I tried:   | makeresults count=10 | eval src=random().".wxyz.com" | eval name = replace(src,".wxyz.com", ".abc.com")   To see how it worked. ... View more

@saurabhkunte, Can you please try this search? Execute this search for that time window span whose record you want to keep. | inputlookup my_csv_lookup | addinfo | where ((NOT isnum(info_max_time)) OR _time > info_min_time AND _time < info_max_time) This search will give you your expected rows in lookup. | inputlookup my_csv_lookup | addinfo | where ((NOT isnum(info_max_time)) OR _time > info_min_time AND _time < info_max_time) | outputlookup my_csv_lookup This search will overwrite lookup file with your expected rows. Thanks ... View more

Thanks Rich ! This works for me ... View more

I don't know what you mean by "line 4 in the rex , after the first? mark and before the . write". Please elaborate. ... View more

Can you share the bits of PoSH writing out those strings? PowerShell has internal handlers on how to display objects and you may have to tweak your Write-Host. ... View more

Hi Try with If like below: index=summary sourcetype=orc_srv | eval now_month = tonumber(strftime(now(),"%m")) | eval log_time_epoch = tonumber(strptime(log_time,"%Y-%m-%d %H:%M:%S")) | eval ts = tonumber(strptime(Oracle_SeekTime,"%Y-%m-%d %H:%M:%S")) | eval ts = log_time_epoch | dedup ts |eval field1=if(((tonumber(strftime(ts,"%m")) == now_month-1)AND (tonumber(strftime(ts,"%d"))<13)) OR((tonumber(strftime(ts,"%m")) == now_month-2) AND (tonumber(strftime(ts,"%d"))>28)),duration_time)|stats sum(field1) as res by milestone | dedup milestone | eval res=tostring(res,"duration") | table milestone res ... View more

Many thanks, this works very well. ... View more

Trying the first method: ... | transaction host, PID startswith="Code=ImportRequestStart" endswith="Code=ImportRequestEnd" | timechart duration I get this error: Error in 'timechart' command: The specifier 'duration' is invalid. It must be in form <func>(<field>). For example: max(size). Using avg(duration) works... ... View more

Hi, in my case it was a embarrasing time syncronisation error between the indexer and the DCN. ... View more

This is very old question still someone can look into it: index="vmware-inv" sourcetype="vmware:inv:vm" | join vm_id [ search (sourcetype="vmware:perf:mem" source="VMPerf:VirtualMachine") ]| table vm_name p_average_mem_usage_percent ... View more

Sure, this will work for each month the search runs ... View more

Thanks a lot this search works. I also managed to split my servers into various environments for e.g DEV, QA Prod etc. Could I please ask for a slight modification where its displays the compliance Percentages for all the environments per month ? Meaning : Y axis has months - Jan, Feb Mar ... and X axis Plots the compliance percentage bar charts for every month ? Thanks again for your quick help. ... View more

Or remove the where commands and see what you get ... View more

ah correct. perfect that works well. Thanks for your quick help. Appreciate it ! ... View more

Hi , Thanks for your post. But this not what Will solve my problem. 1st off our workstations do not register themselves in dns. So doing a dns lookup as it's mentioned in the post does not help. 2nd i already have dhcp logs integrated in splunk. I just need a mechanism In which the splunk search reads the ip addresses from the csv file one by one searchs the dhcp logs to find the workstation names that were associated with each ip and at the end lists ip to workstation name in a table form. Thank you. ... View more

Hello, Is this still a requirement ? Also, some of the custom MIBs i want to import are with .txt extension. Please let me know. Thanks. ... View more