Could you paste a couple sample log entries? ... View more

I am not sure of where you are getiting your data... But maybe you could modify this snippet.. index=wineventlog sourcetype=WinEventLog:Security (EventCode="4624" OR EventCode="4625") user!="*$" | eval count_failure = if(action=="failure", 1, 0), count_success = if(action=="success", 1, 0) | eval time_failure = if(action=="failure", _time, "-"), time_success = if(action=="success", _time, "-") | stats min(time_failure) as first_fail, sum(count_failure) as count_failure, min(time_success) as first_success by user | eval time_difference = first_success - first_fail | where count_failure > 0 | search time_difference>400 | eval first_fail=strftime(first_fail,"%Y-%m-%d | %H:%M:%S"), first_success=strftime(first_success,"%Y-%m-%d | %H:%M:%S") ... View more

I am experiencing the same issue. Did you ever receive the .HAR file? If not, I can try sending one to you. ... View more

The dollar sign ($) trick is just what I needed. ... View more

I have a similar search. See if this can help... | eval status = if(like(status, "No Image%"), "No image", status) | stats count by status ... View more

This might be easier to read... 0 18-7 * * * ... View more

Have you tried using an 'if' function. | eval new-field = if(your-field = "No image*" , "No Image" , your-field) ... View more

If you need more flexibility you might need to create fields extractions. If it was me, I would create 3 separate field extractions. - (?P<error>.*?)\sERROR - (?P<volume>.*?)\sVolume - (?P<tpm>.*?)\sTPM ... View more

Have you tried something like this... index=wineventlog sourcetype="WinEventLog:Security" EventCode=4724 | fields EventCode, Account_Name, Account_Domain | eval admin_Account_Name=mvindex(Account_Name,0), admin_Account_Domain=mvindex(Account_Domain,0) | eval user_Account_Name=mvindex(Account_Name,1), user_Account_Domain=mvindex(Account_Domain,1) | eval user = user_Account_Domain. " \\ ". user_Account_Name | eval admin = admin_Account_Domain. " \\ ". admin_Account_Name | table _time, user, admin | sort -time | rename user as "Password Changed for account", admin as "Changed By" ... View more

I wonder if something like this would be easier. It is all created using just the Dashboard creation UI. <form> <label>sub search by check box on dashboard</label> <fieldset submitButton="false"> <input type="radio" token="tok_subsearch" searchWhenChanged="true"> <label>subsearch</label> <choice value="[ search index=wineventlog host=ndca* | table host ]">Enabled</choice> <choice value="">Disabled</choice> </input> </fieldset> <row> <panel> <table> <search> <query>index=wineventlog $tok_subsearch$ | table host</query> <earliest>-15m</earliest> <latest>now</latest> </search> </table> </panel> </row> </form> ... View more

I came across the same issue. From what I gather, OpenSSL can't find a required configuration file. Luckily when installing Splunk the necessary file is placed in "c:\Program Files\Splunk\openssl.cnf". Unfortunately, installing Splunk does not set the %OPENSSL_CONF% system variable that points to the file. Use the following to see if the system variable is set: echo %OPENSSL_CONF% If the variable is not set you can tell Windows to use the configuration file provided by Splunk. set OPENSSL_CONF=c:\Program Files\Splunk\openssl.cnf ... View more