@alfredoh14  In your examples, "*" is your search string. To expand it, add search terms to that string: splunk search "* sourcetype=e" -maxout 0 | find /c /v "" To dispense with find and have Splunk report the event count: splunk search "* sourcetype=e | stats count" If you know the index you're searching, you can use tstats for much faster results: splunk search "| tstats count where index=main sourcetype=e" ... View more

@adamnealis  To see the last timestamp extracted from audit.log by host over a given time range: | tstats max(_time) as _time where index IN (X Y) source=/var/log/audit/audit.log by host You can add earliest and latest constraints directly to the where clause if desired. To see that last time a host forwarded audit.log data to Splunk, summarize the _indextime field: | tstats max(_indextime) as _time where index IN (X Y) source=/var/log/audit/audit.log by host As with earliest and latest, you can add _index_earliest and _index_latest constraints to limit results by index time. Be mindful of the interplay between _index_earliest/_index_latest and any time value you've selected in the search UI and double check your results. ... View more

@maryambagherik  Did you resolve the problem? Which versions of Splunk and MLTK are you using? ... View more

Here's a functional example using _internal logs that you can adapt to your source type: index=_internal sourcetype=splunkd source=*/splunkd.log* | chart count over component by log_level | append [| makeresults | eval component=split("AdminManager,ApplicationLicense,BucketMover", ",") | mvexpand component | fields - _time] | fillnull value=0 | untable component log_level count | chart max(count) over component by log_level If you need totals, add the addtotals command to the end of the search: index=_internal sourcetype=splunkd source=*/splunkd.log* | chart count over component by log_level | append [| makeresults | eval component=split("AdminManager,ApplicationLicense,BucketMover", ",") | mvexpand component | fields - _time] | fillnull value=0 | untable component log_level count | chart max(count) over component by log_level | addtotals For example: index="index1" ApplicationName IN (app1*,app2*,app3*,app4*,app5*,app6*,app7*,app8*,app9*) | chart count(ApplicationName) over ApplicationName by Status | append      [| makeresults      | eval ApplicationName=split("app1,app2,app3,app4,app5,app6,app7,app8,app9", ",")      | mvexpand ApplicationName      | fields - _time ] | fillnull value=0 | untable ApplicationName Status count | chart max(count) over ApplicationName by Status | addtotals ... View more

@thomas_art  Have you contacted the author, @morethanyell? The Jira REST API is likely encoding the character when writing the response. Splunk is interpreting the raw text value, \u00e9, in the JSON data as it should. Absent some alternative representation and interpretation, the characters \, u, 0, e, and 9 are UTF-8. ... View more

@jondukehds  Assuming this is output from the NetBackup Licensing API, we can use mock test data:   { "data": [ { "type": "string", "id": "string", "attributes": { "masterConsumptionMB": 0, "clientDetails": [ { "clientName": "client1", "clientConsumptionMB": 123, "policyDetails": [ { "backupId": "string", "policyName": "string", "masterServer": "string", "policyType": "string", "policyConsumptionMB": 0 } ] }, { "clientName": "client2", "clientConsumptionMB": 456, "policyDetails": [ { "backupId": "string", "policyName": "string", "masterServer": "string", "policyType": "string", "policyConsumptionMB": 0 } ] } ] } } ], "meta": { "pagination": { "prev": 0, "next": 0, "first": 0, "last": 0, "count": 0, "offset": 0, "limit": 0 } } }   We have clientName values client1 and client2 with clientConsumptionMB values 123 and 456, respectively. Putting this into a synthetic search: | makeresults | eval capacity="{\"data\":[{\"type\":\"string\",\"id\":\"string\",\"attributes\":{\"masterConsumptionMB\":0,\"clientDetails\":[{\"clientName\":\"client1\",\"clientConsumptionMB\":123,\"policyDetails\":[{\"backupId\":\"string\",\"policyName\":\"string\",\"masterServer\":\"string\",\"policyType\":\"string\",\"policyConsumptionMB\":0}]},{\"clientName\":\"client2\",\"clientConsumptionMB\":456,\"policyDetails\":[{\"backupId\":\"string\",\"policyName\":\"string\",\"masterServer\":\"string\",\"policyType\":\"string\",\"policyConsumptionMB\":0}]}]}}],\"meta\":{\"pagination\":{\"prev\":0,\"next\":0,\"first\":0,\"last\":0,\"count\":0,\"offset\":0,\"limit\":0}}}" | spath input=capacity | rename "data{}.attributes.clientDetails{}.clientName" as clientName, "data{}.attributes.clientDetails{}.clientConsumptionMB" as clientConsumptionMB | eval consumption=mvzip(clientName, clientConsumptionMB, "|") | fields consumption | mvexpand consumption | eval consumption=split(consumption, "|"), clientName=mvindex(consumption, 0), clientConsumptionMB=mvindex(consumption, 1) | fields - consumption | stats latest(clientConsumptionMB) as clientConsumptionMB by clientName yields: clientName clientConsumptionMB client1 123 client2 456   mvexpand has no default result limit; it's memory bound by the max_mem_usage_mb setting in the mvexpand stanza in limits.conf. If you're hitting the memory ceiling, try reducing your footprint as I've done above. If that fails, try increasing (or asking your Splunk administrator to increase) max_mem_usage_mb. ... View more

@jadengoho  Here's an example regular expression that assumes the JSON object keys always appear in the same order. I've also corrected "Setup6.exe, to "Setup64.exe", in your sample data, assuming it was a typo. "FileName"\s*:\s*".*(?:vendor\.exe|stellar\.exe).*"\s*,\s*"FolderPath"\s*:\s*"(?=.*windows)(?=.*personal).*",(?:\n|.)*"InitiatingProcessFileName"\s*:\s*"Setup64\.exe",(?:\n|.)*"InitiatingProcessSHA1"\s*:\s*"bbcc123448781q40410bcd6f0a2cc666b52e7abc" ... View more

@mbasharat  It's unclear how you need to aggregate scores or map severity labels, but here's an example using random data that may provide inspiration: | makeresults count=100 | eval severity=mvindex(split("MINOR,MAJOR,CRITICAL", ","), random() % 3), score=round(10 * random() / 2147483647, 1) | stats median(score) as score by severity | rangemap field=score LOW=0.1-3.9 MEDIUM=4.0-6.9 HIGH=7.0-8.9 CRITICAL=9.0-10.0 default=NONE | rename range as adjusted_severity ... View more

@rkishoreqa  To remove the duplicate ApplicationName values with counts of 0 in the various Status columns, untable and then re-chart the data by replacing your final stats command with the following two commands: | untable ApplicationName Status count | chart max(count) over ApplicationName by Status ... View more

@Linnie25  As implied, you need to extract the country code value into a field. At search time, you can use the rex command with an appropriate regular expression: | rex "\\|[^|]*\\|[^|]*\\|[^|]*\\|[^|]*\\|[^|]*\\|[^|]*\\|(?<country_code>[^|]*)" | stats count by country_code ... View more

@Inthegetto  Splunk Supporting Add-on for Active Directory includes the ldapsearch command. When properly configured for your AD domain(s), you can search for users in both groups with an appropriate LDAP filter: | ldapsearch search="(&(objectCategory=person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=cn=GroupA,ou=Groups,DC=example,DC=com)(memberOf:1.2.840.113556.1.4.1941:=cn=GroupB,ou=Groups,DC=example,DC=com))" Running as a scheduled search, you can trigger an alert when the result count is greater than 0. ... View more

@rclifford  Assuming you've indexed message bodies (I wouldn't consider this a normal use case for Splunk), you can use the regex command to search for patterns. E.g.: index=all_the_emails | regex "\\d{3}-?\\d{2}-?\\d{4}" In a more typical scenario, a separate DLP solution would scan email in transit or at rest for indicators of data loss or exfiltration and send alerts to Splunk. ... View more

Are you referring to the Registry data set in the Endpoint data model? If your data is incorrect, you have field aliases, calculated fields, or field extractions on tag=endpoint tag=registry events that produce incorrect results. This could include automatic extractions on raw event text like "user=foo.exe." Start by determining which field-value pairs identify tag=registry. You can use Settings > Tags > List by tag name in the UI or run 'splunk cmd btool tags list --debug' on your instance. From there, review and correct knowledge objects for the related events. You can rebuild the data model or leave old, incorrect data in place while new events populate the data model correctly going forward, depending on your requirements. ... View more

@jessicadrechsel  Here's one possibility using timechart, appendpipe, and transpose: index=prod_test | timechart limit=0 span=1d useother=f count by dv_number | eval _time=strftime(_time, "%F") | appendpipe [ | stats avg(*) as * | eval _time="AVG" ] | transpose 0 column_name="dv_number" header_field="_time" ... View more

@samgol  You can get an approximate count by JSON key schema using something like this: | fields data | spath input=data | fields - data | foreach * [ eval <<FIELD>>="" ] | fieldsummary | fields field count | mvcombine field Note that two schemas with the same field counts will be combined into a single set. Another possibility is removing values and normalizing them to "" in data before grouping: | eval data=replace(data, "\" ?: ?(?:\"(?:\\\"|.*?)\"|[-\d\.eE]+)", "\":\"\"") | stats count by data {"a": "b"} => {"a":""} {"d": "x", "h": "e"} => {"d":"", "h":""} data    count {"a":""}    1 {"d":"", "h":""}    1 ... View more

@dgnatowski  Ensure you have properly defined hosts, sources, or source types for each event. After that, define your field extractions for the correct host, source, or source type. The index containing the event isn't normally relevant. In your case, input #1 and input #2 have different formats and should be defined as different source type. If you're using a common source type, e.g. syslog, then define your extractions based on host or source. ... View more

@KaitoKozo  In simple scenarios with a relatively small number of events, the transaction command works well enough: | transaction asset startswith=eval(switch_state==1) endswith=eval(switch_state==-1) | table _time asset duration | fieldformat duration=tostring(duration, "duration") ... View more

@anmouer  The timechart command span option supports binning by week (Sunday through Saturday): index=_internal | timechart span=1w@w count(eval(case(log_level=="ERROR",1))) as Error count as All_Request _time Error All_Request 2020-12-27 1 123 2021-01-03 2 456 2021-01-10 3 789 2021-01-17 2 123 2021-01-24 1 456 2021-01-31 2 789 2021-02-07 3 123 2021-02-14 4 456 2021-02-21 2 789 ... View more

@Hemnaath  For arbitrary JSON data, a simple way to summarize field values may be: index=xxx sourcetype=xxx:xxx:xxx httpsourcename=xxx | spath | fieldsummary ... View more

@mxanareckless  I have used constructs similar to this in the past: | dbxquery connection="my_connection" query="SELET * FROM tbl WHERE t BETWEEN ". [| makeresults | addinfo | eval t="\"'".strftime(info_min_time, "%F %T")."' AND '".strftime(info_max_time, "%F %T")."'\"" | return $t] You'll want to modify appropriately with TO_DATE, TO_TIMESTAMP, etc. for Oracle. ... View more

Is there a specific reason you need to execute multiple searches concurrently rather than provide an appropriately broad where clause? ... View more

@SplunkUserD  All searches will run with the same earliest and latest time values. Try manually adding earliest and latest values to your index=msad subsearch to accommodate the frequency of your AD input, e.g. earliest=-24h latest=now. You may also have more consistent results using the ldapsearch command appropriately configured to query your AD domain. You could try mapping your search results over ldapsearch to look up individual SID values. ... View more

@pragycho  I've not seen this error before, but I would guess it was an issue accessing or reading the contents of the dispatch directory on the search peer. Is additional error detailed provided in the peer log? Have you provided diag bundles from the search head and search peer to Splunk support? ... View more