Hi Giuseppe, Give me some time, I will try this and revert. Regards, Amit Saxena ... View more

Hi Woodcock, That sounds an interesting approach. I, however, can't try this as both Splunk instances are not connected with each other. Specifically, I am referring to Splunk instances available in mine as well as my friend's laptop. I am looking to transfer the exported data through USB drive. Thanks for the solution anyway. Regards, Amit Saxena ... View more

Hi Giuseppe, Thanks for the details. I will try this out and revert. Regards, Amit Saxena ... View more

Hi, Thanks for sharing the link. After accessing the link and entering my Splunk credentials, I am presented with https://www.splunk.com/404 ( with the title as "Page not found | Splunk" ). Can you please reconfirm the link ? Note : I haven't raised any case with Splunk so far as I always used Splunk for internal PoC and hence used trial / demo accounts. Regards, Amit Saxena ... View more

Hi, I would definitely like to post this idea in a place where "wishlist" from users are submitted and then evaluated by Splunk. Does any such "wishlist" site exists ? If yes, please let me know. Regards, Amit Saxena ... View more

Hi Giuseppe, Finally I was able to get this working. The search query I used was as follows. | inputlookup services.csv | append [ search index=data1 | dedup ServiceName | eval ServiceStateInBinary=if(ServiceState="Running", 1, (if(ServiceState="Stopped",0,-1))) | eval OverallServiceState=ServiceStateInBinary | table ServiceName, OverallServiceState ] | eval OverallServiceState=if(OverallServiceState=1,1,(if(OverallServiceState=0,0,(if(OverallServiceState=-1,-1,-999))))) | stats values(ServiceOwner) AS "Service Owner" values(ServiceDescription) AS "Brief Description" max(OverallServiceState) AS "OverallServiceState" by ServiceName | rangemap field=OverallServiceState severe=-999-0 low=1-1 default=low | table ServiceName "Service Owner" "Brief Description" "OverallServiceState" range Thank you so much for the help 🙂 . I am going to accept the very first answer provided by you. Regards, Amit Saxena ... View more

Hi Giuseppe, Thanks for the reply. I modified the search query given by you so as to include the latest status of the service and for that instead of aggregate function, I used "dedup" command. Please find below the query I used. | inputlookup services.csv | append [ search index=data1 | dedup ServiceName | eval ServiceStateInBinary=if(ServiceState="Running", 1, (if(ServiceState="Stopped",0,-1))) | eval OverallServiceState=ServiceStateInBinary | table ServiceName, OverallServiceState ] | eval OverallServiceState=if(OverallServiceState=1,1,(if(OverallServiceState=0,0,(if(OverallServiceState=-1,-1,-999))))) | stats values(ServiceOwner) AS "Service Owner" values(ServiceDescription) AS "Brief Description" max(OverallServiceState) AS "OverallServiceState" by ServiceName | rangemap field=OverallServiceState severe=-999-0 low=1-1 default=low | table ServiceName "Service Owner" "Brief Description" "OverallServiceState" range Through this, I am getting the "OverallServiceState" and "range" value as required. Please let me know if this query is OK. Also, I install Splunk dashboard examples for 6.x app and copied the files as you have mentioned. I did restarted Splunk after that. However after I re-executed the query, I didn't find the visualization I was looking for. Can you please tell me in which file, I have to update the following text ? <form script="table_icons_rangemap.js, stylesheet="table_decorations.css"> Regards, Amit Saxena ... View more

Hi Giuseppe, Please help and suggest. Regards, Amit Saxena ... View more

Hi, Thanks for the reply. As you have mentioned, I will go with fresh provisioning of new Windows 2008 R2 Datacenter Edition VM and install Splunk 6.5 on it. Regards, Amit Saxena ... View more

Hi Giuseppe, I created the lookup file as you have mentioned and used the search provided by you. However the search command is still giving an error. The error message is Unknown search command 'count' . I tried to prefix 'search" before 'count = 0' however in that case, even though the error went away, however there are no results to shown. Please help and suggest. Search query 1 ( giving error ) | inputlookup services.csv | count=0 | append [ search index=data3 | stats count by service ] | stats values(owner) AS "Service Owner" values(description) AS "Brief Description" sum(count) AS Total by host | rangemap field=Total severe=0-0 low=1-1000000000 default=severe | table Service "Service Owner" "Brief Description" range Search query 2 ( no results ) | inputlookup services.csv | search count=0 | append [ search index=data3 | stats count by service ] | stats values(owner) AS "Service Owner" values(description) AS "Brief Description" sum(count) AS Total by host | rangemap field=Total severe=0-0 low=1-1000000000 default=severe | table Service "Service Owner" "Brief Description" range Lookup contents ServiceState,ServiceOwner,ServiceDescription service1,owner1,description1 service2,owner2,description2 Regards, Amit Saxena ... View more

Hi Giuseppe, While working to replicate this in my environment, I just realized that I need a dashboard for each of the services which are present in the indexed data. For simplicity purposes, I have incorporated only one service in the example but I want separate indicators for each of the services and not for aggregated statistics for all of the services. Can you please confirm this ? It would really help if you could share sample CSV and the lookup file which I would use and modify for my scenario to test out the dashboard you have mentioned. Regards, Amit Saxena ... View more

Hi Giuseppe, Thanks for the reply. Give me some time, I will try and revert. Note : I was assuming that it might be a simple search / visualization command that will do it. Unfortunately that was not the case :-). Regards, Amit Saxena ... View more

Use like this <![CDATA[sourcetype="WMI:WinEventLog:Security" EventCode=529 OR EventCode=530 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=534 OR EventCode=535 OR EventCode=536 OR EventCode=537 OR (EventCode=680 AND Error_Code!="0x0") OR (EventCode=4625 AND Account_Name="$" OR Kontoname="$")]]> ... View more

Hi, Try incorporating the search in "CDATA" ( as shown below ) and let us know if it works or not. <![CDATA[sourcetype="WMI:WinEventLog:Security" EventCode=529 OR EventCode=530 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=534 OR EventCode=535 OR EventCode=536 OR EventCode=537 OR (EventCode=680 AND Error_Code!="0x0") OR (EventCode=4625 AND Account_Name="$" OR Kontoname="$")]]> Regards, Amit Saxena ... View more

Hi, There seems to be typo in your post as you are looking to extract 7 characters starting from character number 3 and not characters between 3rd till 7th characters. I am referring the same assumption which was mentioned in the post from "kristian.kolb". Let me know if following works for you or not. ... | rex field=theString "\w{2}(?P<myvar>\w{7})" Regards, Amit Saxena ... View more

Hi, I have successfully retrieved search results via RSS though indirectly. The steps for the same are as follows. 1) Extract RSS entry from RSS feed. 2) Extract the alert details and hence job name from RSS entry 3) Use REST API with this job name as input to get job results export in any format like rss, xml, json etc Let me know if there are any queries. Regards, Amit Saxena ... View more

Hi, I think the entries in RSS feed do exists till the time the search is active and RSS entries gets expired once the search gets expired. Regards, Amit Saxena ... View more

Hi, I am not sure but I feel that once a search gets expired, the corresponding search results directory in "dispatch" folder also gets deleted. If that's true, whenever you fetch RSS feed, you can extract the sub folder inside dispatch directory to see if it exists or not and if it does not exists, you can stop processing more on the RSS entry just fetched. Let me know your views and if it helps. Regards, Amit Saxena ... View more

Hi, I am not sure whether Splunk has any out of box way to do this but if I consider your requirement, there is an indirect way possible. from RSS feed, extract the alert ID and from there extract the job name. Use REST API which takes job name as input to get job details and from the output of REST API, extract the original search. Once the search details is extracted, remove the summarized part and again execute it through REST API only. Finally configure alert over the search just executed the way you want. Not the cleanest of the ways, moreover I haven't tried it but it seems possible. Let me know how it works for you. Regards, Amit Saxena ... View more

Hi, RSS can be read like a regular XML so you can use any language that has the capability of reading and extracting data from XML apart from fetching any web page. Regards, Amit Saxena ... View more