You will have to configure outputs.conf. This will change depending on where you want to send the data and what format you want to send it in, but this  doc details the steps for multiple forwarding options: https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Forwarddatatothird-partysystemsd ... View more

Hi Nagasi1, I set up the netskope add-on for Splunk on Splunk Cloud today and I ran into the same issue when I ran it on Chrome. Try switching browsers and the configuration screen should load. it worked for me on firefox ... View more

Hi luky! You would accomplish this using an eval and the strptime function. The SPL below should work as long as you substitute the string_time variable that I used with whatever variable holds the time value in your data. Once they're both converted, you can do another eval that subtracts one from the other. | makeresults | eval call_start="Wed Mar 03 13:29:29 PST 2021", call_end="Wed Mar 03 13:38:36 PST 2021" | eval call_start_epoch=strptime(call_start,"%a %b %d %H:%M:%S %Z %Y"),call_end_epoch=strptime(call_end,"%a %b %d %H:%M:%S %Z %Y") | eval call_duration=call_end_epoch - call_start_epoch ... View more

I'm sorry I should have been more clear. Add the eval statement I provided to the search you used that generated the results. Given that your results have the fields 'Total Time Taken' and 'Total Records', it will work. ... View more

sourcetype=wineventlog EventCode IN (1100,6005) | bin _time span=5m | stats values(EventCode) as EventCode dc(EventCode) as dc_EventCode by _time, dest | search EventCode=1100 dc_EventCode=1 My example above should be a pretty efficient means of doing this. I'll explain line by line First, I would recommend moving the EventCode criteria into your search. Adding criteria to the initial search is more efficient than running a broad search and piping it to a where statement. The bin command changes the time field into windows of whatever increment you specify in span. So this creates a 5 minute time bucket. The span you can set to whatever time interval you think is acceptable between the stop logging and start logging events The stats command will show all the EventCodes from the returned events for a given dest (for windows logs this should be the field indicating which device the event occurred on) in a 5 minute window. Then we only show the events that have 1 EventCode that is an 1100. This eliminates any devices where they had a stop event AND a start event in a 5 minute window while still alerting on the ones that only had a stop event! Hopefully that helps ... View more

You can just do an eval to create the new field. The only trick is that the field names within the eval statement will need to be in either single quotes or dollar signs to indicate to Splunk that you're referencing fields | eval Average_time_taken='Total Time Taken'/'Total Records' ... View more

On a universal forwarder, in outputs.conf, you can change the defaultGroup to determine where ALL data is routed to by default. outputs.conf: [tcpout:third_party] server=<ip>:<port> sendCookedData=false [tcpout] defaultGroup=third_party You can also define multiple server groups and put a comma separated list of them for your defaultGroup if you want to send data to multiple. This way you could send the data to Splunk and the third party. [tcpout:third_party] server=<ip>:<port> sendCookedData=false [tcpout:splunk_idx] server=<ip>:<port> [tcpout] defaultGroup=third_party, splunk_idx For reference, defaultGroup is the default setting for the _TCP_ROUTING key that you manipulate via props and transforms on the HF to do this kind of routing on a source, host, or sourcetype basis. If you send the data to a HF or convert the box to a full splunk install, you can route via props and transforms. Similar to how you can specify multiple dests with the previous example, you can do that on the HF if you want too by specifying a comma separated list of dests in the FORMAT attribute. ... View more

You could create a scheduled report that runs once a day and configure it to output to a csv (using alert actions) and use a date token in the name of the csv so every day a new csv is generated. Then you would have the dashboard panels reference a lookup. you could have a dropdown selector that dynamically pulls a list of any csvs that have the naming convention used by the report by referencing the rest endpoint for lookups. The searches that do the inputlookup would use a token in place of the token name so whichever day's lookup the user selected from the dropdown would dynamically populate the dashboard. ... View more

| makeresults | eval DVN="201",Region="SAM",Name="Shapes",Count="20010" | append [| makeresults | eval DVN="201",Region="SAM",Name="Points",Count="24218"] | append [| makeresults | eval DVN="202",Region="SAM",Name="Shapes",Count="20102"] | append [| makeresults | eval DVN="202",Region="SAM",Name="Points",Count="23231"] | table DVN, Region, Name, Count | stats dc(DVN) as dc_DVN values(*) as * by Name | search dc_DVN>1 | eval count1=mvindex(Count,0), count2=mvindex(Count,1), diff=abs('count1'-'count2') Everything before the table command, was just to give me the same result set to work with as you . Then I merged the results that shared a name and took a distinct count of DVN so I could eliminate results that weren't duplicates (although there weren't any in this data set). My search dc_DVN>1 eliminates items that don't have multiple DVNs. Then my evals were just for doing the math to find the difference. Hopefully this works for your use case or gives you a good starting point! ... View more

you could try writing the regex more specifically so it only matches the full username syntax. maybe something like this: ^(?<user>[a-z]+\_[a-z]{2,})\@ That would match john_smith@example.com but not john_s@example.com. might need to be tweaked depending on the naming conventions ... View more

If you want the full range of email values, you'll need a different field to do an exact match on. Is there a way you could create the user field (or another common value that you could group on) either with a rex or an eval? Maybe one of the email addresses is username@example.com and you could extract the user field with regex ... View more

Hello, You can use blacklist within inputs.conf to exclude any files ending in .gz. For whichever input stanza is bringing in the AWS data, add: blacklist=.gz$ More info on blacklist: blacklist = regex If set, files from this input are NOT monitored if their path matches the specified regex. Takes precedence over the deprecated '_blacklist' setting, which functions the same way. If a file matches the regexes in both the blacklist and whitelist settings, the file is NOT monitored. Blacklists take precedence over whitelists. No default. Hopefully that helps! ... View more

I've never seen that error so I don't know for sure. I would need to see the contents of the lookup and the exact search you ran to figure out what caused it. ... View more

after reading your response, I agree that i was hasty to downvote. I switched to an upvote and removed the comment. ... View more

| makeresults | eval fieldA=123, fieldB=321 | where fieldA!=fieldB ... View more

Hey @jmartens, I think your best bet for getting these fields and only the fields you specifically want would be to extract them from the logs via regex in your props.conf configuration. I suggest this because all these fields are just values directly extracted from the logs (generally speaking, if the data comes directly from the log use an extraction. Use calculated fields or lookups for enriching the data that's found directly in the logs with data that isn't) If you can determine which app is responsible for parsing these logs, you should add the configuration to that apps props.conf should be in a directory like this: $SPLUNK_HOME/etc/apps/THIS_APP/local/props.conf then find the stanza for that sourcetype SOURCETYPE_NAME and add an EXTRACT: EXTRACT-new_fields_for_THIS_SOURCETYPE=Query\skey:\s\(\((?<DICOMQueryItem>(?<DICOMQueryFieldGroup>\d+)\,(?<DICOMQueryFieldElement>\d+))\)\)\sSOP\sClass\sUID\s\[(?<SOPClassUID>[^\]]+)\].+SOP\sInstance\sUID \[(?<SOPInstanceUID>[^\]]+).+Query\/Retrieve\sLevel\s\[(?<QueryRetrieveLevel>[^\]]+) I included a regex that I think captures all the desired fields in the way that you want them, but I would recommend reviewing it to make sure it's right and optimizing it any way you can as I did it as a proof of concept and didn't spend any time trying to make it efficient ... View more

If that doesn't work, you can do | mvexpand mail this should create an individual row entry for each value in the mail field. ... View more

you could also wrap it in $s. 'Page Id' or $Page Id$ will work. ... View more

if you need to reference a field with a space in it inside an eval statement, wrap the field name in single quotes to indicate that it's a field. ... View more

Yeah so you do it at the end after you've run the lookup to add those fields... ... View more

Glad to help! ... View more