Hi Splunk Experts, I've a lookup with field 'User', 'Rates' and 'Priority' (values 1 to 5). I use this lookup in my search, I wish to accomplish below Use cases. Kindly advice if it's possible. Cases: Lookup Priority value is '5', I've to get the max(Rates) from Priority Values 1 to 5. Lookup Priority value is '4', I've to get the max(Rates) from Priority Values 1 to 4. Lookup Priority value is '3', I've to get the max(Rates) from Priority Values 1 to 3. Lookup Priority value is '1', I've to get the max(Rates) from Priority Values 1. ... View more

Hi Splunk Experts, I've been trying to group "WARN" logs, but they have a pattern (Dynamic/ Argument values) in them. I'm aware of rex, but I don't want to manually rex for 1000s of such different events. I've even tried cluster, but that doesn't suits well my usecase. Any assistance would be much appreciated.!! Thanks in advance. 2024-08-31 12:34:56 WARN ConfigurationLoader - Deprecated configuration detected in path /xx/yy/zz. Please update your settings to use the latest configuration options. 2024-08-31 12:34:56 WARN ConfigurationLoader - Deprecated configuration detected in path /aa/dd/jkl. Please update your settings to use the latest configuration options. 2024-08-31 14:52:34 WARN QueryExecutor - Query execution time exceeded the threshold: 12.3 seconds. Query: SELECT * FROM users WHERE last_login > '2024-01-01'. 2024-08-31 14:52:34 WARN QueryExecutor - Query execution time exceeded the threshold: 21.9 seconds. Query: SELECT * FROM contacts WHERE contact_id > '252’. 2024-08-31 14:52:34 WARN QueryExecutor - Query execution time exceeded the threshold: 9.5 seconds. Query: SELECT * FROM users WHERE user_id = '123024001'. 2024-08-31 13:45:10 WARN MemoryMonitor - High memory usage detected: 85% of allocated memory is in use. Consider increasing the available memory. 2024-08-31 13:45:10 WARN MemoryMonitor - High memory usage detected: 58% of allocated memory is in use. Consider increasing the available memory. 2024-08-31 14:52:34 WARN QueryExecutor - Query execution time exceeded the threshold: 32.3 seconds. Query: SELECT * FROM users WHERE last_login > '2024-01-01'.   I wish to group them something like below to group similar events!! WARN  ConfigurationLoader Deprecated configuration detected in path. Please update your settings to use the latest configuration options  2 WARN  QueryExecutor Query execution time exceeded the threshold: . Query:  4 WARN  MemoryMonitor High memory usage detected: of allocated memory is in use. Consider increasing the available memory.  2 ... View more

Hi Splunk Experts, I'm not sure how easy it's using Splunk, I've a field (_time) with list of epoch_time values in it. I want to loop through each value and run a search using the time value in below query by replacing $_time$. Any advice would be much appreciated, Thanks in advance!! _time 1722888000 1722888600 1722889200 1722889800 1722890400 1722891000   index=main earliest=$_time$-3600 latest=$_time$ user arrival | timechart span=10m count by user limit=15 | untable _time user value | join type=left user [| inputlookup UserDetails.csv | eval DateStart=strftime(relative_time($_time$), "-7d@d"), "%Y-%m-%d") | where Date > DateStart]     ... View more