Hi all, I installed Heat Map Viz and I use it. https://splunkbase.splunk.com/app/4460/ I want to change x axis label color because I want to use it in dark mode. when it turned dark mode, x axis(date) is difficult to see. But, I have no idea to change label color. Is there anyone know how to change x axis label color? (I know this is svg.) Or Is there anyone know option name to change x axis label color? (like heat-map-viz.heat-map-viz.yaxiswidth) Thank you so much. ... View more

hi all, I confused about strptime. My goal search is this.(this is a sample. I have month field. I get token in my dashboard and do this search.) |makeresults |eval test=strptime("$token$", "%Y-%m") |where month>strftime(relative_time(test, "-2mon"), "%Y-%m") AND month<="$token$" I did this search, but test is no result. |makeresults |eval test=strptime("2020-02", "%Y-%m") |where month>strftime(relative_time(test, "-2mon"), "%Y-%m") AND month<="2020-02" How to change time? Am I wrong using strptime? Thank you for helping. (this is easy question, I know, but today, I am stumbling on this problem for some reason.) ... View more

Hi all, I want to import my Office 365 email logs into Splunk. I have installed the Microsoft Office 365 Reporting Add-on for Splunk. I made an input setting, but I don't understand the setting. How to set if I want to import past data and continue to import future data? For example, I wanted to import the data from April 1st. so I set like this. Name: test Interval: 60 Index: test Status: Active Imput mode: Continuous_monitor Query window size (min): 60 Delay Throttle (min): 5 Start date and time: 2020-04-01T00: 00:00 I think continuous_monitor is contiue every 60 minutes. 2020-04-01T00: 00:00 2020-04-01T01: 00:00 2020-04-01T02: 00:00 ......... Start date and time is start time that I want to import data, right? If I miss, Could you please tell me. Thank you for helping. ... View more

Hi all. I want to calculate the total value for each field value classification. index=test1 |rex field="test2" (?<year>\d\d\d\d)/ |rex field="test2" /(?<month>\d+)/ |eval date=case(year==2020 AND month==2, "2020/02", year==2020 AND month==1, "2020/01", year==2019 AND month==12, "2019/12") |search date=2020/02 |stats count by date place description Splunk return this. date place description count 2020/02 A OK 3 2020/02 A NG 2 2020/02 A None 1 2020/02 B OK 3 2020/02 B NG 2 2020/02 B None 1 2020/02 C OK 3 2020/02 C NG 2 2020/02 C None 1 I want to calculate the total value for each place field values. date place description count Total 2020/02 A OK 3 2020/02 NG 2 2020/02 None 1 6 2020/02 B OK 3 2020/02 NG 1 2020/02 None 1 5 2020/02 C OK 4 2020/02 NG 2 2020/02 None 1 7 I have no idea to use which fields. (I tired |stats list(description) by date place but I have no idea to count....) (description has many field values such as OK NG NOne NOT BAD etc....) Is there any way to return this results? Thank you for helping me. ... View more

Hi all, how to get difference after using chart command. I did this command. | eval year=strftime(X,"%y") | eval month=strftime(X,"%m") | transaction event |chart count over year by month it returns the table. year 01 02 04 05 07 08 09 10 11 12 OTHER 19 2 3 37 33 14 25 30 10 32 21 8 20 9 24 3 2 1 1 22 5 55 23 7 I want to count year-over-year. For example, January of 19year is 2, January of 20year is 9, so,Year-over-year increase is 9/2*100 = 450%.(it is example) But I think I can not use delta command. Is there any way to count year-over-year? Thank you for helping. ... View more

Hi all, I have a lookup like this. caseid date a 19-01-01 15:54:43.934000000 b 19-01-01 16:54:43.934000000 c 19-01-01 17:54:43.934000000 d 19-01-01 18:54:43.934000000 e f g . . . . . I did this command | inputlookup test1 | eval date=strptime(date,"%y-%m-%d %H:%M:%S.%9N") | stats min(date) as starttime max(date) as endtime by caseid | eval diff =endtime-starttime | stats avg(diff) as average my result is like this.(this is dummy) average 999999.9999999 I want to get results like this. average 3600 (this is 1 hour) I understand I have to convert, but I don't know how to convert date differences to seconds. Could you help me? ... View more

Hi Splunker. It is easy question, but I don't understand. so, could you help me? I want to get alert result in python scripts. I read document and I understand I should use $result. < field name > $ so, I made this search. index=test |rex field email"(<?name>.+)@" |sendalert param.username=$result.name$ my python script is like this.I want to use alert result as arguments in python. username= helper.get_param(username) my splunk search returns Alert action param.username=$result.name$ not found. I know I have to set up param name but I do not understand how to set. (I can not find document to set up param name) Is it correct way to get alert result in python? If it is correct could you tell me where should I see to set param name? ... View more