I'm trying to compare multi-value fields from multiple events and display the diff between the two sets. For example, I want to know if a new cookie was introduced today that wasn't there yesterday. Each access log event would contain multiple cookie key/value pairs. So I first use regex to extract all cookie names into an multi-valued field. Then use the mvexpand command to break up the mvfield into individual events, and finally dedup that field to get the list of distinct cookies. I put this search into two subsearches with different start/end times and use the set diff command to compare the two. The result isn't what I'm expecting. It's listing out all the cookies even when the cookie names are present in both sets. My search example: | set diff [search index=access_log earliest=-1m@m latest=@m | rex max_match=100 field=Cookie "(^\b|;\s)(?<cookieNames>[^=]*)" | fields - _raw | fields cookieNames | mvexpand cookieNames | dedup cookieNames | table cookieNames] [search index=access_log earliest=-2m@m latest=-1m@m | rex max_match=100 field=Cookie "(^\b|;\s)(?<cookieNames>[^=]*)" | fields - _raw | fields cookieNames | mvexpand cookieNames | dedup cookieNames | table cookieNames] I'm suspecting this is not working because my list of cookieNames was created post-process using mvexpand and perhaps set diff only works on two list of raw events. Anyone has any experience solving this issue? ... View more

I want to create a form that allow users to input a few search criteria and I want it to perform a "base search" within log source A which will return a list of suspect IPs. For example: Base Search (hidden from user): sourcetype=logA badguy=true | stats count by IP | search count>$CountThreshold$ | table IP I want to take this list of suspect IP to look for matches in multiple sources and display search results from each individually. For example: Chart: sourcetype=logB [results from Base Search above] | timechart count by IP Table: sourceytpe=logC [results from Base Search above] | table username, login_status For performance reason I do not want to repeat the subsearch mulitple times to obtain the same list of IPs. I want to do the Subsearch once only and leverage that list in multiple subsequent searches. I thought about using "searchtemplate" and postprocessing but I think it will only work when I perform further filtering or aggregation of the first result, but not using it as a subquery for a brand new search. I also thought about using dynamic drill down but it will pass the IP one at a time, not as a list. Is there anyway to do this? ... View more

Hi, before Splunk 5 we have created about 40 saved searches that are populating summary index and about 70 other saved searches plus a handful of dashboards that query against the summary index. Now that we've upgraded to version 5, should we convert some (or all) to use Report Acceleration instead? What are some things we need to take into consideration when making that decision? ... View more