Yes. ... View more

Great! Feel free to post the solution in case others can benefit from it later. ... View more

Can you describe or draw what you're trying to achieve / what you're trying to avoid? ... View more

Not that I'm aware of, no. Support may have an SPL-Number to track. ... View more

Including include_reduced_buckets=t in your tstats parameters should work around the 8.2 _internal tstats issue. ... View more

It would be the `$risk|n$` token filter that would turn off the implicit `$risk|h$` filter that made it HTML-safe... but calling `|n` inside an HTML panel doesn't work ... probably for securitay. ... View more

Here's Stirling's Approximation in SPL: `| eval n! = sqrt(2*pi()*n)*pow(n/exp(1), n)` ... View more

There are two more, significantly less SPL-intense options: Cheat. Given the restrictions of finite-bit maths, you can easily ship a lookup of all reasonable factorials instead of calculating them on the fly, here's a start: https://oeis.org/A000142/list Use Stirling's approximation, expressed in SPL it's `| eval n! = sqrt(2*pi()*n)*pow(n/exp(1), n)` ... it won't be perfect, but it'll give you the right number of digits and the first two will be accurate, ie two sigfigs of precision. Probably good enough for your use case, for 13 choose 6 it yields 1749. ... View more

If this is in a dashboard then you don't need to launch a subsearch, instead you can use the token `$env:app$`: https://docs.splunk.com/Documentation/Splunk/8.0.6/Viz/tokens#Use_global_tokens_to_access_environment_information ... View more

Can your Fortinet FW send to HEC? ... View more

Ignore the replace old connection events in your startswith condition. ... View more

Your user's timezone setting applies to your user only. In general I recommend setting the right timezone instead of messing around with adding/subtracting seconds manually. ... View more

Have you tried setting the timezone for your user to IST? ... View more

Filter based on that then. ... View more

I don't see language:eng in there. ... View more

I can't tell you how to use your data if you don't post your data. ... View more

Filter by language:eng then? ... View more

I don't think there is a language detection function in Splunk. Do your original events have a language field? ... View more

Overall rank 650 now 😃 ... View more

You can use any boolean eval expression inside mvfilter() , including regex match() . ... View more

Use mvfilter(lower(Message) = "eng") , or some other filter to detect English. ... View more

You can add a | sort hours , which should use a more natural sorting order than stats . ... View more

I wouldn't say "don't use transaction", I'd say "use transaction for appropriate cases with smart settings". The docs flowchart you linked to covers some of this. In addition to the flowchart, if you have a very high cardinality ID with very short durations a transaction ID startswith=something will be faster than a stats by ID because transaction can discard completed IDs from memory while stats has to keep all of them in memory indefinitely. I also wouldn't say "don't use join", I'd say "use join for appropriate cases". The answers link I posted covers a lot of this. There are cases where join is the right answer, for example you have a complex search that gets some additional fields from a fast tstats. Trying to merge the two into one OR-stats-search often is counterproductive, and a pattern of search | complex stuff | stats | join [tstats] can be the best solution. In short, it depends. ... View more