Looking back through the documentation, back to 7.0.0 which is as far back as I can find, it has been recommended that base searches are transforming searches https://docs.splunk.com/Documentation/Splunk/7.0.0/Viz/Savedsearches#Post-process_searches_2   ... View more

Done ... View more

I tried:   | makeresults count=10 | eval src=random().".wxyz.com" | eval name = replace(src,".wxyz.com", ".abc.com")   To see how it worked. ... View more

the link to the python is broken. Would you happen to have an updated link? ... View more

New working link that always point to latest version 🙂 https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptSetup ... View more

Sigh... Yeah, this was an "interesting idea" four years ago... ... View more

Here is the sample: 12/21/21 7:43:43.000 PM {    logger: connectivity.runner.Runner    message: Managed service successfully started    severity: INFO    thread: main    time: 1640133823.948 }   host = rt22a10031pv00 source = PROD sourcetype = log4j2 12/21/21 7:42:02.000 PM {    logger: connectivity.core.shutdown.GracefulShutdownStrategy    message: Application is closing. Running commands will end with partial results.    severity: WARN    thread: Thread-6    time: 1640133722.085 }   host =rt22a10031pv00 source = PROD sourcetype = log4j2 ... View more

Hi I think that this should be a doable? Just create a SPL query which take care of those unwanted events. Maybe something like this? Your normal query with events which shows shutdown + start time of that service sort 0 by _time ? get shutdown + start time e.g. with eventstats (only one restart exists) or streamstats (more than one restarts within time period) Drop events which are between start and end time (could be little bit challenging with many restarts 🙂 r. Ismo ... View more

@vsingla1 wrote: After grouping the fields into one list, how do I make this list comma separated? This is, what I have somewhere already -- the field Mnemonic (singular), specific to every event, is grouped into Mnemonics (plural), which is then passed to multi-value join: | eventstats values(Mnemonic) as Mnemonics | eval Mnemonics=mvjoin(Mnemonics, ",")   ... View more

you have to increase (or set to zero for this sourcetype) TRUNCATE in props.conf for the first example if the length can exceed 10000 bytes. the probability that the regex find a wrong match is higher for a very long line (depends on your regex). from the other side, Splunk best practices are to keep mulitline events to a minimum: https://dev.splunk.com/enterprise/docs/developapps/logging/loggingbestpractices/#Keep-multi-line-events-to-a-minimum ... View more

Hi @unitedmarsupials, your solution surely solves your functional need, but I think that's a very slow search if you use _internal (this means that you cannot execute it in an alarm e.g. every five minutes!) and a not sure search if you use a different index (because it's possible that you don't have nothing to receive on that index!). In addition, you don't check servers that didn't send logs in the search timeframe. I used the above solutions for an alert (with a frequency of 5 minutes) that's running from many years! Ciao and next time! Giuseppe ... View more

Ok, there are two options here, which can also be combined: Set the includeMDC parameter to true and hope (or provide for), the MDC in your case contains all of the fields you need — they will be in the properties sub-dictionary of every logged event. Set the messageFormat parameter to json -- and format your message to be in proper JSON itself: value="{"cat": "meow", "message": "%m"}"/> The message field of the submitted event will then itself be a dictionary. In the above example, that sub-dictionary will contain two fields: cat and message . These can be searched for on Splunk-server as message.cat="meow" . I'd still like to be able to add additional fields next to the message and the severity , though -- not inside a sub-dictionary... ... View more

Yes, have a base search that nothing uses like this: | rest/services/authentication/current-context splunk_server=local | table username realname email Then have a done section like this: <condition match="$result.username$==&quot;some_username_here&quot;"> <set token="init_token_here">value for some user</set> </condition> <condition match="$result.username$==&quot;other_username_here&quot;"> <set token="init_token_here">value for other user</set> </condition> <condition> <set token="init_token_here">default value here</set> </condition> ... View more

Ah, so sendmail is a function in itself? Is that true about all actions? For example, in addition to sending e-mail, our Splunk instance can also trigger a Moogsoft-alert -- does that mean, there is a moogsoft function too? Thank you! ... View more

It is enough to use in the Last something . If Today is specified, it is regrettable that it will be Custom time . ... View more

The alert used to contain a table of all of the detected oracle-errors -- four fields enumerated in my question. Now it contains only two fields: the App and the incidence. And the second column is empty... ... View more

Like this: Your Search Here | streamstats count(eval(YourMarkerFieldHere="YourMarkerValueHere")) AS sessionID | stats count BY sessionID ... View more

This is a known bug, which affects all of the mechanisms implemented by the splunk-library-javalogging, not just logback. Here, for example, is the Github issue for a log4j2 part. Fixes, such as this one are offered for the HttpEventCollectorResendMiddleware.java , which would fix all logging methods at once too. No idea, why this still is not in the released JAR 😞 ... View more

Trying the first method: ... | transaction host, PID startswith="Code=ImportRequestStart" endswith="Code=ImportRequestEnd" | timechart duration I get this error: Error in 'timechart' command: The specifier 'duration' is invalid. It must be in form <func>(<field>). For example: max(size). Using avg(duration) works... ... View more