I have multiple disk like C, D & E on server and want to do the prediction for multiple disk in same query. index=main host="localhost"  instance="C:" sourcetype="Perfmon:LogicalDisk" counter="% Free Space" | timechart min(Value) as "Used Space" | predict "Used Space" algorithm=LLP5 future_timespan=180 Could anyone help with modified query.     ... View more

I have two separate Splunk cloud instance and want to forward specific set of data from one instance to another. Please suggest the approach or any app/add-on available for this purpose.  ... View more

I want to transpose the below row to column. Host drive_Name utilization   aaa D 20   bbb D 30   aaa E 60     want to covert above table result as below. Host D E aaa 20 60 bbb 30   ... View more

Fields value of 2nd and 3rd events are enter changing. please suggest how to maintain order in Splunk status command. I can't use any other fields in stats by clause than token_id.   Sample Event: |makeresults |eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2931"|eval key=2931|eval keyword="DK-BAL-AP-00613" |append [| makeresults |eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2932"|eval key=2932|eval keyword="DK-Z13-SW-00002"] |append [| makeresults |eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2933"|eval key=2933|eval keyword="DK-BAL-AP-00847"] | stats values(key) as key values(keyword) as keyword values(doc_no) as doc_no by token_id | eval row=mvrange(0,mvcount(doc_no))| mvexpand row| foreach doc_no keyword key [| eval <<FIELD>>=mvindex(<<FIELD>>,row)]|fields - row Search Result output toke_id key keyword doc_no c75136c4-bdbc-439b 2931 DK-BAL-AP-00613 GSSAGGOS_QA-2931 c75136c4-bdbc-439b 2932 DK-BAL-AP-00847 GSSAGGOS_QA-2932 c75136c4-bdbc-439b 2933 DK-Z13-SW-00002 GSSAGGOS_QA-2933         Expected Output toke_id key keyword doc_no c75136c4-bdbc-439b 2931 DK-BAL-AP-00613 GSSAGGOS_QA-2931 c75136c4-bdbc-439b 2932 DK-Z13-SW-00002 GSSAGGOS_QA-2932 c75136c4-bdbc-439b 2933 DK-BAL-AP-00847 GSSAGGOS_QA-2933 ... View more

i want to create new index time field severity if raw json payload have level field value is Information. { "level": "Information", "ORIGIN_Severity_name": "CRITICAL", "ProductArea": "Application", "ORIGIN_Product": "Infrastructure"} What's wrong in my transforms.conf configuration. Any help much appreciated. transforms.conf [severity] REGEX = "level":\s\"(?<severity>\w+) SOURCE_KEY = fields:level FORMAT = severity::"INFO" WRITE_META = true   ... View more

Can i do the wildcard matching in lookup? |makeresults |eval ip=192.168.101.10 |lookup ip.csv ip output host In my lookup i have two entry ip=192.168.101.10 & ip=192.168.101.10/24. How can i add wildcard (*) for match and i should get two entry.   ... View more

I want to call lookup within case statement. if possible, please share sample query. ... View more

How can i Truncate the log description after 20 words in splunk and store in new field. ... View more

Trying to expand the multivalue field with one to one mapping as shown in image. mvexpand create multiple row with all column matching value. Actual data with multivalue. child child_Name dv_class n_name direction name parent 55555             ... View more