You can use the streamstats command with time_window instead of stats. Try this: index=perfmon sourcetype="Perfmon:CPU" counter="% Processor Time" instance=_Total | sort 0 _time | streamstats time_window=15min avg(cpu_load_percent) as last15min_load count by host | eval last15min_load = if(count < 18,null,round(last15min_load, 2)) | WHERE(last15min_load >= 97) | table host, _time, cpu_load_percent, last15min_load, count The streamstats command checks events of the last 15 min (by host) and calculates load average. Furthermore it yields the count of events for use in the next eval command. The eval line checks if event count is higher than 18 to make sure there are enough logged events for average calculation. Otherwise you will get alerts at every reboot as there will be only 1 event with high load. I took 18, because thats the event count I get within 3min from one host (1 event / 10sec ). HTH ... View more

Try the following search: | makeresults count=1 | eval test="18/10/2018 03:42:26 - Chirs Lee (Work notes) commentxxx commentxxx commentxxx commentxxx 17/10/2018 23:14:04 - Sam Smith (Work notes) commentxxx commentxxx commentxxx commentxxx 17/10/2018 23:13:33 - Bob Bob (Work notes) commentxxx commentxxx commentxxx commentxxx 15/10/2018 23:13:33 - Chris Lee (Work notes) commentxxx commentxxx commentxxx commentxxx" | fields - _time | rex field=test mode=sed "s/(\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2} -)|$/|||\1/g" | rex field=test max_match=10 "(?<full_comments>\d{2}/\d{2}/\d{4}.*?)(?:\|\|\|)|\$" | fields - test | mvexpand full_comments | rex field=full_comments "(?<time>\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2})\s-\s(?<worker>[^(]+)(?<comment>\(.*)" | table time, worker, comment, full_comments The first rex command is prepending the delimiter ||| in front of every date and at the end of the string. | rex field=test mode=sed "s/(\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2} -)|$/|||\1/g" The second rex command extracts the comments until each delimiter. | rex field=test max_match=10 "(?<full_comments>\d{2}/\d{2}/\d{4}.*?)(?:\|\|\|)|\$" The mvexpand splits the multi-valued comments into single-valued ones. | mvexpand full_comments The last rex command extracts your wanted fields. | rex field=full_comments "(?<time>\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2})\s-\s(?<worker>[^(]+)(?<comment>\(.*)" HTH... ... View more

Have a look at the following btool command: splunk btool props list linux_messages_syslog Here you find a TRANSFORM for the host part: TRANSFORMS = syslog-host Using another btool command you will see that the host field (for linux_messages_syslog) is extracted using a regex: splunk btool props list syslog-host So to override this I would try to use an empty TRANSFORMS on the host or source as they have higher precedence than the sourcetype linux_messages_syslog. Example props.conf: [host::myawesomeserver] TRANSFORMS = ... View more

You could use the mentioned "join" command to join both searches together on user. Rename field "title" to the same user field name as in the main search, here field name "user". Search: index=_internal sourcetype=splunkd_ui_access useragent!="SplunkCli*" user!="-" | sort _time | dedup user clientip useragent | join type=left user [| rest /services/authentication/users splunk_server=* | dedup title roles | fields roles title | rename title as user] | table _time index user clientip useragent roles ... View more

Have you set the timezone on the first HF to EDT for this input stanza? props.conf : TZ = <timezone identifier> If the timezone is in the log events, Splunk will use this timezone (from props.conf Splunk docs). ... View more