I would like to populate the data inside of a lookup file from a .csv on a local computer. Is there a way to use the Splunk API or Splunk SDK for Python to to do this? Let me know if you need other information. ... View more

I am trying to create a search that looks through some logs and creates a time chart based on the search field which is a domain address like 'global.ymtracking.com' in Splunk Enterprise 6.4.3. I have a search already started which is: index=dns source="/var/log/named/rpz.log" | search src_ip!=xxx.xxx.xxx.xxx AND src_ip!=xxx.xxx.xxx.xxx AND src_ip!=xxx.xxx.xxx.xxx/24 AND src_ip!=xxx.xxx.xxx.xxx/24 | timechart count by query I want to do something like this: index=dns source="/var/log/named/rpz.log" | search src_ip!=xxx.xxx.xxx.xxx AND src_ip!=xxx.xxx.xxx.xxx AND src_ip!=xxx.xxx.xxx.xxx/24 AND src_ip!=xxx.xxx.xxx.xxx/24 | timechart count by query as foo | predict foo And then create an alert if one of the values goes above the predicted value on any given day. The error I get with the above is that you can't do timechart count by query as foo you would have to do timechart count(query) as foo , which is not exactly what I am looking for. I am not sure how this would be possible and any help would be greatly appreciated. ... View more