Good day, Recently, I worked on a project that required me to set up a way for users to retrieve records from SQL with varying dates. I was able to set it up to run so that they can pick explicit dates to search between with an eval statement: [dbxquery here] | eval submitdate_epoch=strptime(submit_date, "%Y-%m-%d %H:%M:%S.%N") | search submitdate_epoch>=$timetok1.earliest$ AND submitdate_epoch<=$timetok1.latest$ However, to make things easier for the user, I'd like to also include a way to pass relative time into the search, such as "now" or "7 days ago". Is there any way to do this, and if so, can you point me towards it? Thank you. ... View more

Hello, I'm working on a dashboard that uses dbxquery, and I am wondering. Is it possible to pass dashboard tokens to the SQL query? I know I can use the WHERE clause to find events between 2 dates: | dbxquery query="SELECT * FROM table WHERE (Event_Date>'2017-05-01 00:00:00.0' AND Event_Date<'2017-05-30 23:59:59.0')" connection="connection_name" wrap=t This query works fine. But if I set up let's say two text inputs, like such: | dbxquery query="SELECT * FROM table WHERE ($datetok1$ AND $datetok2$)" connection="connection_name" wrap=t I get no results. In this case, I would set the token prefix to be Submit_Date<' or Submit_Date>' and the suffix to be 00:00:00.0' or 23:59:59.0', so the user would only need to enter the year, month, and days they want to search between. If this has been asked before, can someone link me to an answer? Also, is it possible to pass the time inputs into the SQL statement? I don't think it is, due to the differing formats (for example, 'yesterday', 'today', etc), but I'd like to be sure. ... View more

Hi, Is it possible to set up Splunk so that, if a search reports that a website is malicious, it can double check with another website with a blocklist? For example, lets say that the logs Splunk monitor report that a user went to www.google.com. It reports this as a malicious site and sends an alert. Obviously, this would be a false positive, so what I want to know is if it is possible to set up a search query to dynamically check URLs reported against an online blocklist. I realize I could probably set up something like this witha lookup file acting as either a blacklist or a whitelist, but I would like something a bit more dynamic. ... View more

I apologize if this is a very obvious question, but I'm completely lost. A project I am working on is to filter the logs coming in so they are never indexed in the first place. Using a question here, I was able to make these props.conf and tranforms.conf files: #props [sourcetype] TRANSFORMS-set=setnull,setparsing #transforms [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = regex_to_match_at_front_(code1|code2|code3) DSET_KEY = queue FORMAT = indexQueue Here is the question I got this from: https://answers.splunk.com/answers/185495/how-to-configure-propsconf-and-transformsconf-to-s-1.html Now I need to test this. Sonce I have to do this via Splunk Web, I'm trying to set up these options in a new sourcetype, via the advanced options. I know I can set up a sourcetype to properly parse the events, but whenever I some of the code as new settings, Splunk automatically deletes them (as with TRANSFORMS-set=setnull,setparsing) or replaces them (I obviously cannot have two REGEX). Basically, is it even possible to set this up in Splunk Web? If so, can you link me to the relevant documentation. I don't have access to the backend, so I need to decide how to proceed. Thank you. P.S. If anyone has another way of whitelisting events, I'd like to hear about it. ... View more

Hello, One of my co-workers is using a search to make a table listing the days the events of interest took place, as well as the corresponding User IDs on those days and the Jobs that are associated with it. So this: index=index_name date_wday=* User=* Job=* | bucket span=1d _time |stats count by date_wday User Job _time | search count >25 | stats values(_time) as time list(User) as UserID values(Job) as JobName list(count) as count by date_wday | eval Time=strftime(time, "%m-%d-%Y") | fields - time | table Time, date_wday, UserID,JobName,count | sort - Time | rename date_wday as Day_of_week Creates something like this: 07-19-2017 | wednesday | User1 | Job1 | 34 | | User2 | Job2 | 45 | | User3 | Job3 | 34 | | User3 | Job4 | 32 This works fine, but I'm wondering if it is possible to set this up so that if a user is associated with multiple jobs, the jobs appear in one line, as opposed to another entry of the user. For example: 07-19-2017 | wednesday | User1 | Job1 | 34 | | User2 | Job2 | 45 | | User3 | Job3, Job4 | 34 Is this even possible using the search queries, though? ... View more

I feel dumb for asking something so simple, but I can't make this work. I'm trying to show a percentage I've calculated as a piechart: | dbxquery query=stuff | stats count(eval(Start_Date_Time > End_Date_Time)) as breach count as total | eval percent=breach/total*100 | eval total=total/total*100 | chart max(percent) over total As you can see, I calculated both the percent of events where the start time is greater than the end time, and the corresponding total, which, of course is 100%. All I need to do now is show it in a pie chart. I calculated the total percent due to the chart only showing a solid block of color for my percent. I was hoping that I could use it to show the percentage correctly, but I was wrong on that. Also, I can't use top; I need to consider all the events, not just the top values. ... View more

Hello, I'm working on a time chart that needs to chart based on the time retrieved from the database. So far, the chart is only working with _time. Here is my query so far: | dbxquery SQL query | dedup id_number| eval _time=strptime("date time","%Y-%m-%d %H:%M:%S.%N") | eval _time="date time" | timechart span=1d sum("Projected_Cost") as Potential_Cost by Incedent So far, though, all I've gotten is a blank chart. Here is an example time stamp: 2017-03-14 17:19:25.0 If anyone can give me any help whatsoever, that would be great. I've been hitting a wall with this for several hours. Thanks. ... View more

How do I add a count to a table using the table command? The project I'm working on requires that a table is mad showing the day of the week, followed by a list of the users who logged on that day and how many time the logged on. The output looks something like this: ============================================= Wednesday | user1 | 5 | user2 | 3 | user3 | 4 | user4 | 3 ============================================= I'm currently using this search to get some of what I need: index=* date=* user=* | transaction date | table date user But I can't get the count I need at the end. I tried appending a stats count: index=* date=* user=* | transaction date | table date user | appendcols [search user=* | stats count by user] But had no luck. Is there anyway to do this? ... View more

Hello everyone, Basically exactly what the title says. I made a white list of approved accounts and would like to alert on successful logins for accounts that are NOT on that list. So far, what I have is very basic: | inputlookup test_lookup | return account The issue is that I can't find anything on the logic needed to match for accounts that are not in the file. ... View more

Hello everyone, I apologize in advance for such a basic question, but I can't find a list in the documentation of the app for supported OS's. Basically, I just need to know before I install this if App for *nix can take data from Red Hat and AIX. I saw AIX in the description of the app, but I cant find any info on if it runs with Red Hat. If anyone can point me to the proper documentation to find this, or to an alternative app, I'd be grateful. Thank you. ... View more