Hi All, I have looked around on the community but I am unable to find anything that matches what I'm looking for, so apologies if this has already been asked somewhere. I am trying to figure out how to do an automatic lookup in Splunk where the field already exists, and I just want to append an additional field into an existing field for things that match. For example, I have a CSV called Exclusions.csv ID Computer STATUS 1 X EXCLUDED 2 Y EXCLUDED 3 Z EXCLUDED 4 B EXCLUDED In my index there are already fields called ID, Computer and STATUS. I want to create an automatic lookup which matches ID and Computer and if they do match output EXCLUDED into the STATUS field. I have done this. However, the problem that I am having is that, if nothing matches in the lookup, the STATUS field for the existing data disappears. Has anyone experienced this problem before? Any help would be great. ... View more

Hi All, I've made a script in PowerShell which utilizes the REST API input that I have. This script is for downloading extremely large amounts of data from Splunk. The problem that I am having is that Invoke-WebRequest is timing out and I cannot get the query to complete. The query stays connected for ~5minutes and times out. Code: [System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true } [System.Net.ServicePointManager]::MaxServicePointIdleTime = 5000000 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $User = "admin" $File = "C:\Temp\Password.txt" $MyCredential=New-Object -TypeName System.Management.Automation.PSCredential ` -ArgumentList $User, (Get-Content $File | ConvertTo-SecureString) $server = 'SPLUNKSERVER' $url = "https://${server}:8089/services/search/jobs/export" $search = "search index=_internal earliest=-5m@m | stats count by sourcetype" $body = @{ search = $search output_mode = "csv" earliest_time = "-5m" latest_time = "now" } Invoke-WebRequest -Method Post -Uri $url -Timeout 3600 -Credential $MyCredential -Body $body | Set-Content C:\Users\User1\Desktop\test.csv Thanks! ... View more

Hi All, I have three dates which I need to compare, the dates that I have is: date1=03/29/2018 04:59:26 #this can be any date/time and changes date2=03/28/2018 12:00:00.000000 date3=03/29/2018 12:00:00.000000 I want to check whether the date1 falls between date2 and date3 - can this be done? If date1 falls between date2 AND date3, assign value X, if NOT, assign value Y Thanks ... View more

Hi guys, Wondering if anyone can help me and if this can be done. I have a CSV file with two columns. CSV file looks like this: domain_name Reference abc.com ABC bbc.co.uk BBC In my index, I have a field called domain_name in which I can run the following search on: index=data [|inputlookup test.csv | fields domain_name] The above search works, however, I want to also reference that domain_name to the Reference column in the CSV file. This is where the problem starts because there isn't a Reference field in the index=data, so the search fails to find any results. My end goal is to get a number of References against the domain_names so it looks like this: Reference count ABC 150 BBC 25 Can this be done at all? ... View more

Hi, I'm trying to run this search: index="proxy" [|inputlookup TEST.csv | return 2 $IPs $dates] My TEST.csv file has the following: IPs dates 10.10.10.10 earliest=11/27/2015:10:00:00 latest=11/27/2015:11:00:00 10.10.10.2 earliest=11/26/2015:10:30:00 latest=11/26/2015:11:30:00 I'm getting the following error: Error in 'litsearch' command: Unable to parse the search: Invalid time bounds in search: start=1450255314 > end=1448622000. If I remove the 2 in the search, so that it's like: index="proxy" [|inputlookup TEST.csv | return $IPs $dates] it only returns the first row in my CSV and doesn't parse the second one. Is there a problem with my CSV, or is there a better way to do this? I have a list of about 150~ entries. Any help would be great. Thanks. ... View more