Hello, I have scheduled a Splunk report that currently notifies me via email if the event count is greater than 3000 and is scheduled to run on hourly basis. Now when the event count is 0, I still get an email from Splunk with 'No results found' message in it. How do I stop getting these emails when the event count is 0? My requirement is to get emails only for events greater than 3000.  ... View more

I have created a scheduled search for the below query with the summary index enabled. When I open the link from the email generated, I get this response in Splunk: "There are no results because the first scheduled run of the report has not completed." I have scheduled the search to run for the last 30 days with a frequency of 1 hour. Am I doing something incorrectly here? The Splunk version is 7.2.0 sourcetype="pcf:Log" AND cf_space_name=perf AND cf_org_name=* | timechart span=1h dc(span_id) by cf_org_name usenull=f useother=f limit=10 ... View more

Currently I am running the below query to generate a report based on appname,spacename,orgnameand foundation which takes longer to run(for the past 24 hours search). How do I create a summary index to efficiently use this query for faster results? sourcetype="pcf:log" | eval report_create_time=strftime(now(), "%Y-%m-%d %H:%M:%S,%3N") | eval spanID_ = coalesce(span_id, SPAN_ID, x_b3_spanid, spanId) |stats count(spanID_) AS spanCount by report_create_time cf_app_name, cf_space_name, cf_org_name, foundation ... View more

I have fields ComponentName, CNC in lookup A and fields ComponentName, ENDPOINT in lookup B. The output should have fields ComponentName,CNC,ENDPOINT. My criteria is that if the field ComponentName in both the lookups matches, the output should be displayed. Note-The field CNC in lookup A has its each of its value dependent upon the values of the field ComponentName in lookup A. ... View more

For example, I have a string "agreementinquiry-web-2.0.3". My result should only have "agreementinquiry". ... View more

For example, in the below url I need to extract just 'abc' and assign the extracted string to a new field name. URL= http://claim-esb-sys.test.xxx.com/abc-3.0.0 ... View more

I have two lookups A,B with fields APIKEY, ENDPOINT. How do I compare the missing value for the column ENDPOINT in lookup B with that of A? ... View more