Hi All, I have a splunk alert that is having this search query: index="dcn_b2b_use_case_analytics" sourcetype=lime_process_monitoring | where BCD_AU_UP_01=0 OR BDC_BA_01=0 | dedup host | eval failed_processes=mvappend( if(BCD_AU_UP_01=0, "BCD_AU_UP_01", NULL), if(BDC_BA_01=0, "BDC_BA_01", NULL) ) | eval failed_process_list=mvjoin(failed_processes, ", ") | eval metricLabel="Labware - Services has been stopped in Server--Test Incident--Please Ignore" | eval metricValue_part1="Hello Application Support team, The below service has been stopped in the server, Service name: " | eval metricValue_part2=failed_process_list | eval metricValue_part3=" Server name: " | eval metricValue_part4=host | eval metricValue_part5=" Please take the required action to resume the service. Thank you. Regards, Background Service Check Automation Bot" | eval metricValue=metricValue_part1 + metricValue_part2 + metricValue_part3 + metricValue_part4 + metricValue_part5 | eval querypattern="default" | eval assignmentgroup="SmartTech Team" | eval business_service="SmartTech Business Service" | eval serviceoffering="SmartTech service offering" | eval Interface="CAB" | eval urgency=3 | eval impact=3 (Please note: here process status = 0 is failed process and =1 is successful process) ALERT CONFIG: Alert type: Scheduled Cron Expression: */7 * * * * Expires 24 hours Trigger Once Throttle (was checked in checkbox) Suppress triggering for 30 minutes When triggered - Alert Action- PTIX SNOWALERT(trigger incident in SNOW)   This should trigger only one incident having the Service names and the Server name, but not sure why this alert is triggering three different tickets-please help me correct the alert to trigger single ticket whenever alert is enabled. ... View more

  when I run this search query in splunk search and reporting apps my output looks like this as mentioned below   Search query:   index="dcn_b2b_use_case_analytics" sourcetype=lime_process_monitoring   Output:   Time  3/19/25 2:32:15.000 PM Event { [-]     BCD_AB_UY_01: 1     BCD_AB_UY_02: 0     BCD_BC_01: 1     BCD_BC_02: 0     BCD_CD_01: 1     BCD_CD_02: 1     BCD_CD_03: 0     BCD_KPI_01: 1     BCD_KPI_02: 1     BCD_KPI_03: 0     BCD_MY_01: 1     BCD_MY_02: 1     BCD_RMO_PZ_01: 1     BCD_RMO_PZ_02: 1     BCD_RMO_PZ_03: 0     BCD_RMO_PZ_04: 0     BCD_RSTA_01: 1     BCD_RSTA_02: 1     BCD_RSTA_03: 0     BCD_SHY_01: 1     BCD_SHY_02: 1     BCD_UK_01: 1     BCD_UK_02: 1     BCD_UK_03: 1     BCD_UK_04: 1     BCD_UK_05: 1     BCD_UK_06: 1     BCD_UK_07: 1     BCD_UK_08: 0     BCD_UK_09: 0     BCD_UK_10: 0     BCD_UK_11: 0     BCD_UK_12: 0 }   host = RSQWERTYASD04index = dcn_b2b_use_case_analyticssource = DCNPassFoldersourcetype = lime_process_monitoring Please Note- if a process value is 1 it means the process ran successfully, if it is 0 it means the process failed   Now my query is I want to trigger an alert for these processes mentioned below so that when these background processes fail I get an incident in my queue  in SNOW   BCD_AB_UY_01: 0 BCD_BC_01: 0 BCD_CD_01: 0 BCD_CD_02: 0 BCD_KPI_01: 0 BCD_KPI_02: 0 BCD_MY_01: 0 BCD_MY_02: 0 BCD_RMO_PZ_01: 0 BCD_RMO_PZ_02: 0 BCD_RSTA_01: 0 BCD_RSTA_02: 0 BCD_SHY_01: 0 BCD_SHY_02: 0 BCD_UK_01: 0 BCD_UK_02: 0 BCD_UK_03: 0 BCD_UK_04: 0 BCD_UK_05: 0 BCD_UK_06: 0 BCD_UK_07: 0     This is the alert search query I designed but when I run this alert I get multiple tickets instead I want a particular ticket where servicename(process name) and servername(hostname) is clearly mentioned to uniquely identify the process is from which server, please help me write and configure the splunk alert properly: Search query- index="dcn_b2b_use_case_analytics" sourcetype=lime_process_monitoring    | where BGS_AR_UY_01=0 OR BGS_BR_01=0 OR BGS_BS_01=0 OR BGS_BS_02=0 OR BGS_KAU_01=0 OR BGS_KAU_02=0 OR BGS_MX_01=0  OR BGS_MX_02=0 OR BGS_RMH_PZ_01=0  OR BGS_RMH_PZ_02=0 OR BGS_RSTO_01=0 OR BGS_RSTO_02=0 OR BGS_SHA_01=0 OR BGS_SHA_02=0  OR BGS_US_01=0 OR BGS_US_02=0 OR BGS_US_03=0 OR BGS_US_04=0 OR  BGS_US_05=0 OR BGS_US_06=0 OR BGS_US_07=0    | eval metricLabel="URGENT !! Labware - < ServiceName > has been stopped in Server"   | eval metricValue="Hello Application Support team, The below service has been stopped in the server, Service name :  < ServiceName > Timestamp :  < Timestamp >   Server : <ServerName>  Please take the required action to resume the service. Thank you. Regards, Background Service Check Automation Bot"   | eval querypattern="default" | eval assignmentgroup="PTO ABC Lab - Operatives" | eval business_service="LIME Business Service"   | eval serviceoffering="LIME" | eval Interface="CLMTS" | eval urgency=2 | eval impact=1     Cron expression * * * * * Trigger For each result Trigger actions PTIX SNOWALERT           ... View more

Hi All, I have a splunk query giving results in this format: Time                                                             Event 3/10/25 10:52:15.000 AM                 { [-]                                                                          BCDA_AB_CD_01: 1                                                                          BCAD_AB__02: 0                                                                          BCDA_AB_DC: 1                                                                          BCAD_CD_02: 0                                                                         } However I want to remove the BCAD_AB__02 and BCAD_CD_02 from the output. Please help me write a splunk query to exclude these two values from the output. I tried doing  | fields - BCAD_AB__02 BCAD_CD_02  but this didn't work ... View more

Hi All, I have designed a splunk query: | inputlookup Expiry_details_list.csv | lookup SupportTeamEmails.csv Application_name OUTPUT Owner_Email_address Ops_Leads_Email_address Escalation_Contacts_Email_address | eval Expiry_Date = strptime(Expiry_date, "%m/%d/%Y") | eval Current_Time = now() | eval Expiry_Date_Timestamp = strftime(Expiry_Date, "%Y/%m/%d %H:%M:%S") | eval Days_until_expiry = round((Expiry_Date - Current_Time) / 86400, 0) | eval alert_type = case( Days_until_expiry <= 7, "Owner", Days_until_expiry <= 15, "Support", Days_until_expiry < 1, "Expired", Days_until_expiry > 15, "Others", true(), "None") | search alert_type != "None" | eval email_list = case( alert_type == "Owner", Escalation_Contacts_Email_address, alert_type == "Support", Ops_Leads_Email_address, alert_type == "Expired", mvappend(Owner_Email_address, Ops_Leads_Email_address, Escalation_Contacts_Email_address), true(), "None") | eval email_list = split(mvjoin(email_list, ","), ",") | eval cc_email_list = case( alert_type == "Owner", Owner_Email_address, alert_type == "Support", Owner_Email_address, true(), "None") | eval cc_email_list = split(mvjoin(cc_email_list, ","), ",") | dedup Application_name Environment email_list | eval email_recipient = mvdedup(email_list) | eval email_recipient = mvjoin(email_recipient, ",") | eval email_cc = mvdedup(cc_email_list) | eval email_cc = mvjoin(email_cc, ",") | table Application_name, Environment, Type, Sub_Type, Expiry_Date_Timestamp, Days_until_expiry, email_recipient, email_cc | fields - alert_type, Owner_Email_address, Ops_Leads_Email_address, Escalation_Contacts_Email_address Now this is returning output as provided in the attached file, what I am expecting is in email_list it should return only Escalation_contacts_email_address and in cc_email_list it should merge the email address of Owner_Email_address and Ops_Leads_Email_address seperated by a comma when the alert_type == "Expired" How do I get this using splunk query? ... View more

Hello, I've created a dashboard that is showing 4 teams in dropdown menu. Now when I choose one of the team, I want to only see the panels for the specific team.  I've created the drop-down input and given it a label called Team. I have created statis options like Team 1, Team 2, Team 3, Team 4. So, my question is how do I assign each panel chart to one of the teams in the drop down? From some of the online searching I've done - it is asking to use tokenization concept. Could you please help me achieve this result. ... View more

Hi All, I have one set of output having 8 closed tickets for two consecutive months as a result of splunk query. I also need to check whether each one of them breached SLAs or not based on their level of priority. How to traverse through each and every record through splunk query? Please Note: I also need to put in the formula to check which tickets got breached and what is the breach age and finally average age for breach of tickets. Please suggest how to proceed with this use case.  ... View more

Hi All,  I have a splunk query returning output as: STime 09:45   I want to convert it to hours. Expected output: STime 9.75 hrs   How do I achieve this using splunk ... View more

Hi All, I have a query which returns results for a particular month like how many tickets breached SLA. The month and year is hardcoded to the query. Now, I am wanting not to hard code the month in the query, instead use it in output - so that user can select the month to get the results. Could you please help here? Query Results: TicketCountSLABreached(TCSB)  TotalTicketCount(TTC)  IncResolutionTime(TCSB/TTC*100)    TimeStamp 2                                                                    3                                              66.667                                                             February 2024 ... View more

Hi All, I have created a lookup table Status.csv which is having all the status of tickets and whether they are SLA relevant or not. However, due to having incorrect data while creating the table the values for all the Statuses are coming wrong. I want to update all the data for these statuses and add few more status values to the lookup table. How do I do that? Please suggest. ... View more

I have written a splunk query and used streamstats command to make my output look like this: Query Used: ... | streamstats current= f last(History) as Status by Ticket Id | ... Current Output:                            Ticket ID Priority    Status 1234 4321 5678 P1 Closed In Progress 8765  P2  Closed   However I want to remove the record 4321 and look at all the closed tickets for Priority P1 and P2, but since it is also of P1 priority the entire record is getting removed for P1 when I use this query: ... | streamstats current= f last(History) as Status by Ticket Id | where NOT Status IN ("In Progress") | ... Output: Ticket ID Priority   Status 8765  P2  Closed   How do I only remove 4321 as it is  "In Progress" Status. Please help. Expected Output: Ticket ID Priority   Status 1234                                                  5678 P1  Closed 8765  P2  Closed ... View more

Expected Output: Ticket ID   Priority   Status 1234           P1            Closed 5678   8765            P2            Closed ... View more

Hi All, how to write a query in Splunk to take two same days in a week only if the difference between the start day and end day is not more than 24 hours. For example - the two days can be Tuesday, but the query should check the difference between two Tuesdays is less than 24 hours, which means the end day hours and the starting day hours falls in the same Tuesday. ... View more

Hi All, I have time field having time range in this format in output of one splunk query: TeamWorkTimings 09:00:00-18:00:00 I want to have the values stored in two fields like: TeamStart 09:00:00 TeamEnd 18:00:00 How do I achieve this using regex or concat expression in splunk. Please suggest. ... View more

I am new to splunk. How do we write a splunk query for a support ticket that is "In Progress" status to calculate the business hours elapsed by the ticket. We need to exclude the non-business hours of the weekday when the incident is "In Progress" status and also exclude the holidays and weekends. ... View more