Attempting to run a tstats search that excludes a collection of IPv6 ranges from the results as follows: | tstats summariesonly=true allow_old_summaries=true count from data model=this where this.that="foo" NOT [|inputlookup ip_subnets.csv | rename cidr as src_ip] by this.src_ip   Upon running the search, I'm hit with the error 'tsidxStats: WHERE clause is not an exact query'. My gut told me that ipv6 may have had something to do with it, so I reran tests with lookups where ipv6 ranges were excluded and the searches ran successfully. Matching both ipv4 and ipv6 works as expected in non-tstats searches, so I'm not sure if ipv6 cidr range matching is supported within tstats. Can anyone assist? ... View more

I've recently begun exploring the FieldSelector command to better understand what fields are the best predictor for an ML model. During my research, I've gained what I think to be a decent understanding of what constitutes a good predictor field based largely on its p-value (anything below .05), and the score values (the higher the better). I've been running through some tests and noticed that the fields being selected by the FieldSelector don't represent what I would think to be the most optimal selection of fields. I've pasted the fit command I'm using below: |fit FieldSelector num from PC_* value_hashed_* type=numeric mode=k_best param=10 into combined_field_selector   Once this is run, I compare the output to the summary of the combined_field_selector model, which provides score and p-values for all the fields: | summary combined_field_selector   One of the ten fields selected via FieldSelector was PC_2, with a score of .3293 and a p-value of .5661. Of the 132 fields passed to this fit command, PC_2 ranked 115th in score and was the 15th highest p-value. This seems to tell me it was not a good predictor for the model. Plus, I had more than ten fields with better score/p-value combinations. I know this type of question falls in no man's land between the underlying python, statistical algorithms, and Splunk, but Splunk is really my only means of applying ML to this data and troubleshooting the results. I'm hoping someone has a better understanding of what's going on and can potentially explain why these fields are being selected. ... View more

I have a Correlation Search that ceased generating notable events without any sort of change or adjustment to the search itself. It fired a few weeks ago but hasn't fired since. The SPL itself runs when run manually from the search app, will send emails as a saved search, but simple refuses to generate notable events. I reviewed the internal logs and it shows that the search is running successfully but always with zero results. That's despite the fact that when run manually over the same time frame events are returned. The search has some regex, a few macros, lookups, stats, nothing out of the norm for my other searches that are firing reliably. It's run twice an hour on a cron. Again nothing out of the norm. Has anyone ever encountered and eventually over come this type of issue? ... View more

So I've been using the Cluster Numeric Events Experiment in Splunk and have saved a version of the model using the save button on the upper right. When I head out to the experiments page, I see a Model Name of 'exp' with a large string of alphanumeric characters that follow. When I attempt to apply this model in searches, Splunk tells me it doesn't exist. I also have this model running nightly training. With previous iterations of this model, I've used the Open in Search option available on the experiment page and have manually created models using the resulting search, replacing '_exp_draft' with something more descriptive. The alphanumeric string values were left intact. Now I can use this model but how does the nightly training on the _exp model affect this model? Also, if I wanted to apply a partial fit, how would I go about doing that, since I don't see a way to tell the experiment to utilize it within it's training schedule. ... View more

So I'm new to the Machine Learning Toolkit and I'm trying to model something that I thought would be somewhat straightforward, but I'm beginning to realize that I might need more of an understanding of what Splunk needs from me to create an accurate report. What I want is a model that will report any event_id that reports an uncharacteristic volume of events. I started off by throwing as many stat commands I could at the data but I ended up with a model that may have modeling something completely different. I simplified the search to the following: base search earliest=-30d | bin _time span=1h as event_window | stats sum(count) avg(count) dc(hostname) by event_id event_window So at this point, I have several questions: Do I include the event_id in the k means algorithm? I've been told that the answer you hope to find should not be included in the clustering but here I feel like it's necessary to describe the data. In my mind, we have to attribute the data point to an event_id or the frame of reference is lost. Am I correct? The bin/timespan. Right now I'm group everything by an hour because I anticipate running a saved search over this data on an hourly basis. Do I have to have like for like values here, or can I potentially run the clustering with different bucket spans and still obtain accurate reports? Is this even a decent model? Like I said previously, I went nuts with multiple stats commands, deltas, etc but felt like I began modeling something else instead of volume of event_ids. I have run this model and tested with some data out in the wild and I see outliers but I don't understand why Splunk is reporting them as such. I'm not sure if the variance in the amount of event_ids overall, but these numbers are well within the limits I would have expected to be set in the clustering. Are there stats that I should be including to address this? Again, I am a super newb at this. I've looked for a primer to ML in Splunk but I haven't found anything that goes into this level of explanation. Any assistance would be greatly appreciated. ... View more

So I'm working on a search that returns standard network stuff and using a bin to bucket the data by a day. Something like this: base search earliest=-7d | bin _time span=1d as window | stats count(dest) as destination values(this) as this values(that) as that by ip window | where destination > 2 So this works but what I'm really interested in seeing are those ip values that exist in more than one window bin . I can't think of a way to break it down from what has effectively been the end of the search up to this point. Any ideas? ... View more

Been targeting the same lookup definition and my lookup just refuses to recognize wildcards in my lookup table. My inputlookup works like so and properly accounts for the wildcards: search NOT [|inputlookup bad_columns | table SCAN_TYPE TABLE NAME SINGLE_COLUMN] My lookup is below and just doesn't work: foreach Column* [lookup bad_columns SCAN_TYPE AS SCAN_TYPE TABLE_NAME AS TABLE_NAME SINGLE_COLUMN AS <<FIELD>> OUTPUT SINGLE_COLUMN as match | various other evals...] I'm not sure if the <<FIELD>> rename is allowed or if match_type can vary between these two commands. I do not have access to transforms.conf, FYI. ... View more

I have a field that contains column names delimited by spaces that I need to break out into separate fields for filtering purposes. The values are simply the column names, like shown below: THIS_COLUMN THAT_COLUMN I currently have an mvexpand solution in place which works but takes a huge amount of time to process through the duplicate events. I really want to parse the column names out into separate columns in the same event and pass them through a foreach statement, or something similar. I've seen solutions that would work given a finite amount of column names but not for when the amount of values vary. Is there a structure I can apply to recognize the amount of columns and add them to the event. Here's my current search for reference: base search | eval UID = _cd + index+splunk_server | eval singleColumns=split(column_name, " ") |mvexpand singleColumns | search NOT [|inputlookup Known_Bad_Columns | rename bad_columns as singleColumns ] | dedup UID | stats count by field1, field2 | sort by count desc ... View more