| makeresults | eval sourcetype=split("BBCN-Kunshan,BSCN-Suzhou,BBSP-Malasiya,BTCN-Tianjin,BXCN-Xian,BCCN-Suzhouheadquarters,BCIT-Italy", ",") | mvexpand sourcetype | eval index="bbs-firewall" | join type=left index sourcetype [ | tstats count where index="bbs-firewall" earliest=-24h by index sourcetype ] | eval count=coalesce(count, 0) | where count=0 | stats values(sourcetype) as sourcetypes by index | eval message ="Sourcetypes With 0 Events Last 24hr" | table index sourcetypes message this is the search that shows which sourcetype is having 0 events last 24 hr . Now i also wanted to show the time of the last log that came in splunk . ... View more

So i have a search which show the indexes that have 0 events last 24hr.  I want to send this result as an alert to microsoft teams from splunk . How can i do that i am using 9.1.4 version. ... View more

I want to create a script for log rotation in splunk , which makes a zip file of last 3 days (individual zip files) ,so every new day it will make a new zip file and if the count of zip files is greater than 3 then it should delete oldest zip file so that count of zip file remains 3 only. because we only want zip file of last 3 days only. There is a main file which is storing logs everyday  (file name: firewall) and the script will be schedule like 1 am everyday. ... View more

this message is displaying in the splunkd logs on syslog server. we are forwarding data from syslog server to DMZ server as we are getting logs from outside our network. And then to indexer.     ... View more

Hi , I want to make an alert of all the indexes that are receiving 0 events in last 24 hr. Thanks ... View more

so i have a index paloalto and a lookup file both have 1 field common app , now i want app which are present in lookup and index as well but there is a problem like in lookup if there is Alexa as an app then in index its amazon-alexa , or in lookup it is "windows xbox" in index it is "xbox-live" and some matches perfectly lilke spotify now tell me a spl where if any part of the name matches just display the app name from lookup as well as index. ... View more

I am using the script in the dashboard and they were running fine and one day they just stop functioning and nothing has been changed why does this happens . and when i go to edit part of my dashboard this warning comes.   ... View more

hello i have a search and i want only latest result of this search . ok so the problem is for 1 DeviceName there are multiple SensorHealthState  , now it was Inactive but latest event shows that the device is active now . But this search shows Inactive . How can I get latest result . index=endpoint_defender source="AdvancedHunting-DeviceInfo" | dedup DeviceName | search DeviceType=Workstation OR DeviceType= Server | rex field=DeviceDynamicTags "\"(?<code>(?!/LINUX)[A-Z]+)\"" | rex field=Timestamp "(?<timeval>\d{4}-\d{2}-\d{2})" | rex field=DeviceName "^(?<Hostname>[^.]+)" | rename code as 3-Letter-Code | lookup lkp-GlobalIpRange.csv 3-Letter-Code OUTPUTNEW "Company Code" | lookup lkp-GlobalIpRange.csv 3-Letter-Code OUTPUT "Company Code" as 4LetCode | lookup lkp-GlobalIpRange.csv 3-Letter-Code OUTPUT Region as Region | eval Region=mvindex('Region',0) , "4LetCode"=mvindex('4LetCode',0) | rename "3-Letter-Code" as CC | search DeviceName="bie-n1690.emea.duerr.int" | search SensorHealthState = "active" OR  SensorHealthState = "Inactive" OR SensorHealthState = "Misconfigured" OR SensorHealthState = "Impaired communications" OR SensorHealthState = "No sensor data" | table Hostname CC 4LetCode DeviceName timeval Region SensorHealthState ... View more

I want to send alerts to ms teams channel how to do it ... View more

I am not able to see the schedule of the saved searches although they are cron scheduled . so when i am saving again the saved search the time can be seen but after some time it just does not show.   ... View more

So I am using this script , what this script does it it creates a solved button on each field of dashboard drilldown and when that button it clicked it changes the value of solved field to 1 from 0 . I wan to know whats wrong in this script button can be seen but when it is clicked nothing happens even if i refresh the drilldown. This is the drilldown with the button in rowKey field. This is the script. require([ 'splunkjs/mvc', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!', 'jquery' ], function(mvc, SearchManager, TableView, ignored, $) { // Define a simple cell renderer with a button var ActionButtonRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return cell.field === 'rowKey'; }, render: function($td, cell) { $td.addClass('button-cell'); var rowKey = cell.value var $btn = $('<button class="btn btn-success">Mark Solved</button>'); $btn.on('click', function(e) { e.preventDefault(); e.stopPropagation(); var searchQuery = `| inputlookup sbc_warning.csv | eval rowKey=tostring(rowKey) | eval solved=if(rowKey="${rowKey}", "1", solved) | outputlookup sbc_warning.csv`; var writeSearch = new SearchManager({ id: "writeSearch_" + Math.floor(Math.random() * 100000), search: searchQuery, autostart: true }); writeSearch.on('search:done', function() { console.log("Search completed and lookup updated"); var panelSearch = mvc.Components.get('panel_search_id'); if (panelSearch) { panelSearch.startSearch(); console.log("Panel search restarted"); } }); }); $td.append($btn); } }); // Apply the renderer to the specified table var tableComponent = mvc.Components.get('sbc_alarm_table'); if (tableComponent) { tableComponent.getVisualization(function(tableView) { tableView.table.addCellRenderer(new ActionButtonRenderer()); tableView.table.render(); }); } }); ... View more

we have a index where the data is currently being stored and indexed on the indexer . Now i am making Search head standalone and i want to send the data from indexer to sh . How to do it. ... View more

hello i have an index  (A) on indexer and other index (B) on Search head (we are making it standalone) . i want to send data from index A to B . How to proceed . I have admin rights. ... View more

require([     'splunkjs/mvc',     'splunkjs/mvc/searchmanager',     'splunkjs/mvc/tableview',     'splunkjs/mvc/simplexml/ready!',     'jquery' ], function(mvc, SearchManager, TableView, ignored, $) {       // Define a simple cell renderer with a button     var ActionButtonRenderer = TableView.BaseCellRenderer.extend({         canRender: function(cell) {             return cell.field === 'rowKey';          },         render: function($td, cell) {             $td.addClass('button-cell');                var rowKey = cell.value             var $btn = $('<button class="btn btn-success">Mark Solved</button>');               $btn.on('click', function(e) {                 e.preventDefault();                 e.stopPropagation();                   var searchQuery = `| inputlookup sbc_warning.csv                     | eval rowKey=tostring(rowKey)                     | eval solved=if(rowKey="${rowKey}", "1", solved)                     | outputlookup sbc_warning.csv`;                   var writeSearch = new SearchManager({                     id: "writeSearch_" + Math.floor(Math.random() * 100000),                     search: searchQuery,                     autostart: true                 });                   writeSearch.on('search:done', function() {                     console.log("Search completed and lookup updated");                     var panelSearch = mvc.Components.get('panel_search_id');                     if (panelSearch) {                         panelSearch.startSearch();                         console.log("Panel search restarted");                     }                 });             });               $td.append($btn);         }     });       // Apply the renderer to the specified table     var tableComponent = mvc.Components.get('sbc_warning_table');     if (tableComponent) {         tableComponent.getVisualization(function(tableView) {             tableView.table.addCellRenderer(new ActionButtonRenderer());             tableView.table.render();         });     } }); in this i want name of the button to be "unsolved" initially and when somebody clicks it the name should change to solved ... View more