I guess there are a couple of things to try. Firstly, depending on your searches, you may or may not use double quotes around index names, so trim those. Secondly, again depending on your searches, you may be searching more than one index, so use max_match=0. Finally, title is returned by saved/searches so you should probably override that with the index name found. | rest /services/data/indexes | fields title | dedup title | append [ | rest /servicesNS/-/-/saved/searches | rex field=search max_match=0 "index=(?P<searchindex>[^\s]+)" | eval title=trim(searchindex,"\"") | stats count by title ] | stats values(*) as * by title | where isnull(count) ... View more

Hi @vinitpathri  List all the names of indexes     | eventcount summarize=false index=* index=_* | dedup index | fields index​ 2. List all the saved searches alerts        | rest /servicesNS/-/-/saved/searches | search is_scheduled=1 | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search​     3. Compare the search field with the index field by joining these two outputs and running a search command.   Did I get your requirement correct? if yes then I can think of creating a join to give  you desired result 🤔 ... View more

Hi @vinitpathri , it's a best practice that all the Splunk componentes send their logs to Indexers, so if you run a search on Splunk _internal logs, you can have the downtime of a Splunk component. you could create a lookup (called e.g. perimeter.csv) containing all the servers (in the column host) of your Splunk infrastructure to monitor and run a search like this: | metasearch index=_internal [ | inputlookup perimeter.csv | fields host ] | timechart span=10m count BY host | where count=0 | delta _time AS diff | where diff=600 | stats sum(diff) AS total BY host Ciao. Giuseppe ... View more

done thanks again ... View more

<your current output>|rename "day of the week" as day|eval day=case(day="Wednesday" OR day="Thursday" OR day="Monday" OR day="Tuesday" OR day="Friday","weekday",day="Saturday" OR day="Sunday","weekend")|stats avg(Number) by day Take care of the string cases and spellings ... View more

Hi You can try this also | makeresults | eval str="14/04/2020|A3|ABC149251|text" | rex field=str "(?P<output>[^|]+)$" ... View more

What parameters you're looking for? you can check the documentation here : https://docs.splunk.com/Documentation/MLApp/5.1.0/User/Algorithms#StateSpaceForecast Also, Arima ( not auto arima) is available out of the box in MLTK. Check that option too. ... View more

Agreed, but that's not how it works with indexes and Splunk. That's what I meant by "not logical". ... View more

last command is correct with just a small correction instead of index=_audit user=username "action=password change" it should be index=_audit user=username action="password change" ... View more