Hi @rpole , You could use a label using eval command, somtethinl like this: index="pcs-ing" ins="ingestion-worker" "metric.ingestion.api.import.time" "mdq.sId" IN ("57","10662") | rename mdq.sId as mdq_sId | eval mdq=if(mdq_sId="57","stack-ind","stack-aus" | timechart span=60m limit=0 count as ingestion_cycles by mdq If it's possibile, use underscore "_" instead minus "-". Ciao. Giuseppe ... View more

Hai @Zazou , Good for you, see next time. Ciao and Happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hai @jacknguyen , It isn't a best practice to use the same shared disk for more Indexers for many reasons,One of the Is that NFS isn't to use for Splunk storage. It this is the only way (with mucho care and sure problems!), eventually use different folders. Ciao Giuseppe   ... View more

Hi @varshini_3141, are there other messages, near the one you shared? which operative systema are you running in? Anyway, the fastest solution is to open a case to Splunk Support (sending them a diag that they can use to analyze your system). Ciao. Giuseppe ... View more

Hiu @SplunkerNoob , as I said, see in the Security Essentials App and you'll find hundreds of searches also fro threat  hunting. Ciao. giuseppe ... View more

Hi @SplunkNinja , good for you, see next time! let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @Real_captain, sorry for the previous message: I forgot the search command! ,anyway, please try this: index=events_prod_cdp_penalty_esa source="SYSLOG" (TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA) OR PIDZJEA OR IDJO20P) | rex field=TEXT "NIDF=(?<file>[^\\s]+)" | transaction startswith="IDJO20P" endswith="PIDZJEA" keeporphans=True | bin span=1d _time | stats sum(eventcount) AS eventcount BY _time file | append [ search index=events_prod_cdp_penalty_esa source="SYSLOG" (TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA) OR PIDZJEA OR IDJO20P) | rex field=TEXT "NIDF=(?<file>[^\\s]+)" | transaction startswith="PIDZJEA" keeporphans=True | bin span=1d _time | stats sum(eventcount) AS eventcount BY _time | eval file="count after PIDZJEA" | table file eventcount _time] | chart sum(eventcount) AS eventcount OVER _time BY file Ciao. Giuseppe ... View more

Hi @Real_captain, the only way is the append command, with another transaction, but you'll have a very slow search: index=events_prod_cdp_penalty_esa source="SYSLOG" (TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA) OR PIDZJEA OR IDJO20P) | rex field=TEXT "NIDF=(?<file>[^\\s]+)" | transaction startswith="IDJO20P" endswith="PIDZJEA" keeporphans=True | bin span=1d _time | chart sum(eventcount) AS eventcount OVER _time BY file | append [ index=events_prod_cdp_penalty_esa source="SYSLOG" (TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA) OR PIDZJEA OR IDJO20P) | rex field=TEXT "NIDF=(?<file>[^\\s]+)" | transaction startswith=PIDZJEA" keeporphans=True | bin span=1d _time | chart sum(eventcount) AS "count after PIDZJEA" BY _time ] Ciao. Giuseppe ... View more

Hi @SplunkerNoob , what's your question? if you want additional ideas, see in the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435): you'll find many ideas. Ciao. Giuseppe ... View more

Hi @Ssuen2311, about the first question: yes, Smartstore is available also on on-premise infrastructures. About the cost, only a Splunk Sales Reperesentative can answer to you. About the size of the solution, you should engage a Splunk Architect or a Splunk PS, it isn't a question for the Community and anyway many details are mandatory for this design. Ciao. Giuseppe ... View more

Hi @Siddharthnegi , what's the purpose of your search? using the search you shared you have a main search that arrives to a stats command and then you added another search without any relation with the first one. Do you want to append the second to the first one or do you want to filter results from the first using the secon one? Ciao. Giuseppe ... View more

Hi @Real_captain , try adding keeporphans =true option to the transaction command (as you can see at https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Transaction), it should run, index=events_prod_cdp_penalty_esa source="SYSLOG" (TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA) OR PIDZJEA OR IDJO20P) | transaction startswith="IDJO20P" endswith="PIDZJEA" keeporphans=True | bin span=1d _time | chart sum(eventcount) AS eventcount OVER _time BY NIDF otherwise use only startswith option and not also endswith option. Ciao. Giuseppe ... View more

Hi @fde , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @IlianYotov, do new files have the same name of the previous or a different one? did you checked without the "crcSalt = <SOUCE>" option? Is it possible that the new files have the same content of the previous ones? Ciao. Giuseppe ... View more

Hi @Real_captain , please try something like this: index=events_prod_cdp_penalty_esa source="SYSLOG" (TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA) OR PIDZJEA OR IDJO20P) | transaction startswith="IDJO20P" endswith="PIDZJEA" | bin span=1d _time | chart sum(eventcount) AS eventcount OVER _time BY NIDF Ciao. Giuseppe ... View more

Hi @avi7326 , as I said, there's no sense to put in the same panel a result from a stats search and a table . use your searches in two different panels. Ciao. Giuseppe ... View more

Hi @andgarciaa , good for you, see next time! let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @splunky_diamond , good for you, see next time! let me know if I can help you more, or, please, accept one answer (eventually your last) for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @splunky_diamond, see in [Incident Management > Incident Review Settings] As I said, in this form you can configure the default Time Picker for the Incident Review dashboard, see (I'm not sure!)  if the same setting is applied also to Security Posture. Ciao. Giuseppe ... View more

Hi @splunky_diamond, did you tried to go in [Configure > Incident Review]? Surely, in this dashboard it's possible to change the time picker of the Incident Review dashboard, I'm not sure that's the same thing also for Securty Posture. Ciao. Giuseppe ... View more

Hi @m92, using the above cron, you run your scheduled search at 12:00 and 19:00. Ciao. Giuseppe ... View more

Hi @m92, you can schedule the runs of your alert twice in a day using cron: 0 12,19 * * * the question is: do you want the same time period (e.g. 24 hours) on bothe the searches? Ciao. Giuseppe ... View more