if you are interested in the DM % complete over time you can create a search to get that data from the REST API endpoint and store it in a lookup I have done it like this: Search to get the info from the API endpoint (runs every 5 min): | rest /services/admin/summarization by_tstats=t splunk_server=local count=0 | eval datamodel=replace('summary.id',"DM_",""), datamodel=replace(datamodel,'eai:acl.app'."_",'eai:acl.app'."/"), _time=now(), complete='summary.complete'*100 | table _time datamodel complete | outputlookup dm_complete_info.csv append=t Search to cleanup data older than 14 days from the lookup table (runs every day at midnight): | inputlookup dm_complete_info.csv | eval oldest=now()-(14*86400) | where _time>oldest | table _time datamodel complete | outputlookup dm_complete_info.csv Search to make a graph of the data: | inputlookup dm_complete_info.csv | where _time>now()-(86400*7) | chart values(complete) AS complete over _time by datamodel useother=f usenull=f limit=0 ... View more

The eventtype "err0r" from the Splunk_SA_CIM is a very broad search.. that is almost a catch all ... View more

If the number changes than the message is not the same. That is why you still see both messages. What you can do is a replace, to remove the number and than do the dedup. something like this based on the layout of the message field you provided: | eval message=replace(message, "([^\d]*)(\d*\s*\d*\s*\d*)(.*)","\1\3") ... View more

This is not the same, and can cause other problems "down stream". If for example you use that alias field in a EVAL you can not do that anymore. The below (super simplified) example will not work anymore: _raw data1: "2018-12-06 15:54:00 Account_Name=arnold sid=123 message=bla" _raw data2: "2018-12-06 15:54:00 user=arnold sid=123 message=bla" FIELDALIAS-user = user AS Account_Name EVAL-userid = case(isnotnull(user),user, isnotnull(sid),sid) in data1 you will miss the Account_Name field even though it is in the data, this cannot be solved with evals in this manner: EVAL-user = coalesce(Account_Name, user) EVAL-userid = case(isnotnull(user),user, isnotnull(sid),sid) Because according to the props.conf spec file: * When multiple EVAL-* statements are specified, they behave as if they are run in parallel, rather than in any particular sequence. * For example say you have two statements: EVAL-x = y*2 and EVAL-y=100. In this case, "x" will be assigned the original value of "y * 2," not the value of "y" after it is set to 100. So in my opinion this is a major breaking change in the way 7.2.x works, and there is no mentioning of it in any doc (spec file/release notes/known issues/.....) ... View more

This is just one of the problems I had with the Splunk_TA_windows... so I desided to make my own windows app... all of the *as_dest_nt_domain regexes are incorrect, also the "wel-col-kv" regex is incorrect. This is what I have now in my transforms.conf: # The default regex for the below 10 *_as_dest_nt_domain stanza is not correct for EventCodes that have more than one Account_Domain field. # The Target Domain is always the second field, the default regex takes in case of two fields everything and not just the last one. [Target_Domain_as_dest_nt_domain] SOURCE_KEY = Target_Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Primary_Domain_as_dest_nt_domain] SOURCE_KEY = Primary_Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Group_Domain_as_dest_nt_domain] SOURCE_KEY = Group_Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Account_Domain_as_dest_nt_domain] SOURCE_KEY = Account_Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [New_Domain_as_dest_nt_domain] SOURCE_KEY = New_Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Domain_as_dest_nt_domain] SOURCE_KEY = Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [User_ID_as_dest_nt_domain] SOURCE_KEY = User_ID REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Security_ID_as_dest_nt_domain] SOURCE_KEY = Security_ID REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Supplied_Realm_Name_as_dest_nt_domain] SOURCE_KEY = Supplied_Realm_Name REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Target_Account_ID_as_dest_nt_domain] SOURCE_KEY = Target_Account_ID REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" # For some reason there isn't always a "-" in an empty field, and in those cases the value of that field is filled with the name of the next field # Example: dest_nt_domain = "Failure Information:" (EventCode 4625) # to prevent that the wel-col-kv regex (splunk/etc/system/default/transforms.conf) needs to be changed [wel-col-kv] REGEX = (?=\w)([^:\n\r]+):[ \t]*(?![\n\t])([^\n\t]*) ... View more

That is not possible... the iplocation command is a build in command, it is build in the core code of splunk so you can't change it... what I did was create a custom command that pulled the fields from the database. It is some time ago that I did this but I can have al look to see if I can find the code. ... View more

If all the usernames start with an "A" and then have 6 numbers you can use this: ([aA][0-9]{6}) if you just want A111111 to A112311 you can use: ([aA]11[12][0-9]{3}) ... View more

you can use the following search to see the notables that have been suppressed over the given period `notable` | search `suppression` ... View more

I am working on that one, but from a Change Analysis DM view point, to fill the object_attrs field with the name of the attributes that where changed. If you just want all the fields you can just create a regex for it. I think you have 3 options for that 1) create 1 regex that will extract every field available using the <_KEY_1> and <_VAL_1> options ( read the transforms.conf documentation REGEX part) 2) create a regex for every field you want to extract 3) create 1 regex that will get all the "Changed Attributes" field, Note that this will not "hit" if one field is missing I whould go for option 1 because it is the most flexible, despite the fact that it will give me some additional fields without a value ( for example Changed_Attributes) ... View more

I had to do something like this today try the following: | makeresults | eval user="skins", urgency="critical" | sendalert notable ... View more

Don't use |datamodel or the macro.... use | tstats instead that is way faster! only downside for tstats is that you can't use a cidr in your where. your query whould become something like: | tstats summariesonly=t count dc(All_Traffic.dest) as dest_count, values(All_Traffic.dest) as dest from datamodel=Network_Traffic where All_Traffic.action="blocked" by All_Traffic.action, All_Traffic.src | `drop_dm_object_name("All_Traffic")` | search (dest=10.0.0.0/8 OR dest=172.16.0.0/12 OR dest=192.168.0.0/16) AND (src!="10.0.0.0/8" src!="172.16.0.0/12" src!="192.168.0.0/16") | where count>150d | rename dest AS "Destination IP", action as "Action", src as "Source IP" more info on tstats: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats ... View more

Probably a bit late... but for anyone else having this problem. For me the solution was to change the app sharing permissions for the app the correlation search was saved in. When you set them to "global" everything works fine. ... View more

you should add the time range below the search between earliest and latest brackets ( just like the timerange input): <form> <label>Analysis of Splunk users activity</label> <fieldset submitButton="false"> <input searchWhenChanged="true" token="timerange" type="time"> <label>Time range:</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="user"> <label>field1</label> <search> <query>(index=_audit action=search) OR (index=_internal) | dedup user | stats count by user | fields user | sort +user</query> </search> <earliest>$timerange.earliest$</earliest> <latest>$timerange.latest$</latest> <fieldForLabel>user</fieldForLabel> <fieldForValue>user</fieldForValue> <choice value="*">All</choice> </input> </fieldset> </form> ... View more

In thought it was something like $click.$ so in this case $click.Country$ ... View more