Tick mark is not changing when I select the other option   I'm going to infer that you are using the timechart to visualize the data, and the timechart still has weekends on the x axis. I believe You will need to switch from timechart  to  using chart over _time  Which should give you a chart without any weekends.    ... View more

You would need to create something like a checkbox on your form that says something like "Exclude Weekends" or "Week Days Only" When that checkbox is selected, have it add the "date_wday!=saturday AND date_wday!=sunday"  to your base search.        ... View more

 From what you are showing... both searches should be doing the exact some thing...which is looking up 152.37.xxx.xxx in the local geocities database.  If they are looking up the exact same values, and returning different countries...that sounds like a bug.   I mean, you could try something like: index=o365 sourcetype = o365* Workload=AzureActiveDirectory Operation=UserLoggedin ActorIpAddress=152.* | iplocation prefix=IpLoc1_ ActorIpAddress | eval ip=ActorIpAddress | iplocation prefix=IpLoc2_ ip | table ActorIpAddress IpLoc1_Country ip IpLoc2_Country Which is effectively running both the searches you had above and comparing them.  Is there any chance there is a Country field in the Data already that's could be causing issues? I have o365 data and don't see any, but that could cause an issue.  ... View more

Depending on the subnet 152.37.xxx.xxx could be either US or UK  The following returns US: | eval ip="152.37.11.2"   The following returns UK: | eval ip="152.37.111.2" Do you have specific entries you are referring to?  ... View more

Assuming characters 1-4=A 5-6=B and 7-8=C, the following should work: | rex field=YourField "(?<A_values>....)(?<B_values>..)(?<C_values>..) You should now have three fields A_values, B_values, and C_values.   ... View more

The iplocation data returned from the GeoLite2-City.mmdb database file in  $SPLUNK_HOME/share/ You can update that file, or if you get a geoip subscription, you replace that file with one of the available data base files with more accuracy. https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Iplocation https://dev.maxmind.com/geoip/updating-databases?lang=en     ... View more

Without understanding the data, or the search your working with... | your search | stats count by name, serial_number, name_number | search count>1 Any records that have identical names/serial number will show up.  You can adjust this as follows: | your search | stats count as count, values(serial_number) as serial_number, values(name_number) by name, | search count>1 That would show if there we hosts with the same name, but might have different serial numbers.  ... View more

Correct, for the data to get  into the datamodel, it has to match the constraints of the datamodel search.  Additionally, you need to make sure your events contain the CIM compliant/required fields names/values.   ... View more

First, you will need to open you .xlsx file in Excel and save it as CSV.  Then  settings -> lookups ->  Lookup Table File -> New Lookup Table File and upload your CSV file. Now to combine your new lookup table file, by appending the new to the bottom of the current: | inputlookup new_lookup.csv | outputlookup append=t current_lookup Which will append the entries of the csv you just uploaded to the bottom of your current CSV.        ... View more

Use use the eval command in stats to get a count of the events whose timestamp are occur within the last week: | search EventType=Errors earliest=-1y | eval ErrorMessage=Server+": "+Application+": " +ErrorMessage | stats earliest(_time) as Earliest, latest(_time) as Latest, count as "Error Count YTD", count(eval(_time>(now()-604800))) as "Error Count WTD" by ErrorMessage | convert ctime(Earliest), ctime(Latest) | sort - "Error Count WTD" | head 10 ... View more

Using the eval in the stats line I get both sumRateE and sumRate, then using eval to divide: index=* Name=rateA OR rateB OR rateC OR rateD OR rateE | stats sum(Rate) as sumRate, sum(eval(if(like(Name,"rateE"),Rate,0))) as sumRateE by _time | eval divided=sumRate/sumRateE ... View more

If a user has r/w access to the Splunk indexers filesystems, they can modify the indexes. If you want to prove the data had not been modified, I recommend checking out data integrity: https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Dataintegritycontrol ... View more

The recommended method: Clone the User Role, and rename as UserGroupA Modify UserGroupA allowed indexes, and ensure the role does not inherit any other roles. Assign the role to a user and verify. https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Aboutusersandroles#How_users_inherit_allowed_indexes If this isn't working, I would first verify the roles assigned to the user: |rest /services/authentication/users splunk_server=local |fields title roles realname|rename title as userName|rename realname as Name Ensure the user doesnt have additional roles assigned that may be allowing the user access to the index. Next, verify the indexes that a role is given access to...both configured and inherited: | rest /servicesNS/nobody/system/admin/roles splunk_server=local | rename title as roles | eval idx=mvjoin(srchIndexesAllowed," ") | eval iidx=mvjoin(imported_srchIndexesAllowed, " ") | table roles idx, iidx ... View more

Do you see any Splunk process running ? Do you see any splunk process holding any files/IO open? Have you rebooted the system since the uninstall? Do you still see connection from the old heavy forwarder to the indexers? Are there other heavy forwarders the data could be coming from? If the inputs.conf has the wrong hostname, the events will appear to be from a different host. This can happen when images are cloned. The same is true for the GUID, if you are seeing license usage ensure there isn't another host using the same GUID. ... View more

Right, it really doesn't matter what the new field name's are...rename does not filter events. ... View more

a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query Something like: search [ search | rename field as search_field ] Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results? The subsearch should pass ALL fields found as arguments, there should be an additional limiting search command: search [ search | rename field as search_field | fields search_field ] Does rename as query give you all the results in the next phase of the query? Correct, a rename should not filter any results ... View more

I would use Epoch or Unix time: https://en.wikipedia.org/wiki/Unix_time ... View more

If you think the results are incorrect, you can break the search down and review the data: index="A" sourcetype=B action=Yes OR action=No | stats dc(action) as action_count, values(action) as action, by User Will show all the results, you can sort by action_count, action, etc.. Look for anomalous values for action. ... View more

Have you tried something like: index=YOURINDEX FIELD_Name>* OR NOT FIELD_name | eval FIELD_Name=if(isnotnull(FIELD_Name), FIELD_Name, "Default value to fill in") https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/NOTexpressions ... View more

Any time, if it worked please accept the answer. ... View more