Timechart has a command option call partial. By default this is set to true, so set this to false. Only the first and last buckets can be partials. http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Timechart ...| timechart partial=False count by foo ... View more

Looking at http://www.phon.ox.ac.uk/jcoleman/old_SLP/Lecture_5/DTW_explanation.html this looks relatively simple by using lookup table, subsearch, and a join statement. If you only need to update this every 15 to 30 days you could store your reference signal in the lookup table. Then with the subsearch join on time and with an eval do the simple math. | inputlookup reference.csv | eval t=strftime(_time, "%d") | join t [search ... | timechart span=1d count as test_signal | eval t=strftime(_time, "%d") ] | eval o= pow((test_signal-ref_signal),2) | chart values(o) over t your lookup would hopefully look something like: _time, refer_signal 1499985432, 10 ...., .... ...., .... ...., .... ...., .... 1499989383, 4 you can play round with the _time field to get time to line up and hope this is what you are looking for. ... View more

Okay peps. I've figured out how do this for capabilities but not items such as quotas, filters, etc. Though this meet an auditors requirement which also show last login date. earliest=-365d index=_audit action="login attempt" info=succeeded | stats first(_time) as etime by user | eval DateTime=strftime(etime, "%m/%d/%Y %H:%M:%S %Z") | join user [ rest splunk_server=local /servicesNS/-/-/authentication/users | stats values(capabilities) as capabilities values(roles) as roles by realname title email | rename title as user ] | append [ rest splunk_server=local /servicesNS/-/-/authentication/users | stats values(capabilities) as capabilities values(roles) as roles by realname title email | rename title as user] | dedup user realname ... View more

The is not real good way of doing this but you can make some assumptions. You can assume that every character in _raw is one byte (some unicode characters are four bytes). You then pick a time period you want to sample. index=network source="/opt/syslog-ng/log/hsm*.log" sourcetype=hsm:file earliest=-8h@h | eval length=len(_raw) | stats avg(length) as bytesPerMessage I don't know the size of your message but lets say every message on average 481 bytes. Now that you've done that you can use tstats find the count of those messages per day. Then we can use some eval statements with Math. |tstats count WHERE index=network source="/opt/syslog-ng/log/hsm*.log" sourcetype=hsm:file by _time span=1d | eval bytesPerDay=(481*count) | eval MB=(bytesPerDay/1024/1024) This will get you close be is only an approximation. ... View more

You can combine roles. I've combine the following rollows Server: DMC, SHC Deployer, LM, Deployment Server Server: CM, DMC, LM I would never combine SHC Deployer and CM on a single server. ... View more

You will want to use multikv. You will see Splunk using this in app like *nix. https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Multikv http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Multikvconf I you may need to edit the multikv.conf file for your data, but should be relatively simple. Cheers ... View more

The P is Python identifier for a named capture group. You will see P in regex used in jdango and other python based regex implementations. https://docs.python.org/3/library/re.html http://stackoverflow.com/questions/7988942/what-does-this-django-regex-mean-p Cheers ... View more

I don't use eval statements to figure this if something is a bot. I have a collection of 74 transforms applied against the useragent field. The regex patterns are highly tuned to match in the least amount of steps. The reason I have so many is that our SEO team uses this data; however, this does not account for any bot doing a good job of impersonating a browser. We also do a cidr match against the cip and assume any address coming from AWS, Google Cloud, Digital Ocean, and Azure address blocks are bots. Here is a link to a gist I created - https://gist.github.com/httpstergeek/5fd08b9bc750e2d1954de78b063a092a Hope this helps and if it does dont forget to accept and vote up. Cheers. ... View more