Hey, I am having issues with changing the region color based on values, could you help me with it ? I have to show the status regions of HK, FR and TYO, and I just want the country to be highlighted in the world map based on the value. How can it be done ? ... View more

Hi. Can you tell me the spl how to fetch the password expiry date and username from search results ?  ... View more

I agree with this suggestion.  Going back to your original visual there is no current method to get items grouped the way you suggested.  Using a trellis gives you the bar graph that you want and you can break out individual items into separate graphs all on one dashboard/report sourced from a single search. ... View more

Hi @andrew15 , Are you sure about the port (443)?  Usually it's 8088, I guess also for Splunk Cloud (Classic). There are some Examples in the Docs. Ralph     ... View more

Something like this sourcetype="sfdc:transaction_log__c" (message = "*b2cforce-liveperson*" OR message = "*userId Retrieval Failure*") | eval isEvent=if(match(message, "b2cforce-liveperson"), 1, 0) | stats sum(isEvent) as Events count(eval(isEvent=0)) as Errors | eval FailureRate=Errors/Events*100 It's better if you can use something else other than matching message to differentiate between errors and events, but as long as events contain the b2c... text and errors do not, this should work.   ... View more

You can't do that directly in the splunk input phase. You can't keep "state" on event processing so you can't count events and keep track of which event you're processing at the moment. So there's no way to enforce the strictly "every 10th" rule. You can do somethig like time based as @rnowitzki suggested or try to implement some INGEST_EVAL logic to base your decision on random value (and check if it falls within some range) or - for example - message hash. But this will of course give you some percentage on average, not a strict 1 out of every N policy. ... View more

This could be also solution for you. https://community.splunk.com/t5/Splunk-Search/FileSize-to-human-readable/m-p/629602/highlight/true#M218718 | makeresults count=35 ```THIS SECTION IS JUST CREATING SAMPLE VALUES.``` | streamstats count as digit | eval val=pow(10,digit-1), val=val+random()%val | foreach bytes [eval <<FIELD>>=val] | table digit val bytes | fieldformat val=tostring(val,"commas") ```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.``` | fieldformat bytes=printf("% 10s",printf("%.2f",round(bytes/pow(1024,if(bytes=0,0,floor(min(log(bytes,1024),10)))),2)).case(bytes=0 OR log(bytes,1024)<1,"B ", log(bytes,1024)<2,"KiB", log(bytes,1024)<3,"MiB", log(bytes,1024)<4,"GiB", log(bytes,1024)<5,"TiB", log(bytes,1024)<6,"PiB", log(bytes,1024)<7,"EiB", log(bytes,1024)<8,"ZiB", log(bytes,1024)<9,"YiB", log(bytes,1024)<10,"RiB", log(bytes,1024)<11,"QiB", 1=1, "QiB"))   If you can install app or ask admin on your to install app, installing add-on Numeral system macros for Splunk enables you to use macros numeral_binary_symbol(1) or numeral_binary_symbol(2). Example | makeresults count=35 ```THIS SECTION IS JUST CREATING SAMPLE VALUES.``` | streamstats count as digit | eval val=pow(10,digit-1), val=val+random()%val | foreach bytes [eval <<FIELD>>=val] | table digit val bytes | fieldformat val=tostring(val,"commas") ```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.``` | fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`)   Numeral system macros for Splunk https://splunkbase.splunk.com/app/6595 Usage: How to convert a large number to string with expressions of long and short scales, or neither. https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-large-number-to-string-with-expressio... ... View more

I was looking for the same Document. Found it in the Internet Archives 🙂 http://web.archive.org/web/20171227002107/https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F   ... View more

perfect thanks ... View more

So, there is no "Status" field in the Lookup, that's why it didn't map. I assume the field "Error_Code" is what you want to map with the "Status" from Query 1. | lookup blabla.csv Status as "Error_Code" OUTPUT Action ... View more

Hi @georgear7 ,  Have you found solution for this scenario? If so, Kindly share it.   ... View more

I had the same issue after copying a known working server.conf file (with encrypted pass4symmkey) to new peer, and once i had it on the new peer I updated the password (so that it wasnt encrypted) and saved.     BUT then i realized it was in "DOS" format, and I used vim command ":set ff=unix" and then saved.  Switching from DOS to UNIX file format is what mangled it so that it could no longer be used. To resolve, i opened server.conf and removed the encrypted pass4symmkey and replace it with the unencrypted value and restarted. ... View more

You could include a negative lookback to ensure ERROR isn't preceded by LogLevel= |rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)" ... View more

Thank you, problem is solved ... View more

thanks Ralph. I got the output now. I really appreciate your help on this. ... View more

Hi  @gvssaicharan , Try this: | eval month=strftime(strptime(checkDate,"%Y-%m-%dT%H:%M:%S.%Q"),"%m") | eval quarter=case(month<=3,"Q1",month<=6,"Q2",month<=9,"Q3",month<=12,"Q4") | eval year=strftime(strptime(checkDate,"%Y-%m-%dT%H:%M:%S.%Q"),"%Y") | eval year_quarter=year."_".quarter BR Ralph ... View more

Nope, you can use it as-is. Doesn't really matter in this case, but I wanted to be sure I don't tell BS and tested it (again) 🙂 : BR Ralph ... View more

Hi @kaspean  Try it with where like instead of the regex command: | where like(file_name, filename_expr) BR Ralph ... View more

hi @mariamathewtel, You can use autoregress to move Duration values to one row up. Try this:   index="abc" host=xxx | eval Indicator=if(state=="RUNNING", "10", "0") | timechart span=5min min(Indicator) as "Trend | delta Trend as diff | where diff!=0 | delta _time AS Duration | eval Duration=tostring(abs(Duration), "duration") | reverse | autoregress Duration as Duration1 | reverse | rename Duration1 as Duration   If this reply helps you, a like would be appreciated. ... View more

Great!, can you please mark as accepted solution for helping to other users. ... View more

Hi @wcastillocruz, What exactly does not work. No output or wrong output, errors? Some trouble shooting suggestions: Are the tokens actually working?  Maybe check with this simple evals: | eval first=$earliest$ | eval last=$latest$ | table first, last If they actually contain the data, then the next thing is to check if the calculation is correct. I think you have to change the order in your math like; | eval periode = $latest$ -  $earliest$ In epoch seconds, "latest" is the bigger number, so extract earliest from latest. Check these 2 items. If it still does not work, try to debug by removing one SPL line after another to check if the disired output comes. So, first remove the last line to check if    | stats sum(duration) AS duration_indispo by Function results in a valid number for duration_indispo If not, remove the line also to check if periode  has the corret value and so on. BR Ralph ... View more