_TS_UAT_ABC_ROW_ID) violated,LogDiscription: In this case, does the error belong to transaction AAA or BBB? The second issue will be how much time can elapse between the "Rec'd TRN" log, and any possible error. Without a field linking these logs, you'll have to use some fixed time range to try to bring logs together. Too short, and you'll fail to find the transaction ID, too long and you might find multiple IDs (leading to the issue mentioned above). IF you can assume that logs are synchronous, and there is no interleaving of transactions, then something like this should work:   index=test_index source=/test/instance | sort _time | rex field=_raw "<=== Recv'd TRN:\s+(?<transaction_id>\w+)" | eval failure=if(like(_raw, "%ORA-00001%"), 1, 0) | filldown transaction_id | where failure=1 | table transaction_id, failure, _raw   ... View more

In my example, I use 3 backslashes when creating the sample data. To get \" in a quoted string, you need escape the backslash \\, and the quote \", resulting in \\\" In the regex, I avoided the need to match on backslashes, so any backslash is just the escape character. However, in my alternative method, you'll notice that there are 5 backslashes in a row. The processing of the escape characters happens once for the string itself, taking \\\\\" down to \\", and then once for the regex, taking \\" down to \".  ... View more

Have you tried a subsearch? index=myindex "TTY" [ search index=myindex cs2k_transaction_id_in_error="CHG063339403031900 major_code="ERROR" | rex field=_raw "Job Id: (?<jobId>.*?)\." | table jobId ] ... View more

I don't know this area well, but the error suggests an issue with "container", and not "update". Within your custom function you are using container, but it would seem it's not defined. How are you passing "container" into your function?  ... View more

Alternatively, you could use streamstats to build a list of files to match against: index=wealth OR index=transform-file OR index=ace_message earliest=-30m | rex field=_raw "inputFileName: (?<inputFileName>.*?)," | rex field=inputFileName "file\_(?<ID>\d+_\d+)\_" | streamstats values(eval(if(now()-_time<1800,ID,NULL))) as IDS | eval alertable=if((now()-_time>1800) AND (ID IN (IDS)),"True","False") | table _time, ID, IDS, alertable ... View more

Besides the approximate time (since the times don't match), there is nothing else to relate those two particular logs together? Will your search be used in the general case to output more than one row's worth of data? If so, how far apart are the various distinct transactions (or can that be arbitrarily short)? ... View more

Oh, I see. You could use a subsearch or a join:   index=wealth OR index=transform-file OR index=ace_message earliest=-30m | rex field=_raw "inputFileName: (?<inputFileName>.*?)," | rex field=inputFileName "file\_(?<ID>\d+_\d+)\_" | table ID | join type=inner left=L right=R where L.ID=R.ID [search index=wealth OR index=transform-file OR index=ace_message earliest=-30d latest=-30m | rex field=inputFileName "file\_(?<ID>\d+_\d+)\_" | table ID]   ... View more