I have a dashboard with 65 panels (all are parsers). It is taking a while to load. I am having 4 base searches to use across the 65 panels, still I am facing some lag in loading the entire dashboard.  For a better viewability, I categorized the panels based on their utility and showing them in tabs using CSS. For for performance perspective, I dont find any other option other then using Base Search, but it isn't helping me either.  Please provide effective ideas for improving the performance without recuding the number of panels involved. ... View more

I am trying to find the occurrence whenever the state changes due to the error. Below are my sample events: 2021/08/01 07:12:12.098 host=12345 In 2021/08/01 07:13:12.098 host=12345 In 2021/08/01 07:14:12.098 host=12345 Out 2021/08/01 07:15:12.098 host=12345 Out 2021/08/01 07:16:12.098 host=12345 In 2021/08/01 07:17:12.098 host=12345 In 2021/08/01 07:18:12.098 host=12345 Out 2021/08/01 07:18:35.098 host=12345 ERROR 2021/08/01 07:19:12.098 host=12345 In 2021/08/01 07:20:12.098 host=12345 Out I need to group the events when the state (In/Out) changed due an ERROR event. For the above sample events, I should not get any result. Because, when the ERROR event happened, the host is already in "Out" stage. We need to monitor only when a "In" host changes to "Out" due to an ERROR. I tried the below search   index=myindex ("Cut-In" OR "Cut-Out" OR "ERROR") | rex "host=(?<host>\d+) (?<State>.*)" | transaction host startswith="State=In" endswith="Out" maxspan=24h | where searchmatch("ERROR") | table _time host   But the above query returns a result by grouping the "In" state which logged at "07:16:12" as start of the transaction and "07:20:12" as end of the transaction. This is not a valid scenario. Please help me in framing the logic. ... View more

I have a transaction similar to the below one: 02/06/2018 15:10:30.560 Starting transaction 02/06/2018 15:20:90.150 Message A 02/06/2018 15:21:33.480 Message B 02/06/2018 15:23:57.442 Message B 02/06/2018 15:24:12.772 Message B I need to find the timestamp of the first occurrence of the message B event i.e., 02/06/2018 15:21:33.480 in the above example. I cannot use endswith=Message B, as I also need the events that happened after it. Appreciate for the suggestions. ... View more

I have configured the Data Input REST API settings as per the following link. While trying with the REST URL in browser I am getting the JSON response. But, when I tried to test it in Splunk, I am getting the following error in splunkd -0500 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\rest_ta\bin\rest.py"" Exception performing request: HTTPSConnectionPool(host='api.nytimes.com', port=443): Max retries exceeded with url: /svc/search/v2/articlesearch.json?api-key=7d61953a50c1446e9e95aa634f35fa9c&sort=newest&q=snow (Caused by <class 'socket.error'>: [Errno 10054] An existing connection was forcibly closed by the remote host) I am getting the same error for any REST API. I have used REST API Modular Input app, Splunk Add-on Builder App to test this REST API Input, but with no luck. ... View more

I haven't used any lookup table in my dashboard. But still I am facing "The lookup table XXX does not exist. It is referenced by configuration YYY" error. I have checked the permission settings of XXX in Lookup definitions, Automatic lookup, Lookup table files & Configuration settings of YYY. Each one is been set as Global. What's wrong with my Splunk then? ... View more

I have the following log data: Number of Users:3 [1]UserId:1 NumberOfUserRoles:2 [1]UserRoleCode:1 UserRoleText:Admin [2]UserRoleCode:2 UserRoleText:Developer [2]UserId:2 NumberOfUserRoles:1 [1]UserRoleCode:1 UserRoleText:Developer [3]UserId:3 NumberOfUserRoles:1 [1]UserRoleCode:1 UserRoleText:Tester I need to parse the above fields as following result: NumberOfUsers UserId UserRoleCode UserRoleText 3 1 1 Admin 2 Developer 2 1 Developer 3 1 Tester In the above results, UserId, UserRoleCode & UserRoleText are multivalue fields. I used traditional rex command with max_match attribute but this is not working. | rex "Number of Users:(?<NumberOfUsers >\d+)" | rex max_match=0 "UserId:(?<UserId>\d+) NumberOfUserRoles:(?<NumberOfUserRoles>\d+)\n(?<teststring>.*)" | rex max_match=0 field="teststring" "UserRoleCode:(?<UserRoleCode>\d+) UserRoleText<.*>:(?<UserRoleText>.*)$" But the above is not working. Please suggest how to parse the above message to get the expected result. Thanks. ... View more

I am facing a weird issue with sid. I have a saved sid with yesterday's (00:00 to 23:59) data, which is showing a dip in my messages during yesterday evening. But, for the same query (since there is no change in the query, i believe I don't need to provide my query here) and for the same time frame, if I try to run as a new search, I do not see the dip. Since, both are having same query & timeframe, how the results would change? Is there any difference in this? Someone please explain. ... View more

I have to forecast data for next 15 days, based on the last 30 days data. I have used the following query: sourcetype=mylogs (message=1234*) | timechart count as msgs span=1m | timechart avg(msgs) as msgs_daily_avg span=1d | predict msgs_daily_avg algorithm=LLP period=30 future_timespan=15 The search is getting me the results. But the performance is taken for beating. The time frame to collect data is "Last 30 days". It is almost taking 20-25 minutes to fetch the entire results along with the predicted values. Is it because of the predict keyword which I used or the time frame which I set? Can I update the results in a file by running the above query in a report and use the data in the file to populate them in dashboard panel? How can this be done to avoid the performance issues? ... View more

Consider I am having two string - "YY02State" and "Y02State" In the above strings, I have to extract the fields like: Y - IsStateLegal Y - IsStateSafe 02 - StateId State - NameOfState There might be instances when the IsStateSafe field is not available in the log entry, like it is in the second string "Y02State" . How can I write rex for this? Please note the other fields will always be available. I tried the following rex, but of no luck. (?<IsStateLegal>\w{1})(?<IsStateSafe>\w*.{1})(?<StateId>d{2})(?<NameOfState>\w*) Please suggest a solution for this. ... View more

These are some sample of my logs : "07PRIVATE" or "06SAMPLE" OR "08EXAMPLES" The first two digits are the length of the string which follows the digits. Hence, I need to form the query based on the first field's (2 digits's) value. I tried the following regex: (?<StringLength>\d{2})(?<MyString>\w{StringLength}) I could clearly see that the above regex is wrong. Please suggest how this can be done. ... View more