I have some search results that return values in the format %Y-%m-%d %H:%M:%S. For example: ...some search... | table UpdateTime This would yield the following table: UpdateTime 2018-06-06 13:49:28 2017-12-22 08:23:21 I know for a fact that time string is in UTC, not my local time. All I need to do is display the number of minutes that have elapsed between that UTC string and the time the event was recorded (_time). Everything I try keeps giving me negative numbers for recent events, I assume because it is treating the UpdateTime field as being in local time, not UTC. Can anyone help me? ... View more

I have a dashboard with a base search that feeds a simple panel like below. Is it possible to change the <query> based on a token? For example, let's say the token $tknIncludeField2$ is set to false. I would want the query instead to read | stats list(Field1) by Field3 Is that possible? <panel> <title>My Awesome Table</title> <table> <search base="base"> <query> | stats list(Field1), list(Field2) by Field3 </query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> Thanks! ... View more

I'm looking for a way to take a CIDR range in the format x.x.x.x/x and tell if it is completely enclosed within one of the private CIDR ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16). I'd like to be able to evaluate the CIDR block and ensure all of it's IPs fall into the private range. For example, I have an event that has a CIDR_Value field and that value is 172.31.0.0/24. That range of IPs should be completely within the private 172.16.0.0/12 CIDR block. I'm looking for a way to evaluate that as true or false. I read up on cidrmatch but that relies on you feeding in an IP and a CIDR block, not two CIDR blocks. Any suggestions would be greatly appreciated. ... View more

Hi, I have another question similar to the question I asked at https://answers.splunk.com/answers/624148/expanding-nested-events.html. The solution posted sort of worked, but stopped working when the number of Tasks changed between Projects. Take for example the following single Event (which is the result of a search): { FirstName: John LastName: Doe Projects: [ { ProjectName: Build Computer Tasks: [ { TaskName: Order hardware TaskDueDate: 1/1/2018 } { TaskName: Install software TaskDueDate: 1/2/2018 } { TaskName: Deploy machine TaskDueDate: 1/3/2018 } ] } { ProjectName: Submit Timesheet Tasks: [ { TaskName: Fill out Timesheet TaskDueDate: 2/1/2018 } { TaskName: Email Timesheet TaskDueDate: 2/2/2018 } ] } ] } I guess my issue is the SPATHing and linking the fields. If I Spath to Projects{}.Tasks{} I get two events with three Tasks in the first event and two tasks in the second event, which I was expecting. And if I were only interested in those tasks I could easily mvzip them and expand them to separate events. My issue is no matter what I try I cannot match them up with the proper Project Name. It seems to just give Build Computer to each of them, even though the second set of tasks should match up to Submit Timesheet. This is the same result I get if I use SPATH alone without actually specifying a path. If I SPATH into just Projects{}, I get two Tasks in the first event and two Tasks in the second, then I end up losing some of the tasks. Basically I am trying to get the output to look like: FirstName LastName ProjectName TaskName TaskDueDate John Doe Build Computer Order hardware 1/1/2018 John Doe Build Computer Install software 1/2/2018 John Doe Build Computer Deploy Machine 1/3/2018 John Doe Submit Timesheet Fill out Timesheet 2/1/2018 John Doe Email Timesheet Email Timesheet 2/2/2018 Thanks! ... View more