I have 2 queries 1st is  | rest /services/data/indexes | fields title | dedup title | table title this query is giving me all the indexes in my environment   2nd query is | rest /servicesNS/-/-/saved/searches | rex field=search "index=(?P<title>[^ ]+)" | stats count by title | sort -count | table title this is giving me all the indexes on which any savedsearch is created.   Now i want to see the remove the 2nd query set from 1st and just wanted to see the indexes on which there are no savedsearches in the environment. I have tried placing "NOT" between the queries but not able to get the desired result. Please help   Thanks in advance. ... View more

There is a Dashboard in JV Firewall named as "Basic Infra Delta Analysis" Location : Basic Infra-> Basic infra delta analysis After selecting the "Addition" or "Removal" from the prompts, last panel named as "Additional Analysis" and "Removal Analysis" respectively is showing below error   but when i am clicking lens symbol to see the query   then the query is running and showing the output Query is taking more than 300 seconds. What could be the possible cause? please help if anyone else also faced the same issue.   Thanks in advance ... View more

I am scheduling an alert with cron for every 5 min */5 * * * * everything is going fine but when i am checking in "searches, report and alert" section the "next schedule time" is showing as none. this is the standalone environment. please help me in finding out what exactly is going wrong.   Thanks in advance ... View more

i want to see which all feeds are there which are not getting used in any use case or in any report/alert or anything. kindly suggest me the way to check those indexes   Thanks in advance. ... View more

i want to find out the time for which a host was down , please share the query to check the same.   Thanks in advance ... View more

i want to check app the add-ons or apps in my environment along with the version we are using. doing it manually by going on every forwarder and checking it is a pain , is there any command which can give me this data in 1 go will be really helpful. Thanks in advance ... View more

i have data on daily basis. Date Number day of the week 2019-05-02 52.55 thursday 2019-05-03 327.57 friday 2019-05-04 279.97 saturday 2019-05-05 266.87 sunday 2019-05-06 374.41 monday 2019-05-07 301.24 tuesday 2019-05-08 373.11 wednesday i want to write 1 query which shows me the data as average for weekdays and average for weekends separately say in the above case the output should look like weekend : 273.42 weekday : 285.77 thanks in advance ... View more

i have a string 14/04/2020|A3|ABC149251|text i really need can i run something which will trim this string from the end till it get 1st | (pipe symbol)? i tried rex for this but some error is coming which i am not able to resolve, so thought of taking it the above way. regular expression i am trying is (?^\d{2}\/\d{2}\/\d{2,4}|A\d|\ABC\d*|)(?[\w*\s-]+). getting below error Error in 'rex' command: Encountered the following error while compiling the regex '(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\INC\d*|)(?[\w*\s-]+)': Regex: unrecognized character follows . please either correct my regex or let me know how to trim ... View more

i am creating a model for the prediction of license usage in our environment. tried many combination(around 25) of p,d,q for ARIMA, got few results which are best among the rest . i want to know is it possible to use auto-arima in splunk? if yes the please share the SPL. Thanks in advance ... View more

index=_internal host=abc123 source="metrics.log" group=tcpin_connections fwdType=uf |dedup hostname |table hostname i am putting hostname= xyz578(output of above query) in the below query index=* host=abc123 "xyz578" but not getting any output please help me with this missing part. ... View more