I was wondering if I can send a Splunk alert directly to an individual in slack. I know can @mention them in a channel with their <@islackid> etc, but I am looking to send an alert directly to an individual (or individuals) from Splunk, instead of sending it directly to a channel. Something like: or? (neither work).     Thanks. ... View more

I am banging my head trying to understand the map command and how it works. I have one search that returns values: index=offers sourcetype=offer producttype=* earliest=-5m latest=now | stats count by producttype | table producttype This gives me the a set of data. So far so good. |producttype| 1 3 9 12 What I thought map did was to pass these $productID$ values to the 'mapped query and run it up to maxsearches time (in this case 4). So my next line was : map maxsearches=4 search = "index=offers sourcetype=offer producttype=$producttype$ earliest=-5m latest=now | timechart ...some stuff... | blah blah | etc.... " I get no results found. (This is a simplified version of my search and the foreach is not going to be an option with my final goal). What am I failing to understand? Thank you in advance! ... View more

Hi, I am using the below query to timechart the values of offers (STATUS=ACCEPTED) from midnight, of the current day, and compare them to lastweek. I had found this query on these forums, plugged it in and it works beautifully! index="offers" STATUS="ACCEPTED" earliest=-7d@d | eval StartTime=relative_time(now(), "@d") | eval Series=case( _time >=StartTime, "today", _time <= relative_time(now(), "-6d@d"), "LastWk") | timechart span=5m count by Series | eval Time = strftime(_time, "%H:%M") | chart sum(LastWk) as LastWeek, sum(today) as Today by Time | eval Today=if(Today==0, "", Today) My problem is I am trying to insert the below "eval Percent..." so I can compare "Percent" today vs lastweek, in the above "Series". count(STATUS) AS total, count(eval(STATUS="ACCEPTED")) AS Accepted eval Percent=((Accepted/total)*100) I tried timewrap, but while that is nice, it is a super slow process and only compares a 24h "moving window" I tried doing things like: | timechart span=5m count(STATUS) AS total, count(eval(STATUS="ACCEPTED")) AS Accepted by Series |eval Percent=((Accepted/total)*100) and a few other combinations but none seemed to work. Any help would be appreciated! ... View more