Everyone, Needed help on an issue of event blocking for a Splunk setup which would receive events from a Web page that would be passed forward to a Splunk Webhook alert to get triggered. There would be many events coming to Splunk from this Webpage with events like the following (Latest event received is placed on top) :  ID Process Name Receive Time Trigger Status 2 xyz 17th Aug 4PM Queued 1 abc 17th Aug 3PM Queued  My requirement is as follows: 1. If any new event comes to Splunk with the same process name I need to block the event from getting triggered by the WebHook alert.  2. This new event should be permanently blocked. 3. If the older event changes its state to Completed then any OTHER new event (not blocked in step 2) should be eligible to get triggered by the WebHook alert. To summarize : If during the time duration of the older event's Status change from "Queued to Completed" any new event gets sent to Splunk it needs to be blocked permanently. But if the older event's Status changes to Completed AND THEN any other new event comes to Splunk then they need to flow ahead to the Web Hook trigger. Let me know your inputs ... View more

Everyone, The events on splunk for me have data in the following format : ticket_num,actual_start_time,finish_time,assigned_to. For Example : A particular ticket number IN1234 has a start time of "January 1 2018" and finish time of "January 5 2018" along with whom the ticket was assigned to, for example, "A". This particular ticket may have been worked by "A" and also by "B" and "C". "A" might have charged 5 hours to the ticket, "B" - 3 hours and "C" - 2 hours. The file consisting of the hours charged by "A","B" and "C" is in the format of : "Resource Name","Date Charged in mm/dd/yyyy" ,"Hours Charged","Ticket Number" "A",01/02/2018,5,IN1234 "B",01/04/2018,3,IN1234 "C",01/05/2018,2,IN1234 The current approach I am following to utilize the hours charged values is to : 1) Since IN1234 is only going to be present once in the indexed data (one event); I use the ticket_num to lookup with the file mentioned above. 2) I get a multivalued field like below : | table ticket_num name date_charged effort IN1234 "A" 01/02/2018 5 "B" 01/04/2018 3 "C" 01/05/2018 2 3) I do an mvzip --> | eval Test = mvzip(name,date_charged) --> "A",01/02/2018 "B",01/04/2018 "C",01/05/2018 4) I do another mvzip -- | eval Test = mvzip(Test,effort) --> "A",01/02/2018,5 "B",01/04/2018,3 "C",01/05/2018,2 5) I do a mvexpand on Test, so now I have 3 events like the following |table ticket_num Test IN1234 "A",01/02/2018,5 IN1234 "B",01/04/2018,3 IN1234 "C",01/05/2018,2 6) I use Split on Test and use mvindex to assign values | eval Split = split(Test,",") | eval name = mvindex(Split,0) | eval date_charged = mvindex(Split,1) | eval effort = mvindex(Split,2) Using the above I can now use the data I retrieved from the lookup. I wanted to know if there was a better alternative for the "Lookup" approach used above as there are many restrictions to this method, slower searches with an increase in tickets being one of them. Let me know. ... View more