I want to keep updating new records to Splunk lookup table and not writing records again for existing users, even if they come in search results. Lookup table structure : apiCallerID, ticketId My base search query is having mvexpand, mvindex & rex commands and then table so when I do "NOT" it does not allow me to any other way or corrections. index=test sourcetype=stats earliest=-5m@m latest=-0m@m| eval temp=ltrim(Response,"[") | eval temp1=rtrim(temp, "]") | eval temp2=split(temp1,"}")| mvexpand temp2| eval temp3=ltrim(temp2,",")  | eval testData=mvindex(temp3,-1) | rex field= testData "userID:\s(?<apiCallerID>\d+)" | table apiCallerID  NOT [|inputlookup LookuptableGeneratorForDSIDByTestID.csv| fields apiCallerID] Basically if the user is not there I want to add a ticket id along with user in lookup table and in future system will use this to raise any new tickets and prevent duplicate tickets for the existing user.   ... View more

Hi, We generally raise tickets in Prod through Splunk by putting search query as Report/Alert and now we have a requirement to alert if the load is not equally distributed b/w the hosts. With the top command I see result is in % but I wasn't able to use it in where cause to calculate the deviation. Say we have 4 hosts sharing an app and ideally it should be almost equal distribution but in unwanted scenario if load is lesser in Prod on one of the host Or higher on a host, I should have an alert. log ex : index=data loggerName="xyzzy" threadName="thread1" appName="dataSync" ... View more

Sorry I am new to Splunk and wondering if can have the report that gives results in a table as below, data as : index=api serviceName=find userId=7878 index= api serviceName=find userId=7877 index= api serviceName=find userId=7878 index= api serviceName=person userId=7878 Result should be like : a) table A : serviceName, count of (unique userId's) b) Also if its possible to have the result of table A for 1 day, 7 day, 30 days Please provide the queries also. ... View more