Hi @pavanae, Maybe the following will work for you. It uses rex/sed to locate the placement location, and inserts a placeholder (#LINK#, but you can replace this with what you deem "safe" in this context). After that an eval command replaces that placeholder with the needed value: | rex field=Details mode=sed "s/(Product\s1:-\s[^\n]+)(\n)/\1\n#LINK#\n/" | eval Details=replace(Details, "#LINK#", link) I'm not sure if you can do this in an single rex line (maybe something like $link or ${link}), I can't find anything about it in the documentation. ... View more

Hi @yk010123, you can map a lookup file to the status codes using the following command:   | lookup http_status_codes_lookup.csv status OUTPUT description   This assumes you have a lookup file containing the fields status and description. If you don't yet have a lookup, you can add one through settings, lookups. You could start by getting a prefilled csv file at iana: https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml or https://www.iana.org/assignments/http-status-codes/http-status-codes-1.csv You can read more about adding lookups over here: https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Usefieldlookupstoaddinformationtoyourevents ... View more

The format of your data example varies a lot. Writing a pattern for those specific examples would be possible, but that doesn't guarantee that it will work predictable for the rest of your data.  I've tested the following pattern on the three given examples:   | rex field=_raw "(?<ApplicationName>.+)\s(?<ApplicationId>[\w-]+)\s(?<ApplicationType>[\w-]+)\s(?<StartTime>\w{3}\s\w{3}[\d:\s]+[A-Z]+\s\d{4})\s(?<EndTime>\w{3}\s\w{3}[\d:\s]+[A-Z]+\s\d{4})\s(?<FinalState>[A-Z]+)\s(?<Queue>[^\s]+)\s((?<QueueUtilization>[^\s]+)\s)?\w+$"    You can see it parsing your examples on regex101: https://regex101.com/r/AkNmTb/1 Apart from predictability, having to implement all those edge cases makes it an inefficient and relatively slow pattern. ... View more

Hi @Borys, Instead of the chart command, you could first combine relevant data. Maybe this will work for you? ... | stats count by EndPoint,Code | stats sum(count) as sum, values(EndPoint) as EndPoints by count, Code | rename sum as count | nomv EndPoints | chart sum(count) by EndPoints,Code | fillnull value=0 After the initial stats command the above block groups again but by count and code, keeping endpoint values and the related sum. The nomv command is needed to flatten the result of the EndPoints, so the chart command can't split that result again. The final command fills the remaining empty values. I've tested the above with the makeresults command: | makeresults format=csv data="EndPoint,auditJsonMessage.Code /test1,200 /test1,200 /test2,400 /test2,200 /test3,201 /test3,303 /test4,201" | rename auditJsonMessage.Code as Code | stats count by EndPoint,Code | stats sum(count) as sum, values(EndPoint) as EndPoints by count, Code | rename sum as count | nomv EndPoints | chart sum(count) by EndPoints,Code | fillnull value=0 Which gave me the following output:   ... View more

Hi @srv007  If I understood correctly, the example data is the _raw value for each row? If you want to solve this search time, you could try to use the extract command: | extract kvdelim="-" pairdelim="\n" Note that the default behavior of the command is set to a max of 50 kv pairs and it that it only works on the _raw field. You can read more about the command over here: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Extract If the above data is not contained in the _raw field, could you reply with an example of a data row? ... View more

Weird. The only reason I can think of why this wouldn't work is sorting. Have you tried sorting your results descending before applying the rest? | sort -_time | stats dc(Host_Auth) as unique_count, last(Host_Auth) as last_auth by IP | where unique_count>1 AND last_auth="Unix Failed"  The last function used in the stats command takes the last known value by IP, so if your results aren't sorted correctly that could mess things up. ... View more

Sorry for the confusion. You can ignore the makeresults command, I use it in my example to simulate the example data you provided. So it would look something like this: .. your original search, containing the fields _time, Host_Auth and IP .. | stats dc(Host_Auth) as unique_count, last(Host_Auth) as last_auth by IP | where unique_count>1 AND last_auth="Unix Failed"         ... View more

I added the makeresults command to generate my testdata, you should replace that line with your own search. ... View more

Hi @atebysandwich, counting the unique values in Host_Auth by IP and checking the last state may be sufficient: | makeresults format=csv data=" IP,Host_Auth,_time 1.1.1.1,Unix Successful,2023-04-23 00:00:00 1.1.1.1,Unix Successful,2023-04-16 00:00:00 2.2.2.2,Unix Failed,2023-04-23 00:00:00 2.2.2.2,Unix Successful,2023-04-16 00:00:00 3.3.3.3,Unix Successful,2023-04-23 00:00:00 3.3.3.3,Unix Failed,2023-04-16 00:00:00 4.4.4.4,Unix Failed,2023-04-16 00:00:00 4.4.4.4,Unix Failed,2023-04-23 00:00:00 " | stats dc(Host_Auth) as unique_count, last(Host_Auth) as last_auth by IP | where unique_count>1 AND last_auth="Unix Failed"  I've added two more scenarios, so: Success > Success (no result) Fail > Success (no result) Success > Fail (result) Fail > Fail (no result) Is this what you're looking for? ... View more

@POR160893I think you were almost there. | eval year = if(month>=2, strftime(relative_time(now(), "@y+1y"), "%y"), strftime(now(), "%y")) | eval quarter = "FY" . year . quarter  Changes: Combined the "@y+1y" into a single string (that was the error) Switched arguments in strftime (first the date, then the format) ... View more

Hi @supersnedz, you can follow up timechart with the timewrap command:   | timewrap 1w You can read more about timewrap over here: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap ... View more

Based on the test data you're giving I had to fill some blanks, but if you want to detect a change only, the following could suffice:   | makeresults format=csv data=" _time,host,qid 2022-04-19,host_a,105015 2022-04-26,host_a,70053 2022-04-19,host_b,38307 2022-04-26,host_b,105053 2022-04-19,host_c,70053 2022-04-26,host_c,70053" | stats dc(qid) as qid_count, last(qid) as last_qid by host | where qid_count>1 AND (last_qid="38307" OR last_qid="105053")   So the "stats dc" counts unique qid values by host, where there's more than 1 value it has changed. If you want to detect its last attempt has failed" the last_qid field could be compared to known fail states. ... View more

I’m not sure if that type of grouping could work. Edit; tested it to be sure. You can use the IN operator with search, but not with where (https://docs.splunk.com/Documentation/SCS/current/SearchReference/SearchCommandExamples#4._Using_the_IN_operator). Because the "len" command the above suggestion uses where. Depending on if the data needs to be live you could try scheduling the sub search into a lookup or chain searches using the id and base attribute. About the chain searches, if performance is an issue and your dashboard panels use the same data source, you could ensure the heavy duty stuff only happens on page load by doing something like this: <search id="base_search"> <query> index=... ``` Apply resource heavy filtering here, which should only be executed on page load ``` </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <search base="base_search" id="filtered_search"> <query> ``` Apply dashboard token filtering here ``` | where name IN ($field1$) </query> </search> <row> <panel> <event> <search base="filtered_search"> <query> ``` Apply panel transforms here, repeat in multiple panels ``` ... </query> </search> </event> </panel> </row>   ... View more

Seeing you specifically want the subset filtered, using a wildcard will not help narrow anything down. Bit of a workaround, but maybe the following helps achieving your goal: Change the initial value to an empty value Filter your search by applying your sub-search Apply the filter field when selected So, something like:   .. <initialValue></initialValue> <choice value="">All</choice> .. <query> index="AnIndex" level="warn" ``` Filter by applying a subsearch ``` | search [ | search index="AnIndex" type="FilterType" | fields resultValue ] ``` Filter again when $mytoken$ is not empty and matches myToken ``` | where len("$mytoken$")=0 OR myToken="$mytoken$" | stats count(message) </query>   ... View more

That's a more effective pattern (148 vs 178 steps), use @richgalloway's pattern :)! ... View more

The match continues until the second instance of “scriptnameend”. The following pattern uses a lookahead, so it should break at the first instance of “scriptnameend”:   | rex field=_raw "scriptnamestart(?<ScriptName>.+?(?=scriptnameend))scriptnameend"    I tested the above, it returns “receiving_S02_sat_Get”. ... View more

OK, so are you adding the lines on _time or your formatted time? In your original question you added the following line:   | eval Last_Scanned = strftime(time, "%F")   %F = Equivalent to %Y-%m-%d (the ISO 8601 date format). The command max and the comparison with relative_time are expecting a timestamp, not formatted time. So you can either use the original timestamp or use strptime to transform it back. See the following docs for more information. strptime: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/DateandTimeFunctions#strptime.28.26lt.3Bstr.26gt.3B.2C.26lt.3Bformat.26gt.3B.29 relative_time: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/DateandTimeFunctions#relative_time.28.26lt.3Btime.26gt.3B.2C.26lt.3Bspecifier.26gt.3B.29 Formats: https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Commontimeformatvariables#Time_variables ... View more

That’s a good question. When you save a search in the dashboard UI it gets stored encoded, e.g. Splunk translates > into &gt; so the search doesn’t break the underlying XML. You can see this happening when you inspect the XML after editing a search.  This should work fine in most cases, but maybe something is happening with token replacements? Those also use $. What happens if you execute the search with the magnifying glass in the bottom of the panel, is the pattern still the same? ... View more

Hi @bitnapper, Assuming you're creating XML dashboards, you could also try using CDATA. Edit the dashboard (go to the raw view), go to the search that you want to edit and wrap it in CDATA. An example:   <search> <query> <![CDATA[ ``` Your search here. Because of cdata there's no need to escape text. ``` ]]> </query> </search>   You can read more about cdata at MDN or wikipedia: https://developer.mozilla.org/en-US/docs/Web/API/CDATASection https://en.wikipedia.org/wiki/CDATA ... View more