Yes, it appears that most (if not all) non-ASCII character are major breakers. The lispy I see for a simple search for  тестирование is: [ AND index::main а в е и н о р с т ] This is a bigger issue if the data is ingested in ASCII JSON format. {"data": "\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435"}  If the data above is ingested, "data="тестирование"  or "тестирование" will not find the data.  An initial search like "u04*" must be included.  A similar issue occurs when the raw JSON includes a newline, as a string like {"data": "line_one\nline_two"} cannot be found with a search for "line_two". ... View more

The sed command is probably too aggressive, as it removes escaped backslashes. The regular expression to extract the message didn't include all the characters. By using an alternative of matching every escaped quote or other characters, it will keep any single JSON string.  REGEX = \"message\":\s*\"((?:\\\"|[^\"]*)\" SEDCMD-unescapetab = s/\\t/    /g SEDCMD-unescapenewline = s/\\n/\n/g SEDCMD-removeescape = s/\\(.)/\1/g   ... View more

This isn't an issue that is limited to liberal use of the wildcard.  I don't believe it is intended behavior. When a search is made in Smart or Verbose mode, the base search returns schema for events that are not included in the result. The number of fields shown to the user in the "All Fields" can be a small subset of the fields exposed in the table command or a data export.  In the search example that @rbechtold provided, the "alert_name" placeholder may have matched 144 of ~2000 events returned from the indexers.  The schema from those other ~2000 events is not shown in the UI.  Because of this, I would consider inclusion of null fields for events that are displayed to be unexpected.   index _raw source Event 1 _internal "alert name", k1=val1 scheduler.log Event 2 _internal "name alert", k1=val1, k2=val2, k3=val3 scheduler.log   If I searched that data with ` index=_internal "alert name" source=schedular.log `,  k2 and k3 would not be shown in the web result GUI.  Including them in the table command or a data export is a surprise, especially if Event 2 included hundreds of fields.  I guess something like this could work, and would also work in Fast mode.    index=_internal "alert_name" source="/opt/splunk/var/log/splunk/scheduler.log" | fields _time, _raw | extract     ... View more

No, you didn't miss anything. The splunk-packaging-toolkit (slim), splunk-appinspect, and the Splunk Python SDK are not perfectly aligned yet. If you want slim to work better, you could update the files in ./venv/Lib/site-packages/slim/config/conf-specs/*.conf.spec to what you find in your target Splunk version's config files. If you don't have a Splunk installation, replace commands.conf.spec and others with a current version from Splunk docs (https://docs.splunk.com/Documentation/Splunk/Latest/Admin/Commandsconf#commands.conf.spec).  Some of the other issues I've seen: Options must be provided before the command documented slim options may not exist (e.g. --quiet) Python SDK doesn't pass splunk-appinspect  splunk-appinspect and slim raise conflicting errors no slim option to set the location of inspect.yml no option to return a non-zero code if any validations fail in splunk-appinspect or slim  I'd recommend packaging the app with slim and using splunk-appinspect  to validate, rather than using the validation in slim. ... View more

I understand the frustration, but the issue may be partially due to the email provider blocking the messages. I also hope that Splunk will help identify the root cause and help fix this issue. Have you tried resetting the password for your instance and using the username above? ... View more

  I agree that mode function is most likely what @HeinzWaescher  was looking for.  Because it is a stats function, you can also use it with eventstats to keep the events.  | eventstats mode(country_code) by user_id For the example initially provided, the top command does not appear any better than the stats mode() command provided by @p3hndrx. But if you the top N values (N>=2), there is no function like values() that returns them sorted by frequency of occurrence.  ... View more

The three macros below calculate the haversine formula that @MuS provided.  [haversine(5)] # Calculate the great circle distance for a sphere with an arbitrary radius args = input_lat1, input_lon1, input_lat2, input_lon2, hav_radius definition = "eval hav_lat1_radians = pi()*$input_lat1$/180, hav_lat2_radians=pi()*$input_lat2$/180, hav_delta_lat_radians = pi()* ($input_lat2$-$input_lat1$)/180, hav_delta_lon_radians= pi()*($input_lon2$-$input_lon1$)/180 | eval hav_intermediate = pow(sin(hav_delta_lat_radians/2), 2) + cos(hav_lat1_radians) * cos(hav_lat2_radians) * pow(sin(hav_delta_lon_radians/2), 2) | eval hav_distance = 2 * $hav_radius$ * atan2(sqrt(hav_intermediate), sqrt(1-hav_intermediate)) | fields - hav_*_radians, hav_intermediate " [haversine(4)] # Calculate the great circle distance for the earth (in kilometers) args = input_lat1, input_lon1, input_lat2, input_lon2 definition = "`haversine($input_lat1$, $input_lon1$, $input_lat2$, $input_lon2$, 6371)` " [haversine(2)] # Calculate the great circle distance between two IPs (in kilometers) args = input_ip1, input_ip2 definition = "iplocation $input_ip1$ prefix=$input_ip1$_ | iplocation $input_ip2$ prefix=$input_ip2$_ | `haversine($input_ip1$_lat, $input_ip1$_lon, $input_ip2$_lat, $input_ip2$_lon)` "  Using streamstats, you can calculate IP location distances between events. With eventstats, you can calculate IP location distances between a common IP location and an events IP location.   The calculated value is returned as hav_distance, to decrease the chances of a field name collision. The haversine formula is not as accurate as Vincenty's formulae, but is much more accurate than a simple chord length calculation.  | makeresults | eval usual_src_ip="8.8.8.8", src_ip="9.9.9.9" | `haversine(usual_src_ip, src_ip)` | where hav_distance > 500   ... View more

Removing the last comment of the following search will create a lookup table of all of the values.    | datamodel | spath output=modelName modelName | search modelName!=Splunk_CIM_Validation `comment("mvexpand on the fields value for this model fails with default settings for limits.conf/[mvexpand]/ max_mem_usage_mb")` | spath output=fields objects{}.fields{} | mvexpand fields | eval _time = now(), _raw = fields `comment("fill the values required for display in the Events viewer")` | spath | rename comment.* AS comment_* | rename *{}* AS ** `comment("| fields - _time, _raw, fields, comment | outputlookup datamodel_info.csv")`   This then permits simpler lookups against each data model's field names, including the description, type, etc.    That doesn't directly answer the initial question. That can be directly extracted with spath as commented previously.   | datamodel | spath output=modelName modelName | spath output=field_names objects{}.fields{}.displayName | stats list(field_names) as field_names by modelName    The field displayName includes the object names, but for CIM datamodels they can be removed relatively easily because they are the only values that include uppercase characters.    If you prefer using the rest command, the following have the same output   | rest /servicesNS/-/-/datamodel/model | rename description AS _raw | fields _raw | spath | datamodel | spath     The datamodelsimple command is an easy way to get basic information from a datamodel, like the field name and lineage.  | datamodelsimple datamodel="Network_Resolution" object=DNS type=attributes  For that example,  it returns  lineage attribute DNS.dest_port dest_port host host DNS.answer_count answer_count _raw _raw ... View more

I would recommend using an eventstats command to exclude  index="idx" earliest=-360s latest=-0s source="server.log" "<Request" | xmlkv | eventstats earliest_time(clientId) as earliest_clientId by clientId | where relative_time(now(), "-60s") > earliest_clientId |`enter code here`   ... View more

The URL is visible from the Instances page, and you can also request a password reset from that page. But the username is not shown on that page.  https://splunkcommunities.force.com/customers/apex/RMEC_InstancePage I never got my the "Welcome to Splunk Cloud!" email, so I registered with a different email address, and that welcome got through. That included a username that worked on both instances. You can try the cloud default usernames, like sc_admin, with the password sent in the password reset. https://community.splunk.com/t5/Splunk-Cloud/sc-admin-cannot-login/td-p/519531 ... View more

I don't know when the change was made, but threading seems to be working now. ... View more

I just posted an "idea" for the return command to be able to do what you would like it to do. https://ideas.splunk.com/ideas/EID-I-532  The following is your command, rewritten with a rex command that should create a simple boolean expression from one subsearch.   (index=winsec sourcetype="WinSecurityEvent") OR index=DNS [ search sourcetype="dns" "specific urls" | dedup src | return 100 src_ip=src OR query | eval search = if(len(search)<3, "NOTHING FOUND") | rex mode=sed field=search "s/ (OR|AND|NOT)=\"\" / \1 /g" ] ) | dedup accountname | stats values(accountname) AS accounts | table query, src_ip, accounts     The string in the eval command should be changed to something that will never be found.  Depending on the use, perhaps "index!=*" might be more efficient.  Otherwise, if nothing is found then the search will return an empty string that matches all events. This may be desired, in which case the eval statement should be removed.   ... View more

That is there, under the "DESCRIPTION FORMATTING" section. The earlier "FORMATTING" section states to use \" to represent a quote. This is not directly aligned with the Description Formatting and does not work in a description. The "\" is also shown as "\\", which is not documented. Based on the descriptions shown above that were written by Splunk, it appears that this behavior was not understood by Splunk authors, or the parsing behavior changed and the descriptions were not updated. The only concern I have with @lstewart_splunk's accurate answer, is that the current behavior breaks the description syntax for stock Splunk commands, as shown above for regex.  The Splunk authors for the regex syntax apparently expected that (\")?string(\")? would be shown as (")?string(")?, but instead, it is strangely highlighted. ... View more

In addition the the good advice from @bmacias84 , I recommend also including a .slimignore file. This will exclude your .git and other directories that shouldn't be published in the app. https://dev.splunk.com/enterprise/docs/releaseapps/packagingtoolkit/pkgtoolkitref/packagingtoolkitcli/#slim-package # Default Splunk Packager exclusions .DS_STORE Thumbs.db *.py[co] default/indexes.conf local/ metadata/local.meta # Additional exclusions .git .gitignore venv*/ .idea/ .vscode/   Here is an example from Splunk's Cisco Webex Meeting App: https://github.com/splunk/cisco_webex_meetings_app_for_splunk/blob/master/.slimignore Another option is to use a subdirectory for the app, as Palo Alto Networks did recently when they consolidated their apps into one GitHub repository. https://github.com/PaloAltoNetworks/Splunk-Apps/ ... View more

To modify @martin_mueller's answer to find where the underscores ("_") are, the "rex" command option, "offset_field", will gather the locations of your match. The "offset_field" option has been available since at least Splunk 6.3.0, but I can't go back farther in the documentation to check when it was introduced. If you only want the first match index, or a limited number of indexed locations, the "max_match" parameters can be changed. ... | rex field=message offset_field=message_offsets max_match=0 "(?P<char_match>_)" | rex field=message_offsets max_match=0 "char_match=(?P<offset_range>[0-9]+-[0-9]+)" | chart values(offset_range) by message  The first "rex" command creates a field named "message_offsets" will contain data like the results of these eval statements, if the character(s) are found. | eval example_message_offsets = "char_match=7" | eval example_message_offsets = "char_match=12-12&char_match=19-19" The second "rex" extracts the index from those values into "offset_range". For one character, the values are the same and separated with a "-".  If there is no match, both the char_match and the message_offsets fields are null(), so the chart will not include field values that don't contain the string of interest. Unless fillnull, coalesce, or another eval statement is used to populate null values. ... View more

For the highlighting, it appears that it has affected Splunk as well.  You can look at the shelper response to see the raw text, so the highlighting appears to be in the browser, not in the backend.     Note: if you want to use the "or" ("|") command regex (field("="|"!="))?((\")?string(\")?)               If you look at the chart command, it does the same to the BY/OVER that is capitalized in the source.   ... View more

I think there is a misunderstanding. This is a discussion on how the Splunk searchbnf.conf parser has undocumented and unwanted behavior, not about any particular app or any 3rd party commands. ... View more

I replicated this issue with Splunk versions 7.2 and 8.0. ... View more

I tried the following, with no luck. AAAA _BBBB_ \CCCC "DDDD" 'EEEE' `FFFF`  I was surprised to see backslashes escaped, and the underscore after BBBB is highlighted but the underscore after is not.    ... View more

It appears to happen with all uppercase words. I have not found a way around it yet. ... View more

The transaction command is the simplest way to aggregate related logs.  Depending on your log volume and what you want to see, the following will show the 95th percentile of the time between two events.  index=iis cs_username=* | eval action = if(match(a_action, "event_status"), "login_complete", action) | transaction cs_username maxspan=5m startswith="action=login" endswith="action=login_com" | eventstats p95(duration) AS p95_duration `comment("| timechart avg(duration) AS avg_duration, p95(duration) AS p95_duration, max(duration) AS max_duration, min(duration) AS min_duration by cs_username | predict avg_duration p95_duration max_duration")` https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Transaction If you click on the duration field on the left of the events list, it will show the average, minimum, maximum, and standard deviation.  Or you can calculate those with timechart/stats/chart and get a table of values or a visual representation, and use predict to forecast the values. https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Predict Using a reasonable maxspan value and startswith will significantly reduce the number of transactions in memory. I think the default maxspan is 1 day, which can cause a large number of evicted records if you have a large log volume. ... View more

I don't know which version it was introduced in, but mvrange and mvzip can be used. ... | eval keys = split(rawKeys, ",") | eval index_and_key = mvzip(mvrange(0, mvcount(keys)), keys, ",")   ... View more

csv.QUOTE_NONNUMERIC also works, with potentially less overhead that csv.QUOTE_ALL ... View more

I found a solution, but the problem may not be with the SDK. The SDK reads the data passed from the search command, but Splunk strips the data when passed back to Splunk. The workaround is to modify the SDK 'splunklib.searchcommands' CSV dialect to pass the data back with csv.QUOTE_ALL in internals.py. Although this is not recommended by Splunk, it is likely preferable to modifying other Splunk internals. ... View more