Does this app https://splunkbase.splunk.com/app/2646  Support RSS JSON Feed  from vendors? ... View more

@PrewinThomas  Just confirming Will it capture warcraft-9.0.78\logs\* ... View more

@livehybrid  Just confirming Will it capture warcraft-9.0.78\logs\* ... View more

Thank you @livehybrid  I see yeah I just copied someone else post for their input.conf example https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-with-wildcards/m-p/59916 but my main focus was the Monitor line ... View more

Thank you @PrewinThomas  I see yeah I just copied somonelses post for thier input.conf example https://community.splunk.com/t5/Getting-Data-In/Inputs-conf-with-wildcards/m-p/59916 but my main focus was the Monitor line ... View more

@livehybrid  for your comment"Without the original data its a little hard to say" Will this work? index="xxxx"   field.type="xxx" OR index=Summary_index | eventstats values(index) as sources by trace | where mvcount(sources) > 1 | spath output=yyyId path=xxxId input=_raw | where isnotnull(yyyId) ANDyyyId!="" | bin _time span=5m AS hour_bucket | stats latest(_time) as last_activity_in_hour, count by hour_bucket, yyyId | stats count by hour_bucket | sort hour_bucket | rename hour_bucket AS _time | timechart span=5m values(count) AS "Unique Customers per Hour" Still doesnt return any results ... View more

@livehybrid  Question: In your search you would struggle to achieve timechart because you dont have _time at this point? Respond: I see how can I achieve this? Question: If possible please give us further info we can help with this. but it would be good if you could confirm the field which links them? Is it trace? Answer: Yes it is trace ... View more

@ITWhisperer  im getting this no results   ... View more

@livehybrid  Yes its Trace ID ... View more

@yuanliu  Good Morning I've updated the Search query, let me know if anything needs to be adjusted. So far the Alert is not firing. My index search is looking for something  that doesn't exist so it should always alert unless I update the Lookup table to today's date(5/27/2025) to mute.   ... View more

@yuanliu  hi so I only want to suppress alert on the dates of the lookup table. The condition for the alert is to fire if the resulted does not equal to 1 If your pointing out my screen shot please let me know which to adjust to the correct format so I can try implement it correctly.   ... View more

@gcusello  tried this is it suppose to return the lookup table? and it Still Alerted   Only for discussing: what do you want to check? So  the Goal here is to check if there is More than 1 Event Alert if there is 0 Event Alert Issue currently facing Currently the Search is look at 0 event so on default it will always alert because there is 0 event What I am trying to test is the Mute in effect. on the Lookuptable Ive added Today's date to see if it will take in effect and looks like I am still being Alerted. Looking for answers to fix the Alert to MUTE on the Dates ive included in the lookuptable ... View more

@yuanliu  I still get alerted, I added today's date so it should of Muted the Alert, but it didnt     ... View more

@livehybrid  Thank you so much for the feedback as to answering your question "Although I'm confused as to why you couldn't do this? index=xxxxxx | eval HDate=strftime(_time,"%Y-%m-%d") | search NOT [ | inputlookup Date_Test.csv | fields HDate ] | stats count | where count>0" Would this also help capture if there was 0 events?  The Goal is to have the Alert Trigger anything except 1 event , so !=1  . It needs to alert if  there is 0 events found OR more than 1 event. Either way I have a scenario where there is 0 events BUT! Its a Mute date on my Lookup table and it still fired an alert. Its either that or because its was a Mute date that there might have been 1 event but since its a Mute date it changed it to 0 event Still causing the Alert to fire. Let me know if you need more clarification and I can post what I have setup ... View more

@gcusello the Alert still fired     ... View more

@gcusello "at first check that the date format is the same both in events (after eval command) and in lookup" This is what I have in the look up   ... View more

Thank you @gcusello  appreciate the feedback. I'm just having trouble understanding why my alert fired when it was not suppose to. I do not know where to start troubleshooting, but I will accept your answer to the original question ... View more

Quick question  so lets say we use your query. When muted on the day of lets say 4/25 and there was an event that happened that day does the alert the say: there no results that return therefore it will not fire the alert. I am trying to figure why my alert fired on of the the dates that my lookup table has chose to mute. this is my alert settings cron schedule to search  0 6 * * 1-5  so its monday-friday but yet the alert fired on a day that it was suppose to mute. I was wondering could the trigger condition be the root cause? since there was no results returned and so the trigger alert came to a conclusion no results is also != 1       ... View more