<panel> <table> <title>Top Users</title> <search> <query>foo | table userid Business</query> </search> <option name="count">10</option> <drilldown target="My New Window"> <link field="user"> <![CDATA[https://foo.com/en-US/app/appname/dashboardname?form.egress_type=$form.egress_type$&form.userid=$click.value2$&form.cdi_business.tok=$row.Business$]]> </link> </drilldown> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> </table> </panel> I'm not sure how this is relevant considering the mechanism would be identical between all implementations. Documentation says to use earliest/latest as the tokens ; http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/PanelreferenceforSimplifiedXML#Drilldown_event_tokens Like this; <![CDATA[https://foo.com/en-US/app/appname/dashboardname?form.egress_type=$form.egress_type$&form.userid=$click.value2$&form.cdi_business.tok=$row.Business$&earliest=$earliest$&latest=$latest$]]> However, that appears to do nothing at all. ... View more

Won't this allow deletion of a file that is not completely indexed yet? ... View more

Regarding "LOOKUP-xxx"; What order are the "xxx" processed in? Alphanumerical? If you can order lookups, can you use the first lookup as a field for the second lookup? This is for a sourcetype that feeds into numerous reports and data models. The raw search must produce results from both lookups. Keeping it in the sourcetype is more logical in the environment than a macro would be unfortunately. ... View more

Ok, this begs the question; Why? Why on earth would we not be able to control the order of operations? ... View more

It looks like this line is breaking on any 6 digits; BREAK_ONLY_BEFORE = ^(\d{6})\s I'm trying this; BREAK_ONLY_BEFORE = ^(\d{6})\s+\d+:\d+:\d+ ... View more

The sourcetype appears to take that into account already. I can't figure out why events are getting the wrong timestamp, and are being combined. There are two artifacts occurring and I can not seem to replicate them. props.conf [mysql:generalQueryLog] KV_MODE = multi_mysql_query_log TRUNCATE = 0 TIME_FORMAT = %y%m%d %H:%M:%S SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = ^(\d{6})\s EXTRACT-login_success = Connect\s*(?<user>[^@]+)@(?<client_host>\S+) EVAL-action = case(isnotnull(client_host), "success") EVAL-Id = case(isint(Id), Id) MAX_TIMESTAMP_LOOKAHEAD = 128 This is what an event should look like with a timestamp of 08/03/2015 4:42:02; 150803 4:42:02 102917 Connect [email protected] on whatever 102917 Query select @@version_comment limit 1 102917 Query SELECT * FROM whatever WHERE foo Or bar This is artifact #1 (Wrong timestamp, truncation of event start) that shows a timestamp of 10/29/2015 8:42:02; 102917 Query select @@version_comment limit 1 102917 Query SELECT * FROM whatever WHERE foo Or bar 150803 4:44:08 102917 Connect [email protected] on whatever 102917 Query select @@version_comment limit 1 102917 Query SELECT * FROM whatever WHERE foo Or bar 150803 4:47:12 102917 Connect [email protected] on whatever 102917 Query select @@version_comment limit 1 102917 Query SELECT * FROM whatever WHERE foo Or bar Artifact #2 ( wrong timestamp, and failure to break event ) that shows a timestamp of 10/29/2015 8:42:02; 150803 4:42:02 102917 Connect [email protected] on whatever 102917 Query select @@version_comment limit 1 102917 Query SELECT * FROM whatever WHERE foo Or bar 150803 4:43:02 102917 Connect [email protected] on whatever 102917 Query select @@version_comment limit 1 102917 Query SELECT * FROM whatever WHERE foo Or bar 150803 4:44:02 102917 Connect [email protected] on whatever 102917 Query select @@version_comment limit 1 102917 Query SELECT * FROM whatever WHERE foo Or bar 150803 4:45:02 102917 Connect [email protected] on whatever 102917 Query select @@version_comment limit 1 102917 Query SELECT * FROM whatever WHERE foo Or bar 150803 4:42:02 102917 Connect [email protected] on whatever 102917 Query select @@version_comment limit 1 102917 Query SELECT * FROM whatever WHERE foo Or bar ... View more

Splunk support was able to replicate this bug and have submitted a ticket; SPL-104212 Awaiting response, and I will post any remediation steps here. ... View more

http://answers.splunk.com/answers/140208/how-to-compress-csv-file-and-email-it-on-unix-platform.html You could create a script that does this outside of the web interface via CLI, but there is no native compression mechanism command to use in a query. Or you could create a custom command to facilitate, but there are licensing issues to contend with. ... View more

I have something working as a scheduled alert; index=ad_* objectCategory="CN=Group,CN=Schema,CN=Configuration,DC=foo,DC=bar,DC=com" | fields - _raw | dedup cn | eval splitted=split(member, "|") | mvexpand splitted | eval Zone="Latest" | table cn splitted Zone _time | append [ | search index=ad_* objectCategory="CN=Group,CN=Schema,CN=Configuration,DC=foo,DC=bat,DC=com" | fields - _raw | eventstats latest(_time) AS latest_timestamp by cn | eval prev_timestamp = strftime(_time, "%Y-%m-%d %I:%M:%S %p") | where _time < latest_timestamp | dedup cn | eval splitted=split(member, "|") | mvexpand splitted | eval Zone="Previous" | table cn splitted Zone _time latest_timestamp ] | stats values(cn) AS cn, values(Zone) as Zone, values(_time) as Timestamp, values(latest_timestamp) AS latest_timestamp by splitted | nomv Zone | search Zone="Previous" | eval t=now() | eval t_earliest = (t - 86400 * 1) | where latest_timestamp>t_earliest It can likely be cleaned up, but this is working for both removals and additions of accounts. The query as is only pulls removals with the "Zone" field set to "Previous". It's set as a scheduled alert around 6am, and if results are > 0. ... View more

Well aware of this, however I'd rather use the built in AD monitoring over deploying a forwarder on multiple domain controllers. I've made some progress in that I can now compare deltas of the latest event vs. the prior event; This grabs the event prior to the latest: index=ad_* objectCategory="CN=Group,CN=Schema,CN=Configuration,DC=foo,DC=bar,DC=com" | table cn _time | eventstats latest(_time) AS lasttime | where _time < lasttime | dedup cn I'm now formatting a 'set diff' query to compare the two. ... View more

I still tested your theory, however it did not make a difference. Thank you for your assistance though! ... View more

I should have specified we are only indexing the active directory structure with admon. There are no forwarders on the domain controllers. ... View more