@rakes568 I have the exact same requirement as you have mentioned in the very beginning of this post. I tried the last solution posted for this post but that's not what I'm looking for. In case you found a solution for this problem it will be great if you share the solution or the approach. ... View more

What did you end up doing for this? I'm trying to do the same calculation but I'm trying to use the  index=_index source=*splunkd.log (event_message="*Splunkd starting*" OR event_message="*Shutting down splunkd") ... View more

It might simply not be available for self-service installation. I pulled that from the Docs https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/User/SelfServiceAppInstall and chatted with someone on the team earlier before posting who said that was the best route. ... View more

Updated now. ... View more

That is some interesting trivia I was not aware about. I did not know there was a somesoni(1) account back in the days. I strongly believe that somesoni isn't actually a real person and in fact a wicked smart AI that is now in his second version of his development release cycle (somesoni v2). After 100k karma there could be a somesoni3... who knows. I strongly hope you and somesoni will slow down for a few (weeks|months|years|decades|centuries) so I get the chance to rule over splunk answers and catch up. At least I will get more karma on regular-expression postings, because there then will be no strong competition anymore. ... View more

Save the result 5 minutes ago in the lookup file and use the diff command. Is it the desired behavior? https://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Diff ... View more

Are you saying you are using a free Cloud trial and you want to keep your data as you move to the free version of Splunk Enterprise? I don't think there is any way to do that. Paying customers could file a Support ticket for help with something like this. ... View more

And example code to automate updating the DB https://github.com/georgestarcher/TA-geoip ... View more

It probably hadn't been approved yet. I've just emailed you. ... View more

Hi rakes568 try something like this: sourcetype = abc (status=active OR status=inactive) | transaction IP | search NOT status=inactive | table IP Bye. Giuseppe ... View more

This creates test data to simulate sourcetype=S1 OR sourcetype=S2 | makeresults | eval mydata="sourcetype=S1,SRC=001.001.001.001,Hostname=hostA,Field1=f1A,Field2=f2A sourcetype=S1,SRC=002.002.002.002,Hostname=hostB,Field1=f1B,Field2=f2B sourcetype=S1,SRC=003.003.003.003,Hostname=hostC,Field1=f1C,Field2=f2C sourcetype=S1,SRC=004.004.004.004,Hostname=hostD,Field1=f1D,Field2=f2D sourcetype=S2,SRC_IP=001.001.001.001,DST_IP=123.123.123.001 sourcetype=S2,SRC_IP=002.002.002.002,DST_IP=123.123.123.002 sourcetype=S2,SRC_IP=004.004.004.004,DST_IP=123.123.123.004 sourcetype=S2,SRC_IP=005.005.005.005,DST_IP=123.123.123.005" | table mydata | makemv mydata | mvexpand mydata | streamstats count as recno | makemv delim="," mydata | mvexpand mydata | rex field=mydata "(?<fieldname>[^=,]+)=(?<fieldvalue>[^=,]+)" | eval {fieldname} = fieldvalue | fields - mydata fieldname fieldvalue | stats values(*) as * by recno | fields - recno This gets your answer | eval SRC=coalesce(SRC,SRC_IP) | stats values(*) as *, dc(sourcetype) as foundboth by SRC | where foundboth==2 ... View more