Maybe a dumb question but its been making me mad, maybe im overthinking it. I have a very simple search: index=poc channel="/event/Submission_Event" | bucket _time span=$global_time.earliest$ | stats count by _time | stats avg(count) as AverageCount I just want the avg(count) over the timerange that is selected. So if they picked 7 days it would give the 7 day average, if they picked 24h then it would give the average over the 24 hours span so i can use it in a single viz visual.   I keep getting: Error in 'bucket' command: The value for option span (-24h@h) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value. because the token time is something like 24h@h which isnt feasible for token setting. How can i work around this? Any ideas? Thanks so much for the help! ... View more

Simple search but Im having issues nailing down what I want to see. This search returns all the views the logged in user owns. | rest splunk_server=local /servicesNS/-/-/data/ui/views | rename author as user| search [| rest /services/authentication/current-context splunk_server=local| fields + username | rename username as user] | rename eai:acl.app as App, eai:acl.perms.read as Permissions, title as View, label AS Dashboard | table Dashboard I would like to have it show all the views the logged in user has access to instead, not just the ones that are owned. Thanks for the help ... View more

Hello I have a search like     index=index1 | rename Number__c as EventId | append [search index=index2 sourcetype="api" ] | stats count by EventId | search count < 2     What it does is search 2 indexes for ids and counts them, expecting 2(1 from each index). What I would like to ensure is that when the count is less than the expected 2 that its only source is from the first search. Meaning that if there is only 1 record it is from the first portion of the search and not found in the second. In the table however I only want to show the EventId.   Thanks for the assistance! ... View more

Hello I am working on creating a search that eval's results and adds boolean strings. the results will then be passed as a token to later searches. The result of the search could be a single ID or multiple IDs. The idea is that the first panel lists IDs. The next panel in the dashboard will search an index but only for IDs from the first panel.  For example: Panel 1 index=db source=MSGTBL MSG_src="XXXX" MSG_DOMAIN="CCCCCCCC" "<messageType>AAA</messageType>" | eval MSGID1="MSGID="+MSGID+" OR" | table MSGID might give you a table of MSGIDs: MSGID=56454GF-5RT1KL-566IOS-FT5GFAS OR MSGID=56454GF-65WE-566IOS-5845UIK OR MSGID=SD8734-DFH745-DFHJ7867-GKJH8 OR I can then set that as a token like <done> <set token="tokMSGID1">$result.MSGID1$</set> </done>   The issue im having is that if there is only a single MSGID it will have an 'OR' at the end as well as the last result in a set of IDs would have the 'OR' at the end. Can anyone tell me search-wise how to handle this? Thanks!   ... View more

Hello I am working on creating a dashboard to monitor some data flow info. this dashboard will have many panels so I was thinking I could hide them all when loaded and then only display the ones that the user selects in a multiselect input(maybe a better way?). I am unsure how to accomplish this though or if it can even be done. Does anyone have any ideas on how I could accomplish this task? Thanks for the help! ... View more

Hello I am collecting data via AWS add on and what I have found is that my timestamp recognition isn't working properly. I have a single AWS input using the [aws:s3:csv] sourcetype. this then uses transforms to update the sourcetype based on the file name the data comes from. Config snips: props.conf   [aws:s3:csv] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = true FIELD_DELIMITER = , HEADER_FIELD_DELIMITER = , TRUNCATE = 20000 TRANSFORMS-awss3 =sourcetypechange:awss3-object_rolemap_audit,sourcetypechange:awss3-authz-audit-logs [awss3:object_rolemap_audit] TIME_FORMAT=%d %b %Y %H:%M:%S LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE_DATE = true FIELD_DELIMITER = , HEADER_FIELD_DELIMITER = , FIELD_QUOTE = " INDEXED_EXTRACTIONS = CSV HEADER_FIELD_LINE_NUMBER = 1 [awss3:authz_audit] TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3Q #TZ=GMT FIELD_DELIMITER = , HEADER_FIELD_DELIMITER = , FIELD_QUOTE = " INDEXED_EXTRACTIONS = CSV HEADER_FIELD_LINE_NUMBER = 1   transforms.conf   [sourcetypechange:awss3-object_rolemap_audit] SOURCE_KEY = MetaData:Source REGEX = .*?object_rolemap_audit.csv DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::awss3:object_rolemap_audit [sourcetypechange:awss3-authz-audit-logs] SOURCE_KEY = MetaData:Source REGEX = .*?authz-audit.csv DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::awss3:authz_audit     It seems that the data comes in at indextime from what I can see, even though I set recognition for each sourcetype. I believe that timestamping is happening at the initial pass into Splunk before it gets the transforms applied.   How can i set timestamping via the initial sourcetype if there are multiple formats for the sourcetype depending on the file? Since its not honoring the timestamp recognition setting post-transforms. Thanks for the help. ... View more

Hello I have some array data located within a field in my data. It comes from DBConnect and isnt exactly JSON. Im trying to figure out how to extract this data so I can make it useful but Ive gone through several iterations and have been unsuccessful so far. Hers a sample record(I picked a fairly long one for an example):       2023-08-02 08:23:28.000, CASE_ID="50031iIQAQ", STAGE="Initial", EVENT_TYPE="SS", SUBMISSION_DATE="2023-08-02 06:23:23.0", SUBMISSION_TYPE="Application INITIAL SUBMISSION", DESTINATION=""Application ", SUBMISSION_DATA="{ "submissionType": "Application INITIAL SUBMISSION", "submissionDate": "2023-08-02 06:23:23", "stage": "Initial", "repository": "central", "xxxxMessage": { "header": { "timeStamp": "2023-08-02 06:23:24", "source": "XXXXX", "messageType": "XXX CCC SSS", "domain": "APPLICATION/SUBMISSION" }, "body": { "submissionUnit": { "field": [ { "value": "500871iIQAQ", "name": "sourceId" }, { "value": "CCC VVVV", "name": "submission_unit_type" }, { "value": "1", "name": "submission_unit_number" }, { "value": "2023-08-02 06:23:23", "name": "submit_date" }, { "value": "2023-08-02", "name": "xxxx_received_date" } ] }, "submission": { "field": [ { "value": "5000871iIQAQ", "name": "sourceId" }, { "value": "00132546", "name": "submission_event_id" }, { "value": "XXXX", "name": "submission_type" }, { "value": "1", "name": "submission_number" }, { "value": "Pending", "name": "submission_status" }, { "value": "2023-08-02", "name": "submission_status_effective_date" }, { "value": "TTTT 1", "name": "xxxxx_xxxxxx" }, { "value": "String of data goes here", "name": "proposed_change" } ] }, "referencedMonographs": { "referencedMonograph": [ { "field": [ { "value": "a001YmysUAC", "name": "sourceId" }, { "value": "XXX2", "name": "ref_monograph_number" }, { "value": " String of data goes here", "name": "ref_monograph_description" } ] } ] }, "organizations": { "organization": [ { "field": [ { "value": "a07000nMzDQAU", "name": "sourceId" }, { "value": "String of data goes here", "name": "organization_name" }, { "value": "117185493", "name": "xxxx_number" }, { "value": "12071", "name": "company_global_id" }, { "value": "Requestor", "name": "contact_type" }, { "value": "String of data goes here", "name": "address_line1" }, { "value": "CityName", "name": "city" }, { "value": "US", "name": "country" }, { "value": "XX", "name": "state" }, { "value": "XXXXX-AAAA", "name": "postal_code" } ], "contact": { "field": [ { "value": "a07nMzDQAU", "name": "sourceId" }, { "value": "Requestor", "name": "contact_type" }, { "value": "XXXX", "name": "first_name" }, { "value": "CCCC", "name": "last_name" }, { "value": "2221112222", "name": "phone_number" }, { "value": "test@test.com", "name": "email_address" }, { "value": "1111 NW 1st St", "name": "address_line1" }, { "value": "CCCCC", "name": "city" }, { "value": "United States", "name": "country" }, { "value": "CD", "name": "state" }, { "value": "11111", "name": "postal_code" } ] } } ] }, "ingredients": { "ingredient": [ { "field": [ { "value": "a041R8IbQAK", "name": "sourceId" }, { "value": "XXXXXXXXX", "name": "sssss_aaaaaa" }, { "value": "U8LYN0Y118", "name": "CCCC" }, { "value": "311218848", "name": "wwwwww_global_id" }, { "value": "String of data goes here", "name": "XXXXX_strength" }, { "value": "XX", "name": "numerator_unit" }, { "value": "12.00", "name": "numerator_strength" }, { "value": "1", "name": "denominator_unit" }, { "value": "1.00000", "name": "denominator_strength" }, { "value": "40", "name": "CCCCCC" }, { "value": "Month", "name": "xxxxx_frequency" }, { "value": "String of data goes here", "name": "age_group" }, { "value": "String of data goes here", "name": "xxxxx_form" }, { "value": "xxxxx", "name": "xxx_xxxx_xxx" }, { "value": "xxxxxx/ccccc", "name": "xxxxx_class" }, { "value": "0117984AB", "name": "xxxxx_xxxxx" }, { "value": "U8LY118", "name": "xxxxx_value" }, { "value": "xx", "name": "xxxxx_type" } ] } ] }, "xxxx_event_id": "00132542", "contacts": { "contact": [ { "field": [ { "value": "a070nMzEQAU", "name": "sourceId" }, { "value": "String of data goes here", "name": "contact_type" }, { "value": "XXXXXXXX", "name": "first_name" }, { "value": "CCCCCCCC", "name": "last_name" }, { "value": "+12223334444", "name": "phone_number" }, { "value": "test@test.com", "name": "email_address" }, { "value": "321 Drive", "name": "address_line1" }, { "value": "XXXXXXXXX", "name": "city" }, { "value": "United States", "name": "country" }, { "value": "VVVVVVV", "name": "state" }, { "value": "11111", "name": "postal_code" } ] } ] }, "attachment_metadata": { "total_attachment_count": 1, "application_attachment": { "type": "application", "submission_attachment": { "sub_submission": [ { "name": "String of data goes here", "attachment_count": 1 } ], "name": "String of data goes here" }, "name": "CCCCC" } }, "application": { "referencedMonographs": { "referencedMonograph": [ { "field": [ { "value": "a0Z3S000001YmynUAC", "name": "sourceId" }, { "value": "M009", "name": "ref_monograph_number" }, { "value": " String of data goes here", "name": "ref_monograph_description" } ] } ] }, "field": [ { "value": "5003872puQAA", "name": "sourceId" }, { "value": "XXXXX", "name": "application_type" }, { "value": "12345678", "name": "application_number" }, { "value": "Pending", "name": "application_status" }, { "value": "2023-08-02", "name": "application_status_effective_date" }, { "value": "Requestor", "name": "requestor_role" }, { "value": "test1", "name": "application_justification" } ] } } }, "eventType": "WE", "documentDestination": "Applications", "caseID": "5003871iIQAQ", "attachments": [ { "type": "docx", "storageLocation": "/XXXX/Data Stored HEre", "processedInd": "N", "name": "Test 3.docx", "fileSize": "11885", "fileId": "0683S000001o43hQAA", "file_metadata": [ { "value": "String of data goes here", "key": "docCategory" }, { "value": "1.1", "key": "sectionNumber" }, { "value": "Table of Contents", "key": "sectionName" }, { "value": "5003iIQAQ", "key": "sourceId" } ], "contentVersionId": "xxx/cccc/dddddd/0693hQAM/0683001QAA/Test 3.docx" } ] }", XXXX_MESSAGE_ID="7eewrty6e9-00ea-4e58-981f-3cn56igb82f", CREATED_BY="XXXX_CCC_APP", CREATED_DATETIME="2023-08-02 09:23:25", MODIFIED_BY="XXXX_CCC_APP", MODIFIED_DATETIME="2023-08-02 09:23:28", PROCESSED_STATUS="success"         Anyone have any ideas how I might accomplish getting the SUBMISSION_DATA field extracted properly? Thanks for the help ... View more