I have a number of Lookups that I create with similar naming convention (and plan to create more in the future). I want to be able to have a saved search that searches across all these lookups. The following does not work as subsearches returned provide a litsearch of  (title="chosen_lookups_abcd" OR title="chosen_lookups_bcda" )  |inputlookup append=t [|rest /servicesNS/-/-/data/lookup-table-files | search title=chosen_lookups* | table title ]   Ideally, something like the following would work | inputlookup append=t chosen_lookups*   Thanks in advance  ... View more

This is more of a bug report than a question. I am working with the Billing data coming from our new GCP environment and have found that CSV data where a string contains a comma is not being parsed properly. I have discovered this from data where the Credit1 field says "External IPs will not be charged until April 1, 2020." It splits the row into two columns, pushing all data out by one and therefore losing the Description Field value from that event. The data looks like this is Splunk *{ [-] Account ID: 111111-222222-333333 Cost: GBP Credit1: "External IPs will not be charged until April 1 Credit1 Amount: 2020." Credit1 Currency: -0.156831 Currency: 0.156831 Description: End Time: 2020-02-20T00:00:00-08:00 Line Item: com.google.cloud/services/compute-engine/ExternalIp Measurement1: com.google.cloud/services/compute-engine/ExternalIp Measurement1 Total Consumption: 183661 Measurement1 Units: seconds Project: 12344566778 Project ID: 12344566778 Project Labels: project Project Name: project Project Number: GBP Start Time: 2020-02-19T00:00:00-08:00 } * This data parsing isnt done in the props of the sourcetype but in the python code. Line 260 of Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/modinputs/billing.py I'm not an expert in GCP data, so I dont know what the best course of action would be to fix this bug without breaking other things. My assumption is that no data values will have "word,word" but "word, word" with a space, so would the fix here to change the split from being just a comma to a comma and no space afterwards. ie in python line = line.split(',[^\s]') ... View more

Im working with some thresholds and I'm using |eval score = if(percentage>Target, 1, percentage<=Target, 0) Looks simple and I thought it would be. My percentage fields are just numbers and my Target fields are percentages (e.g. 99.5%) But, when my number field becomes 100.00, the score becomes 0 no matter what Target values there are. If I do | eval isHundred = if(percentage==100, 1, 0) I get results of 1. And, if I take 0.01 away from 100.00, the values are return as expected for the lower value. What's going on here? I'm working on 7.0.0. Thanks ... View more

I've been trying to get the Splunk App for AWS working by following the Splunk docs but I cannot get any of the Cloudwatch data to be ingested. I'm receiving aws:cloudtrail, aws:description, aws:billing and aws:config just fine so I must be doing something right? I've checked my permissions so that in my aws policy, I have permissions for everything that the aws app needs - following http://docs.splunk.com/Documentation/AWS/5.0.2/Installation/ConfigureyourAWSpermissions. In my AWS add-on, I have in my inputs a cloudwatch input type with the correct account and role with the above permissions. In AWS, I have also ticked the "Receive Billing Alerts" button in the Billing Management Preferences Page. This help page - http://docs.splunk.com/Documentation/AWS/5.0.2/Installation/ConfigureyourAWSservices - says that there is no further configuration for the cloudwatch data to be ingested by Splunk, so I am clearly missing something. Any advice would be greatly appreciated. Thanks in advance ... View more

Im tring to come up with a way of listing all my forwarders (on or off) in a list and display whether they are active or inactive. There is no guarentee that they will be turned on after a certain amount of time. I would prefer a solution where I don't have to search through all time just to get all the host names in a list. I know that if I were to run the search over all time, I would do something with: index=* host=* | dedup host and then look for the last log instance and see if its discussing the shutdown procedure and status. - But this is very costly. Surely Splunk has something built in that remembers what forwarders have connected in the past or something? I have UF's on both windows and Linux machines. Thanks in advance ... View more