Hello all, I've had this issue in the past but never really spent the time to find a solution as bin is usually "good enough." Take the following data set: 12:00:00 -- id = A 12:01:00 -- id = B 12:02:00 -- id = A 12:03:00 -- id = A 12:04:00 -- id = A 12:05:00 -- id = A 12:06:00 -- id = A 12:07:00 -- id = A 12:08:00 -- id = A 12:09:00 -- id = A 12:10:00 -- id = B 12:11:00 -- id = A If I did a |bin _time span=5m | stats count by id I'd get something like: 12:00:00| A : 4 | B : 1 12:05:00| A : 5 | B : 0 12:10:00| A : 1 | B : 1 And if then wanted to find a period where I had 5 or more As I'd have 1 period. If I wanted a period with 4 or more As I'd get 2 periods. Here's a very advanced diagram to illustrate the point: Using what I'm intending I would have 8 periods with A>=4 and 4 periods with A>=5 I've tried stuff like transaction with maxspan but that doesn't seem to work and streamstats has been giving me issues when I'm not using only one field. bin and span seem to do the job most of the time but I feel like a lot of interesting data can be missed simply because the data happens to fall across the binning period. More severely if it the following happened and I was looking for A>=5 I would get no results! 12:00:00 -- id = B 12:01:00 -- id = B 12:02:00 -- id = B 12:03:00 -- id = A 12:04:00 -- id = A 12:05:00 -- id = A 12:06:00 -- id = A 12:07:00 -- id = A 12:08:00 -- id = B 12:09:00 -- id = B 12:10:00 -- id = B 12:11:00 -- id = B ... View more

Hello all, I am attempting to get my Splunk VM to send email via SSL or TLS using the localhost settings. I want to use localhost because I do not have access to any mail relay (3rd party such as GMAIL, HOTMAIL, etc are out of the question). When I configure Splunk to use SSL/TLS and then I run a simple sendemail test ( index=_audit | head 3 | sendemail to="me@me.com" use_ssl=true / index=_audit | head 3 | sendemail to="me@me.com" use_tls=true ) I get the following error: command="sendemail", [Errno 111] Connection refused while sending mail The actual intent of this is to successfully send email from localhost using SSL/TLS from a python script I've written as part of an app I'm submitting for approval to Splunk Cloud, which was denied because I was sending email without SSL. It works fine with non-SSL but it fails with localhost settings. I feel like there may be something fundamental I'm missing. ... View more

Hi all, Before I dive into the issue, I'd like to explain the goal: I have a search that returns some fields including an SID. From there I am attempting a left join on the SID to include the results by using the |REST endpoint. I've successfully returned results via a curl, but as of yet I have not succeeded using |REST . I have attempted these tests on both expired and non-expired SIDs. Below is an example of successfully returning results via curl: curl -u admin:changeme -k https://localhost:8089/servicesNS/admin/SplunkEnterpriseSecuritySuite/search/jobs/1545072559.25/results/ If I run the following, I successfully retrieve all the various metadata about the search's dispatch itself: | REST /servicesNS/admin/SplunkEnterpriseSecuritySuite/search/jobs/1545072559.25/ However, when I attempt to retrieve the results with the following, I get an error about failing to fetch the rest endpoint: | REST /servicesNS/admin/SplunkEnterpriseSecuritySuite/search/jobs/1545072559.25/results I've also tried various forms of GET as described here: https://docs.splunk.com/Documentation/Splunk/7.0.2/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fdispatch All of this leads me to believe that this is not possible and that the |REST command does not have access to all of the endpoints available via curl. If this is the case, is there a way to do what I'm attempting in another fashion, or do I need to resort to a script? A script is possible, but ideally, I'd like to keep it entirely in SPL. Edit: We are also considering using |loadjob but the sid argument seems to treat fields as literal strings. specifying savedsearch= has potential, but requires a user:app:search definition, which seems clumsy. ... View more

Hi everyone, Given an event like the following, is there a way to get this to successfully parse as _time at index time? I've tried including the pipe in my STRPTIME format but it does not work. xxxx|yyyy|xxxx|yyyy|xxxx|yyyy|123000|111218|xxxx|yyyy I would think that the following would work, but it has not: TIME_FORMAT = %H%M%S|%m%d%y ... View more

Hi all, I'm using ES 4.7.3 and as far as I know there is only the option to add collaborators one at a time to an investigation. This doesn't work well with our existing structure of incident response (cases are not assigned to users, but the group and users take incidents from the list of active ones). The logistics involved in adding every user to every investigation is pretty time consuming, I'm hoping there is a basic functionality to add batches of collaborators to investigations. ... View more

Hello, I recently joined a project at a place with an ES Search head and a few ad-hoc ones. Apparently, there has been a new issue that started a few days before I got here. The ES SH (others are fine) will go unresponsive for web browsing until it is restarted. The web daemon and splunkd are still running. Alerts and searches are still running. Splunkd is just bombarded with "ERROR HttpClientRequest - HTTP client error=Read Timeout while connecting to server" messages and pretty much nothing else. I'm trying to help them figure out what the issue is, but I've never seen something like this happen. Any thoughts? ... View more