The as av1 just tells splunk to name the average av1. window=5 says take the average over 5 events (by default) including this one. So the average of slot 1-5 goes in slot 5 , 2-6 in slot 6 and so on. But there is an extra option you can say, current=false . This will then over ride the default and use the previous 5 not including the current one. So slot6 has the average of 1-5, slot7 has 2-6 and so on. ... View more

The streamstats command is designed to reference previous events. That is previous in the order you see them on screen so sorting will allow you to reference the next one. Try this. mysearch | streamstats current=false window=1 first(f1) as next_f1 first(f2) as next_f2 | sort _time | streamstats current=false window=1 first(f1) as previous_f1 first(f2) as previous_f2 | sort _time | table previous_f1 f1 next_f1 previous_f2 f2 next_f2 But be aware that streamstats does not map reduce so should be used as late as possible in a search string. Bob ... View more

No! I'm afraid this is not retroactive. All new data will use this configuration but old data will not be updated. The only way round it is to force splunk to delete and re-index the data. 😞 ... View more

It looks like the search should work providing the user has access to all the same knowledge objects and indexes. Check try the following 2 searches. index="login_data" sourcetype="Login_Data | stats count by SignonID index="hrxref_data" sourcetype="HR_XREF" | stats values(LVL1_MOID) values(MOID) values(SignonID) values(EMP_NAME) If any of the searches or columns are empty, look to see if the user can see the index and that field extractions are not private. ... View more

You will need to put your command in a bat file. Save the file in a bin directory in the system or your app. $SPLUNK_HOME/etc/system/bin/ $SPLUNK_HOME/etc/apps/<APPNAME>/bin/ Then add it as a scripted input. The following page will give you more detail. http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs ... View more

Or if you are looking for the last few in other circumstances, you can use tail. ... | tail 20 ... View more

so add another function. | stats values(ip) as IPs dc(ip) as ipCount by url | sort - ipCount ... View more

would this be what you want? | stats values(ip) as IPs by url ... View more

If you do not have that extraction, you are probably missing other usefull information. I suggest you install the free "Technology Add on for Cisco ASA" to all your indexers and search heads. http://splunk-base.splunk.com/apps/58196/technology-add-on-for-cisco-asa ... View more

For most firewalls, though technically we probably could install a forwarder, it is recommended by security experts to set the device up to send it's logs by syslog. You will have to look at the manufacturers instructions on how to do that. Then you can set splunk to listen for syslog. The easiest way to do this is explained here http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/SyslogUDP ... View more

Assuming the number after the + is 10,000ths of a second you can tell splunk to use this with :- TIME_FORMAT = %Y-%m-%dT%H:%M:%S+%4N If it is consistently +0000 you can specify it in the time format. TIME_FORMAT = %Y-%m-%dT%H:%M:%S+0000 ... View more

Whitelists and blacklists are only used at inputs phase and match against source names, normally file names or folders. It sounds like you want to discard individual events which can not be done until parsing phase. This must be done on the indexer and the link Ayn provided explains how to do this. ... View more

If the network knows that computer by the name world then yes. Quite often a computer will use a name for itself that the network does not understand and this may be the case here. If this is on a private network you may have to use the ip address. To find out the computers ip address open a cmd, dos or terminal window and run the command ipconfig You wil see a set of 4 numbers seperated by dot probably starting 192.168. Use this in place of the computer name. ... View more

Splunk is accessed with a browser so any computer on your network should be able to connect to it provided you don't have firewalls blocking them. If you haven't made any changes, point your browser to port 8000 on the other computer. http://computerA.mycompany.com:8000 ... View more

Hi Theo If your server was down for a clean hour, it would be a simple task to use cron to schedule it. For example the following would work every 5 mins from midnight to 2:55 and then 4:00 onwards. */5 0-2,4-24 * * * For your timing, this is not so simple. I would normally use the date_hour and date_minute fields to calculate the time but your report may not have them. What you could do is modify the search by adding the following at the end of the search. | eval timeInMin=(now()-relative_time(now(), "@d"))/60 | where (timeInMin < 3*60+14) OR (timeInMin > 4*60+16)| fields - timeInMin This would delete any results if the time was between 3:15 and 4:15. If this doesn't work, please tell us how you have your alert set up. ... View more

For your specific example, you should be able to use the following. I am assuming there are no 4 Level Domains or longer. \bquery: (? < fulldomain>(?<2_LevelDomain>[^.s]+.[^.s]+)|(?<3_LevelDomain>[^.s]+.[^.s]+.[^.s]+))$ ... View more