I want to search for events related to a list of IPs that are declared on a public URL. How can I insert this URL for ask this list in my Splunk request ?       ... View more

Hi all I use a lookup file with a mix of ranges of IP and unique IP to count events of login My file is like this ip,entity 10.0.1.0/24, A 10.0.2.0/24, B 12.0.0.4,C 12.0.0.8,C I configure my lookup file with CIDR option but the result of search only extract the events of ip integrated in ranges of ip. I woulld like to extract all the results how can I solved this with only one lookup file ? ... View more

I want to compare statistics of events between 2 weeks, day per day. I count events for every day in real time but when I compare last day versus first day delta is not coherent For example, if my request is launched at 10am, it compares For today, the number of events between 0 to 10am and for the same day last week, the number of events between 10am to midnight. I want to compare for today, the number of events between 0 to 10am and for the same day last week, the number of events between 0 to 10am mysearch | timechart count as sendOK | timewrap w | eval delta=round((sendOK_latest_week - sendOK_1week_before)*100/sendOK_latest_week,2) ." %" | table _time delta How to compare the same period? ... View more

First I search the number of login by sector for users with a mobile mysearch | stats count as loginOK by sector The result is like : Secteur login S1 25 S2 56 S3 12 My second search, in another log, counts the number of users passing through different authentication modules mysearch2 | stats count by module sector2 The result is like : Secteur module1 module2 module 3 s1 25 15 12 s2 56 51 42 s3 12 9 8 This second search pulls me the information of all mobile users or not. But I only want the mobiles results I can't join the 2 searches to count only kinematic of users with a mobile. mysearch | stats count as loginOK by sector | join [search mysearch2 | stats count by module sector2 ] | lookup sector_sector2 sector output sector2 | table sector2 module1 module2 ... ... View more

I would like to extract the text of tag3 in xml file like that : When i search the texte tag2 it's ok mysearch | xpath "//tag1/tag2/@name" output=name | chart count by name What is the syntax of request to extract the text of tag3 ? None of those searches are OK mysearch | xpath "//tag1/tag2/tag3" output=text | chart count by text or mysearch | xpath "//tag1/tag2/tag3" outfield=text | chart count by text Thanks for your help ... View more