This is perfect. Thank you very much! ... View more

In the props.conf example, when it says "REPORT-file_name = url_domain", what should I replace file_name with? I'll stay tuned, thank you very much. ... View more

It is also from both a manual search and a dashboard. ... View more

How can I do this? Note that the forwarder is an Edge Processor and you can't touch the conf files, everything is modified in the GUI. ... View more

You are deduping 'x' so you need to understand the consequences of that. Your search is not doing any aggregations, so without knowing what combinations of Application, Action and Target_URL you have, it's impossible to know what's going on here. These 3 lines are most likely the source of your problem | mvexpand x | mvexpand y | dedup x   ... View more

Hi @mahesh27  As @bowesmana said, this is a classic proving the negative issue and you can find thousands of answers in Community. In this case you have two solutions: if you have a list of hosts to monitor to put in a lookup (called e.g. perimeter.csv with at least one column called host), you could run something like this | tstats count WHERE index=app-logs sourcetype=app-data source=*app.logs* host IN (appdatajs01, appdatajs02, appdatajs03, appdatajs04) BY host | append [ | inputlookup perimeter.csv | eval count=0 | fields host count ] | stats sum(count) AS total by host | where total<100 If you don't have a lookup or you don't want to manage it, you could run something like this: | tstats count latest(_time) AS _time WHERE index=app-logs sourcetype=app-data source=*app.logs* host IN (appdatajs01, appdatajs02, appdatajs03, appdatajs04) earliest=-30d@d latest=now BY host | where _time<now()-3600 In this way, you have the hosts that sent logs in the last 30 days but not in the last hour (you eventually can modify the time periods). in addition the command | bin span=1m _time has no sense because you don't use time in your stats. Ciao. Giuseppe ... View more

Great, thanks - that makes it easier! OK, so it looks like you are trying to compare fields in two separate events - you can't do that unless you collapse the two. You should use rex to extract a single filename and then do something similar to my previous post. Here's an example that hopefully will point you in the right direction. It creates two events 60 seconds apart each containing a filename - the rex statements extract filename and logtype and the stats will join the events together and by using min and max on _time you can get the start and end times for the pair of events. The final where clause will ensure that you have seen both loga and logb events. | makeresults | eval v=split("log a: There is a file has been received with the name test2.txt###log b: The file has been found at the second destination C://user/test2.txt", "###") | mvexpand v | streamstats c | eval _time=now()-(60*c) | rename v as _raw ``` Above is simply a data set up example ``` | rex field=_raw "(/[a-zA-Z0-9]+\/|name )(?<filename>[^\"]*)" | rex field=_raw "log (?<logtype>\w)" | stats count min(_time) as Starttime max(_time) as Endtime values(logtype) as logtype by filename | where count=2 AND logtype="a" AND logtype="b" | eval diff = Endtime - Starttime Hope this helps. ... View more

You have not done what I suggested, you have changed the SPL to something that will not work. Please use the exact code I provided after your timechart command   ... View more

Here's a simple example <form version="1.1"> <label>HostDropdown</label> <fieldset submitButton="false"> <input type="dropdown" token="hosts" searchWhenChanged="true"> <label>Host Types</label> <choice value="prodhost*">Production</choice> <choice value="qahost*">QA</choice> <choice value="testhost*">Test</choice> </input> </fieldset> <row> <panel> <table> <search> <query> index=aaa source="/var/log/test1.log" host=$hosts$ |stats count by host </query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> I suggest you look at this and have a look through the documentation that describes this https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML   ... View more

@bowesmana , thank you for ur inputs. We created queries according to our data working now. Thank you once again. ... View more

The search did not work. Looks like it is may be cause by the data index. I checked the monitoring console and did a health check. showing License warning and violations. Category showing data indexing. ... View more

I just checked on a Splunk Cloud SHC and saw to difference in expansion time so I suspect there's something happening in your environment. Do you see any relevant messages in splunkd.log on the SH? ... View more

What you suggest is not possible in a single search. Assuming the cardinality does not change much over the 24h period I don't suppose there is benefit in running the search hourly - which would produce more metrics and would need to be aggregated on consumption. However, you could create N searches where the body of a search is a single macro, which runs your base SPL and you call the macro with the device id prefixes you want to search for. Not an elegant solution - but functional.  I don't understand the message you say you are getting though - I am not familiar with that - secondly what is the impact of that message occurring - does it break the collected data in some way and does it stop other searches from working? ... View more

timechart 명령에서 "fixedrange=f" 설정을 사용할 수도 있습니다.   ... View more

The reason why your subsearch is taking a long time is _probably_ due to the volume of hosts, because using a large X=Y OR A=B OR C=D expression in the search can be very slow to get parsed and setup, hence the lookup option can often be the better option. The second way is fundamentally on a different planet to your concept of the previous search. Using join in itself is limited and using join+inputlookup is a completely wrong way to use lookups. The lookup command is designed to enrich data with results from a lookup. If a result cannot be found in the lookup, you will not get results from the lookup and you can validate that state. Have you tried it? ... View more

Try something like this index=events event.Properties.errMessage!="Invalid LoginID" event.Properties.errMessage!="Account Temporarily Locked Out" event.Properties.errMessage!="Permission denied" event.Properties.errMessage!="Unauthorized user" event.Properties.errMessage!="Account Pending Verification" event.Properties.errMessage!="Invalid parameter value" | stats count by event.Properties.errMessage ... View more

Thank you for your help, but I figured out what was wrong. The query I am using pulls data from a relational database. We have created a macro that converts the SPL into the query language for that DB and part of that includes the time frame. So essentially, for those queries the time picker is irrelevant. As I stated previously, the query works fine in the splunk search bar. However, in the dashboard, the query is the PARENT Query, and the results are filtered by subsequent child queries. The child queries have no concept of the earliest or latest,  even though they are supposed to inherit that from the parent query, and the SPL doesn't allow you to put that code in after the filter query. Our problem was that since the Parent Query didn't use the earliest and latest times, we deleted the code that defined that after the query. Once I reinserted the code for the earliest and latest times after the Parent Query, the Single with trend lines worked as they should. ... View more

Minor point, but the number of seconds in a day is 86400, not 86000. ... View more

Create a composite field with the two labels concatenated and count by that I am not sure how to create composite filed, could you please advice on this please   ... View more

Yes, that is very odd that it just removes fields if the viz space is not big enough and certainly not intuitive! ... View more