After reading your question and the back and forth comments, I think what you are looking for is this: You write a modular input which acts as a network service listening for your .NET objects. Your PowerShell script is altered to emit the .NET objects over the network, to your mod input service Your PowerShell script is called via whatever external mechanism If you can't alter your PS script, this won't work. I can't think of a way to tell a modular input to watch another process's stdout, where that process starts/stops via some mechanism external to Splunk. ... View more

@garapathis, This question is over 3 years old, and is unlikely to attract sufficient attention to answer any question you may have. I suggest submitting a new question. ... View more

I'm willing to bet your UI is configured to show events in ET. That would explain why a time that you'd expect to be at 12:00 would be displayed on your side as 07:00. To check this: Your Name (on the top bar of the page) -> Account Settings Examine what's shown for Time zone under the Global heading. ... View more

Any chance your events are in a different timezone than your user preference, thus the time value shown for the event is different than the time of the event itself, which is what would be used by bin ? ... View more

You can actually work around this, but you need to know that when an inner search returns a field named search , that value will be dropped in directly where the subsearch is. So this should work: index=main eventtype=bad_traffic | eval contactlist = [| whois src_ip | search attribute=*.contact.name | stats values(value) as contacts | eval search="\"".mvjoin(contacts, ",")."\"" ] | table src_ip, errormsg, contactlist The quote fun in search="\"".mvjoin.. surrounds the list of contacts with double quotes, so that eval knows it's setting the field to a string. ... View more

I don't have an answer, but I wonder if it would help you (and us) track down the issue if you look at the events that are not returned, perhaps with a search like this: index="index1" tdr=tdr1 OR tdr=tdr2 transaction id | foreach * [ rex field=<<FIELD>> mode=sed "s/{|}//g"] | eval _time=strptime(Qtime,"%Y-%m-%d %H:%M:%S.%3N") | eval LoS=.... | search LoS = 1 | table ..... It's worth pointing out that since we can't see your eval expression for LoS, it's tough to see the full picture of why searching for !=1 and !={1} may return different sets of results. ... View more

<title> isn't valid inside <search> , so it needs to be moved out. This run anywhere example shows what you're trying to accomplish, though: <dashboard> <row> <panel> <title>$aapacCount$</title> <table> <search> <query>| tstats count WHERE index=* OR index=_*</query> <done> <set token="aapacCount">$result.count$</set> </done> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard> ... View more

Here is a run anywhere dashboard that uses a recent answers post's sample data to demonstrate what I think you're looking for: <form> <label>622761</label> <fieldset submitButton="false"> <input type="checkbox" token="filter_expired" searchWhenChanged="true"> <label></label> <choice value="yes">Check for expired</choice> <delimiter> </delimiter> <change> <condition value="yes"> <eval token="checked_result_value">"Status=Expired"</eval> </condition> <condition> <eval token="checked_result_value">""</eval> </condition> </change> </input> </fieldset> <row> <panel> <table> <search> <query>| makeresults | eval Class_Date="2018-1-1" | append [| makeresults | eval Class_Date="2018-12-12"] | append [| makeresults | eval Class_Date="2017-1-2"] | append [| makeresults | eval Class_Date="2017-1-3"] | eval class_plus_one_year = relative_time(strptime(Class_Date, "%Y-%m-%d"), "+1y") | eval Status = if(now() > class_plus_one_year, "Expired", "Valid") | search $checked_result_value$</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> ... View more

When you say cron * , what is your exact cron expression? I don't believe a single * is a valid expression, so I want to make sure the issue isn't simply that your search isn't running when you think it should be. ... View more

Which instance did you install this configuration on? It needs to go on the heavy forwarders and indexers. ... View more

I added a test case and correction to my search in the answer. window=1 was causing the search to only find transitions that were right next to each other, so I removed it. ... View more

Is that application server running a Splunk forwarder? If not, what method are you method are you intending to use to get its data? ... View more

And where is the data you're trying to index? ... View more

Are you running a single instance, or is your indexer separate from your search head? Is the data you're attempting to index on your indexer, search head, or a separate forwarder? ... View more

I think you should be able to see your dashboards at <your host>/en-US/app/search/dashboards , when selecting All . You can also find the configuration of them at <your host>/en-US/manager/search/data/ui/views . ... View more

https://regex101.com/ is a great site to test regexes. As for learning them, I'd have to defer to google on that one, as I don't have a recommendation handy. ... View more

Changed it to add the word "site" to the site field, and added in a table command. ... View more

You don't need to bookmark it in Splunk, you just bookmark it in your browser. ... View more

You are correct that I had my search flipped. I've added changed that and added a run anywhere search that should show that it works that way, though. ... View more

I'm not proud of this search, but it does work: | makeresults | eval _raw="<entry><key>Name</key><value>Siri</value></entry><entry><key>U_ROLE</key><value>BUS</value></entry>" | xpath outfield=value "//entry/value" | eval value=mvjoin(value, ",") | xpath outfield=key "//entry[value]/key" | makemv delim="," value | eval key_value=mvzip(key, value) | fields key_value | mvexpand key_value | rex field=key_value "(?<key>[^,]+),(?<value>.*)" The mvjoin and makemv lines are there because, for some reason, calling xpath a second time results in the first multivalue field it produced being squashed into a single, space-delimited value instead. Perhaps someone will come along and show the proper way to do this. I've never used it before. ... View more