Hello, not sure this was solved. However, I had the same problem, and managed to remove the link by checking Type "plain text" in the Edit PDF Schedule window. The link desappeared... Hope it helps. BR Nordine ... View more

This works, thanks! ... View more

Hi @splunkrocks2014, I know that you can use only one input, infact you cannot use two inputs on the same files because they don't work! So you have to manually modify your outputs.conf as described in the above link and then modify the TAs containing the inputs to only one group on Indexers. Ciao. Giuseppe ... View more

Have you enabled the NetScaler input? And/or have you checked firewall rules? Some additional troubleshooting tips are here: https://docs.splunk.com/Documentation/AddOns/released/CitrixNetScaler/Troubleshoot   ... View more

It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result. https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results ... View more

does this finally work? i have a similar query to trigger the sendemail inside the map command, but I got "2021-04-30 04:05:59,276 +0000 ERROR sendemail:1428 - [HTTP 403] Client is not authorized to perform requested action" error in index=_internal source=*python.log*, but the sendemail works if I run separately, some post said the script inside map missed the context, do you know how we could fix this?  ... View more

I'd like to be able to do this too. Did anyone ever find a solution? ... View more

Where in Splunk can I find that template? Is this template specific to my account?  If not, do I have to be an administrator to update that file? ... View more

Maybe use a case in your where clause SELECT * FROM table_1 WHERE (case when [logoff_time] is NULL then [timestamp] else [logoff_time] end) > ? ORDER BY timestamp, logoff_time ... View more

hello have a look at this answer: https://answers.splunk.com/answers/645419/script-input-error-no-module-named-splunklibclient.html https://github.com/Microsoft/AzureMonitorAddonForSplunk/issues/29 ... View more

Yes this is possible. You can make an calculated field with the name of the field you want to change. The Eval expression should look like this: replace(fieldname, "text-to-replace", "replacement") When trying to mask data you can use the same command but with regex: replace(fieldname, "field=[^;]+", "field=XXXX") Remember to set sharing to the correct level. ... View more

Never thought about this way 🙂 ... thanks. ... View more

@splunkrocks2014 , Try this, | makeresults | eval date="2018-07-16", col1=4, col2=5, col3=6, col4=7 | append [| makeresults | eval date="2018-07-17", col1=8, col2=9, col3=16, col4=17] | fields - _time | table date col1 col2 col3 col4 | transpose|rename "row 1" as row1,"row 2" as row2 | eval diff=if(column!="date",(row2-row1),null()) | transpose header_field=column|fields - column|fillnull value=diff date ... View more

Like this: | makeresults | eval item="item 1", count_a=12, count_b=23, count_c=50, date="07/06/2018" | append [| makeresults | eval item="item 1", count_a=3, count_b=123, count_c=41, date="07/05/2018"] | append [| makeresults | eval item="item 1", count_a=31, count_b=13, count_c=21, date="07/04/2018"] | append [| makeresults | eval item="item 2", count_a=1, count_b=42, count_c=12, date="07/04/2018"] | append [| makeresults | eval item="item 2", count_a=21, count_b=142, count_c=122, date="07/05/2018"] | table date item count_a count_b count_c | eval _time = strptime(date, "%m/%d/%Y") | sort 0 _time | streamstats current=f last(count*) AS prev_count* BY item | foreach count* [ eval diff<<MATCHSTR>> = <<FIELD>> - prev_count<<MATCHSTR>> ] ... View more

| search`parentMacro(source)` ? Or include the search command in the macro, although that might only fix the first issue I can see there... ... View more

Try this | rest/servicesNS/-/-/data/lookup-table-files ... View more

If you are wondering why you need to rename them at all, it's because Splunk uses underscores to identify internal fields: https://docs.splunk.com/Splexicon:Internalfield http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Knowledge/Usedefaultfields ... View more

| inputlookup my_kvstore_name | rename _key as view_key worked as well for me; splunk recommend as a guideline to use rename instead of eval where it is possible. ... View more

@PowerPacked If you're still alive on this forum i'd really appreciate if you could elaborate on if you don't have permissions to the box - then use the Rest command in UI I'm trying to figure out exactly how to delete a specific key from KV Store via UI. If you have any sample code or links or anything that could push me in the righ direction then please share 🙂 Regards, Andrew ... View more

That will be pretty easy, but to help you structure the query, can you tell me what field in your current search you'll be looking to match and the name of the column/field in the lookup table that you're matching to? ... View more

Found an answer,just have a look on it: https://answers.splunk.com/answers/495132/how-to-preserve-order-of-json-array-in-search-resu.html ... View more

The key won't display by default. If I want to view the key field, I add this to a search: | eval key=_key This will make it visible in tables/stats/etc. ... View more

Hi, This might need a little re-work to pipe in your list of groups, but something along these lines might get you going: |ldapsearch domain=YourDomain search="(&(objectClass=user)(memberOf=CN=YourGroup,OU=YourOrgUnit,O=YourOrg))" | eval AccountIsDisabled=IF(userAccountControl=512,"True","False") | table sAMAccountName, AccountIsDisabled ... View more

It doesn't work for me. Here is the data: _time _raw 2018-03-02 16:43:45 03/01/2018 11:00:00 -0500, info_min_time=1520023380.000, info_max_time=1520027024.000, info_search_time=1520027024.435, report=testing123 ... View more

Here is an option https://github.com/georgestarcher/TA-geoip ... View more