Upgraded several independent instances of Splunk Enterprise from various starting points, all to 9.1.0.1.   Some clustered, some standalone. 8.1 -> 9.1.0.1 9.0.1 -> 9.1.0.1 All had the same outcome:  When browsing to: Settings > Users and Authentication > Users, most but not all users are no longer visible in the 'Users' list, but the users still have access as validate by Splunk logs.  In the most severe case there were 100+ users, mostly SAML, some local.  Post upgrade there are 4 showing, yet in validation all can still login ... View more

I have a query that must search 9 weeks of data, and then applies a filter against a single field (dv_opened_at) looking for specific events that occurred within an 8 week period.  Initial 9 week search is necessary to catch events that were modified after the end of the last week, yet had a dv_modified_at time within the last 8 weeks.  query     index=cmdb (dv_number=* OR number=*) dv_state=* dv_assigned_to[| inputlookup cmdb_users.csv| table dv_assigned_to ] earliest=-8w@w latest=now() | table _time number dv_number dv_opened_at dv_assigned_to dv_short_description dv_watch_list dv_sys_updated_on dv_state close_notes | dedup number | eval dv_opened_at=strptime(dv_opened_at,"%Y-%m-%d %H:%M:%S") | where dv_opened_at>=relative_time(now(), "-8w@w") AND dv_opened_at<=relative_time(now(), "@w") | eval _time=dv_opened_at | bin _time span=1w | eval weeknumber=strftime(_time,"%U") | rename dv_assigned_to AS Analyst | timechart limit=0 useother=false span=1w count BY Analyst     The problem is, the timechart outputs 9 weeks of data, and as expected the last week is all 0's.  How do I eliminate the current week from the output, but keep the current week in the initial query? Output     _time Analyst1 Analyst2 Analyst3 Analyst4 2022-05-08 19 6 0 0 2022-05-15 5 4 0 0 2022-05-22 8 2 0 1 2022-05-29 7 4 0 0 2022-06-05 1 3 1 39 2022-06-12 7 1 4 51 2022-06-19 3 2 0 59 2022-06-26 25 5 2 26 2022-07-03 0 0 0 0 #how to drop this row each weekly report     ... View more

I am working producing a table that calculates the number of incidents resolved by each analyst.  What my query does is produces a table with three columns with a count of 'Class Names': Analyst / Class Name / count What I am trying to do is produce an output with (4) columns with a count under the descrete columns and a total of the row to the right: Analyst / Class Name 1 / Class Name 2 / Total Count (of all class names)     <query> | table "Analyst" "Class Name" | stats count by Analyst "Class Name"       ... View more

I started with the following query, required to join a knowledge library with discovered hosts. The results are stored in a summary index for quick(er) retrieval.  The first query is usually less than 100 events, the second is 70,000+ every time, but the whole thing runs in less than 60s.  The problem is the 50,000 JOIN subsearch limitation.       index=qualys sourcetype="qualys:hostDetection" QID=* SEVERITY IN (3 4 5) LAST_SCAN_DATETIME=* earliest=-15min latest=now() | join type=inner QID [search index=qualys sourcetype="qualys:knowledgebase" QID=* earliest=1 latest=now() | dedup QID | table QID THREAT_INTEL_VALUES CVSS_V3_BASE PUBLISHED_DATETIME THREAT_INTEL_IDS VENDOR_REFERENCE TITLE] |table _time IP DNS NETBIOS TRACKING_METHOD OS TAGS QID TITLE TYPE SEVERITY STATUS LAST_SCAN_DATETIME LAST_FOUND_DATETIME LAST_FIXED_DATETIME PUBLISHED_DATETIME THREAT_INTEL_VALUES THREAT_INTEL_IDS CVSS_V3_BASE VENDOR_REFERENCE RESULTS       In order to overcome the JOIN/subsearch limit and maybe gain some efficiencies I tried using eventstats instead.  The resultant query is below, and runs for over an hour with questionable results (never really finishes.  Pretty sure it is not giving me the same output as the JOIN.  What am I doing wrong? New query     (index=syn_sec_qualys sourcetype="qualys:hostDetection" QID=* SEVERITY IN(3 4 5) LAST_SCAN_DATETIME=* earliest=-15m@m latest=now) OR (index=syn_sec_qualys sourcetype="qualys:knowledgebase" QID=* earliest=1 latest=now) | eventstats values(_time) AS _time, values(DNS) AS DNS values(TRACKING_METHOD) AS TRACKING_METHOD values(NETBIOS) AS NETBIOS values(OS) AS OS, values(TAGS) AS TAGS, values(TITLE) AS TITLE, values(TYPE) AS TYPE, values(SEVERITY) AS SEVERITY, values(LAST_SCAN_DATETIME) AS LAST_SCAN_DATETIME, values(LAST_FOUND_DATETIME) AS LAST_FOUND_DATETIME, values(LAST_FIXED_DATETIME) AS LAST_FIXED_DATETIME values(PUBLISHED_DATETIME) AS PUBLISHED_DATETIME values(THREAT_INTEL_VALUES) AS THREAT_INTEL_VALUES, values(THREAT_INTEL_IDS) AS THREAT_INTEL_IDS values(CVSS_V3_BASE) AS CVSS_V3_BASE, values(VENDOR_REFERENCE) AS VENDOR_REFERENCE, values(RESULTS) AS RESULTS BY IP, QID | TABLE _time IP DNS NETBIOS TRACKING_METHOD OS TAGS QID TITLE TYPE SEVERITY STATUS LAST_SCAN_DATETIME LAST_FOUND_DATETIME LAST_FIXED_DATETIME PUBLISHED_DATETIME THREAT_INTEL_VALUES THREAT_INTEL_IDS CVSS_V3_BASE VENDOR_REFERENCE RESULTS         ... View more