It seems like you may be able to accomplish what you want with an eval: index=cs | rex "Type=(?<type>[a-z]+)" | eval AResponse.BResponse.Message = replace('AResponse.BResponse.Message', "Ref number \w+ failed on num: ", type." failed on num: ")   ... View more

Edited after I learned to read: You should be able to use the replace function for this:   | where customer="foo" AND like(Register,replace("$tok_reg_num$", "\*", "%"))   Original Reply: Try using searchmatch in your where statement.  It will take a regular SPL search statement and is compatible with the asterisk as the wild card.   | where customer="foo" AND searchmatch("Register=\"$tok_reg_num$\"")   ... View more

Right now you have the optional closing quote inside of your capture parenthesis. Try moving it outside with something like this: operation="?(?<operation>[^\,"]+)"?, See the working example here: https://rubular.com/r/KvJKsg4drQl51V ... View more

Try this: | makeresults | eval user="qwerty\foo" | eval ruser=replace(user,"\\\\","\\\\\\\\") In SPL, the escape has to be escaped so everything doubles. If you want to find a backlash, you would normally look for \. But in SPL you have to escape your escape: \ and then escape the backslash you are trying to find with another \. https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/SPLandregularexpressions ... View more

Are you trying to get the average for the previous month or the last ~30 days? For example, are you looking for June or June 16 - July 16? The easiest would be to pick your actual time range from the Time Picker controls. Taking your examples, you most likely want to do something like you specified: earliest=-1mon latest=now . But make sure this is doing what you want. You are telling Splunk to return the data since June 16th starting at the current time. If instead you want the previous month, you can do this instead: earliest=-1mon@mon latest=@mon . This will search for data between 2019-06-01 00:00:00 and 2019-06-30 23:59:59. bucket _time span=1mon is not going to do much for you unless your also include the _time in your stats command: | stats avg(sent_data) as sent_data avg(received_data) as received_data, values(SITE) as SITE by _time, USERNAME This will round each time stamp down to the first of each month. If you are trying to get the last 30 days, this won't quite do what you want. It will also depend on the time range specified. ... View more

You are REALLY close on this one. In a condition match, you need to wrap string values like "green" in quotes. The caveat is that they need to be sanitized quotes since the statement is already in quotes. It should look something like this: <condition match="$result.ManagedEntityStatus$ == &quot;green&quot;"> Otherwise it is looking for the ManagedEntityStatus field to match another field named green ... View more

You should be able to do this without using the map command. You just need to have the email address in your search results. example: Then you can set up an alert action to send an email FOR EACH RESULT using the value from the email field in the TO address: ... View more

You could use the metadata command for type=hosts. Splunk keeps track of all hosts that have sent data, including the first and last time of the events it has received. I have a similar one I use for this. The query below shows the hosts that have sent data within the last 24 hours, but not within the last 4 hours. | metadata type=hosts index=ind1 | where recentTime < relative_time(now(), "-4h") AND recentTime > relative_time(now(), "-24h") ... View more

If you specify the span in tstats, as well as adding specifics to the sparkline command, I think you'll have better luck. Here is an example search for the past 24 hours: | tstats count where index=foo by _time span=10m | stats sparkline(sum(count), 10m) as Volume Because | tstats returns tabled results instead of events, the default for sparkline just shows a count of 1 for each row. By specifying a sum for count, you should get better results. ... View more