thank you for the update, all the search head having same pem file.  ... View more

I have tried to get the index not used used any KO, but not getting all the details.  | rest /services/data/indexes | fields index | eval index=1 [index=_audit| stats count as accessed by index, search ] | stats sum(accessed) as accessed, values(index) as index by  | fillnull accessed value=0 | where index=1 AND accessed=0 Total Index Index Not used in Any Knowledge Object Index has 0 data last 90 days 100 25 10 ... View more

I am listing the index name using rest query and then checking those index name with audit or internal to to find if how many index used, sourcetype used, and HOW Many index not used in splunk.  Also i need to identify which indexes and sourcetypes have not received any data for a period exceeding 90 days. ... View more

the query is not getting expected result,  I need to get the list of index which is not used by anyone ... View more

the query is not getting expected result,  i was runining for last 90 days but didnt get the result.    ... View more

Thank you for your response, but your query is providing list of dashboard accessed and i am looking for number of unused/not accessed by anyone.  ... View more

thank you for your response, I have tried your query but not getting the user not logged in for last 7 days 30d or 90d. it showing total 0,i need to show by selecting the time range it should automatically show the result which user not logged into splunk web UI.  For example we have 100 account in user list, only 10 users are actively login in, remaining user need to identify the when they last logged into splunk.  ... View more

thank you for your response, I have tried your query but not getting the user not logged in for last 7 days 30d or 90d. By selecting the time range it should automatically show the result which user not logged into splunk web UI.  For example we have 100 account in user list, only 10 users are actively login in, remaining user need to identify the when they last logged into splunk.  ... View more

index=_internal source=/opt/splunk/var/log/splunk/license_usage.log type=Usage | stats sum(b) as bytes by st , idx | eval GB=round(bytes/(1024*1024*1024),6) | table st, idx, GB | sort -GB | eventstats sum(GB) as total | eval Percentage=round((GB/total)*100,6) | rename st as SourceType | rename idx as Index | stats list(SourceType) as "Source-Type", list(GB) as GB by Index | addtotals col=t row=f labelfield=Index label="Overall Total" ... View more

Please find teh below sample values Index Source-Type GB aws_vpcflow aws:vpcflow 10 aws:cloudwatchlogs:vpcflow 20 windows windows:fluentd 30 windows 40 WinEventLog:Security 50 cloud  cloud_watch 60 aws_cloud 70 ... View more

If i use the  | addtotals col=t row=f labelfield=Index label="Overall Total" , I am getting incorrect total result , becuase one index and multiple sourcetype values are there.  ... View more

Please let me know if you get an answer ... View more

I am looking for custom index in splunk not audit index used in choice.  I have extracted the idx st using rex in 3rd lineof my query, so i need to select either index=aws or sourcetype=aws;cloud in checkbox <form theme="light"> <label>Logical Test</label> <fieldset submitButton="true" autoRun="false"> <input type="multiselect" token="index"> <label>Index</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>index_name</fieldForLabel> <fieldForValue>index_name</fieldForValue> <search> <query>| REST /services/data/indexes |dedup title | rename title as index_name | table "index_name"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <delimiter>","</delimiter> <initialValue>*</initialValue> </input> <input type="multiselect" token="sourcetype_name"> <label>Sourcetype</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>sourcetype_name</fieldForLabel> <fieldForValue>sourcetype_name</fieldForValue> <search> <query>| tstats count WHERE index IN ("$index$") by sourcetype | rename sourcetype as sourcetype_name</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <delimiter>","</delimiter> <initialValue>*</initialValue> </input> <input type="checkbox" token="field3"> <label>Logical</label> <choice value="index_name=index AND sourcetype_name=sourcetype">Index AND Sourcetype</choice> <choice value="index_name=index OR sourcetype_name=sourcetype">Index OR Sourcetype</choice> <delimiter> </delimiter> </input> <input type="time" token="field1"> <label>Time</label> <default> <earliest>-4h@m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Search</title> <table> <search> <progress> <set token="adhoc"></set> </progress> <query>index=_audit sourcetype=audittrail info!=granted provenance="UI:Search" | rex field=_raw "search=\'(?&lt;search&gt;.*)\'," | rex field=search max_match=0 "[\w^]*index=\s*\"*(?&lt;index_name&gt;[^\s\"]+)" | rex field=search max_match=0 "sourcetype=[\"]?(?&lt;sourcetype_name&gt;[\S]+)" | where isnotnull(search) | search $field3$ | rename info as Completion | table _time index_name sourcetype_name search, user | rename user as "accessed by"</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">5</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">none</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="number" field="time_ago(seconds)"> <option name="precision">0</option> </format> <format type="number" field="seconds_ago"> <option name="precision">0</option> </format> <format type="number" field="exec_time"> <option name="precision">0</option> </format> <format type="number" field="search_lt"> <option name="precision">0</option> </format> <format type="number" field="search_et"> <option name="precision">0</option> <option name="useThousandSeparators">false</option> </format> </table> </panel> </row> </form>   ... View more

<form theme="light"> <label>Logical Test</label> <fieldset submitButton="true" autoRun="false"> <input type="checkbox" token="command" searchWhenChanged="false"> <label>Logically OR'ed Search Command</label> <default>*</default> <initialValue>*</initialValue> <choice value="*">Index</choice> <choice value="**">SourceType</choice> <choice value="***">Index OR Sourcetype</choice> </input> <input type="time" token="field1"> <label>Time</label> <default> <earliest>-4h@m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Search</title> <table> <search> <progress> <set token="adhoc"></set> </progress> <query>index=_audit sourcetype=audittrail info!=granted | rex field=_raw "search=\'(?&lt;search&gt;.*)\'," | rex field=search max_match=0 "[\w^]*index=\s*\"*(?&lt;idx&gt;[^\s\"]+)" | rex field=search max_match=0 "sourcetype=[\"]?(?&lt;st&gt;[\S]+)" | table search user idx st</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">5</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">none</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="number" field="time_ago(seconds)"> <option name="precision">0</option> </format> <format type="number" field="seconds_ago"> <option name="precision">0</option> </format> <format type="number" field="exec_time"> <option name="precision">0</option> </format> <format type="number" field="search_lt"> <option name="precision">0</option> </format> <format type="number" field="search_et"> <option name="precision">0</option> <option name="useThousandSeparators">false</option> </format> </table> </panel> </row> </form> ... View more

Yes its part of my dashboard, for example if i select checkbox or radio button ( logical AND or Logical OR) will show the result accordingly in panel either is simple search or any other panels.  could you please give me example search to define the token ... View more

Could you please give me some example because i need to use this into ad-hoc search and saved search ... View more

I have tried the below query as per your suggestion, But not getting the result, index=_audit sourcetype=audittrail action=success AND info=succeeded | eval secondsSinceLastSeen=now()-_time | eval timeSinceLastSeen=tostring(secondsSinceLastSeen, "duration") | stats count BY user timeSinceLastSeen | append [| rest /services/authentication/users | rename title as user | eval count=0 | fields user ] | stats sum(count) AS total BY user timeSinceLastSeen, ... View more

your query is showing who is successfully logged into splunk.. not the user not logged in splunk.  ... View more