I have a eval on a dashboard that used to work but it stopped and I havent been able to figure out why. On the dashboard im taking the _time and turning it into a human readable string using `strftime(_time, "%m/%d/%Y %H:%M:%S %Z")` and that works great. The problem comes in when I try to convert it back later for making a link to a search. For example: ``` <eval token="endTimestamp">relative_time(strptime($row.Timestamp$, "%m/%d/%Y %H:%M:%S %Z"), "+30m")</eval> ``` Used to work and return the unix time that I added 30m to, but now `strptime` just returns NaN but this is the right format. I've checked out all the Splunk docs and everything looks right but it still is broke. Any idea what I could be doing wrong? Here is the snippet from my field row im making: ``` <condition field="Search"> <eval token="startTimestamp">$row.Timestamp$</eval> <eval token="endTimestamp">relative_time(strptime($row.Timestamp$, "%m/%d/%Y %H:%M:%S %Z"), "+30m")</eval> <eval token="corKey">$row.Correlation Key$</eval> <link target="_blank">search?q=(index=### OR index=###) earliest=$startTimestamp$ latest=$endTimestamp$ correlationKey=$corKey$</link> </condition> ``` I have taken out everything but the $row.Timestamp$ and that returns something like `10/03/2021 07:41:27 PDT` which is the format that I put into it, I just cant do the reverse. I have copied and pasted the format from the `strftime` and still no luck converting it back so I can do math on it. Any suggestions? ... View more

I have events that often have lager JSON data in them, however, I need to send additional data along with them. Typically my events will look something like this:   timestamp="2021-03-02 11:46:48,745" correlationKey="30C05D96A7544BF3948034BE0C" level=INFO message="{'json': 'test'}"   What I would like to do is cover it so that the JSON gets formatted but allows me to keep the rest of the data in the event so that I can use the items like correlationKey. Is there some way I could do this? Perhaps with a custom source type? Right now if the JSON is too large it bogs down my search UI really badly when it has hundreds of lines of JSON. I want to be able to log the raw JSON response, though. ... View more

I have a search using timechart count by [value] and I'd like to set up an alert for when any of the values reach more than 25 results in 30 minutes. Search: index=[redacted] ... | rex field=message "responseCode : (?<response>.*)," | rex field=message "errorMessageKey : (?<response>.*)," | timechart span=30m count by response usenull=f useother=f The response comes back like Application.errorMessage simple and short string. How can I achieve this? ... View more

I have events that happen in pairs. A request and a response from a server. What I would like to do is be able to easily table those side by side. Right now they return in the normal table but id like to be able to see them side by side instead. Right now I'm rexing out the data to able it. Is there a way to accomplish this? I need them in pairs of 2. So if some reason there is 4, which isn't normal, it would do two rows with 2 columns. This is what I'm doing right now: [query] | rex field=message "(Received|Sent) raw (?<processor>.*) (response|request) (?<raw_message>.*})" | table raw_message ... View more

I have a stats query that I would like to fire only when a new value for a field comes in. I have my alert set up like this: I can run the search in the alert and I see values, but the alert does not fire, what do I have set up wrong? ... View more

I have event logs with a % in them and I want to break them apart and show them on their own: My event log looks like this: Tue May 5 12:55:01 PDT 2020 /dev/sde2 9460988 7233068 1751044 81% /Volumes/Media 2 /dev/sdc1 13245631 12470714 107304 100% /Volumes/Media Id like to turn it into this: But with it showing the %'s as a total out of 100% (so 100% used and 81% used) ... View more

I have my docker set up to send events via HEC, however id like to set the host as well since I have multiple services running on the physical host. I have tried setting it in tag and label, with no success. Is there a way I can pass in the host parameter from docker to Splunk HEC? ... View more