So, for each pair, do you already know how to calculate the duration? Are you just after determining the average for each month? | bin _time span=mon | stats avg(duration) as avg_duration by _time ... View more

thank you for this. I tried, did return alerts, but not all. Some alerts (of a whole app) are missing - and I cannot find why. best regards Altin ... View more

You can also try this to remove space in both ends | rex field=myField mode=sed "s/(^\s+)|(\s+$)//g" ... View more

Thank you for the query. but i tried using transactions it grouped the events but I dont have a way to say startwith and does not endwith | transaction host maxspan=2m startswith=(EventCode="5009") NOT (endswith=(EventCode="10003")) ... View more

Like this: index=AlwaysSpecifyAnIndex cloudServiceName="onref*cls*" "SourceName=Microsoft-Windows-IIS-IISReset" | streamstasts count(eval(EventCode=="3202")) AS SessionID | stats range(_time) AS sessionSeconds BY sessionID | where sessionSeconds > 5 ... View more

I will ask our splunk folks about the CIM. If they had it in place I believe this will solve the purpose. ... View more

You have to account for possible trailing spaces in the rex, otherwise if they exist in the source data they will be captured. If you know they the spaces are always in the source data you can write: | rex "#TAGRESPONSE.*?RESPONSETYPE\:(?<RESPONSETYPE>[^\s]+)\s+?LICENSESTATE" But if you want account for the spaces possibly being there but account for the possibility that they won't? | rex "#TAGRESPONSE.*?RESPONSETYPE\:\s*?(?<RESPONSETYPE>.*?)\s*?LICENSESTATE" The first regex is less computationally expensive but won't capture fields that unless they are formatted properly. ... View more

@maniishpawar, can you please add some sample data where Only the first match count is returned ? | makeresults | eval _raw="some conflict while finding FOREIGN_KEY" | append [| makeresults | eval _raw="Event with nonexistingvalue"] | eval P_ErrMsg=case(searchmatch("conflict"), "FKEY1" ,searchmatch("FOREIGN KEY"), "FKEY" ,searchmatch("nonexistingvalue"),"garbagevalue") | stats count by P_ErrMsg As @DalJeanis has mentioned you should avoid a command like | eval _rawtext=_raw to copy raw data over from one field to another. Alternative to Dal's approach, you can also try searchmatch() function which matches your criteria against the _raw data. Splunk Documentation for reference: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions#searchmatch.28X.29 PS: Pipes with | makeresults and | append are used to generate some mock data. You would need to replace with your base search. Also it is better id you added your own mocked up sample events ( with sensitive information masked or anonymized ) | makeresults | eval _raw="some conflict while finding FOREIGN_KEY" | append [| makeresults | eval _raw="Event with nonexistingvalue"] ... View more

Thank you so much ... View more

Hi maniishpawar, in subsearches there is the limit of 50.000 occurrencies, so you have to build your search in a different way. remeber that the lookup command is similar to a left join. if you want to add some lookup field to your output, something like this: index=abc*prod sourcetype=iis earliest=-10m latest=now | lookup file.csv lookupservers AS host OUTPUT lookup_field | stats values(lookup_field) AS lookup_field count by host | rename host AS hostname | table count hostname lookup_field If instead you want to filter your events using your lookup try something like this: index=abc*prod sourcetype=iis earliest=-10m latest=now [ | inputlookup file.csv | rename lookupservers AS host | fields host ] | stats count by host | rename host AS hostname | table count hostname lookup_field Bye. Giuseppe ... View more

Thank you for the explanation. ... View more

Hello there, This will extract both lines from both keyworkds (RefillService, ProcessResponse): | rex "(?:RefillService|ProcessResponse)\s-\s(?<my_custom_field1>[^\n]+)" This will work only for RefillService line: | rex "RefillService\s-\s(?<RefillService>[^\n]+)" Hope it helps. ... View more

Okay, if you are on splunk below 6.4, then streamstats won't work for you. here's an alternate route. Basically, we copy each record forward into the next twenty-nine 10-second intervals, kill the excess records that go out into the future, and then let timechart do all the work. your query to return fields _time and responseTime over a 15-minute interval earliest=-16m@m | bin _time span=10s | eval fan_time=mvrange(0,300,10) | mvexpand fan_time | eval _time=_time+fan_time | addinfo | bin info_max_time as maxtime span=10s | where (_time >= info_min_time+300) and (_time < maxtime) | timechart span=10s avg(responseTime) as avgResponseTime ... View more

check this https://www.splunk.com/blog/2012/02/19/compare-two-time-ranges-in-one-report.html ... View more