I certainly google it and tried a lot of answers but none of them worked. In any case, thanks as yours did work!   ... View more

Thanks for your response. I check with my Splunk team but it seems sendresults app it's not an option for our implementation. Not familiar with the "map" command. Can you help with some insights on how that would look like? ... View more

For instance how can you validate which server names are in the lookup but not in the index? ... View more

Hey, thanks for your reply. Let's say my universe of devices is in the lookup, and then a portion of those servers are running an specific agent that is sending its status to Index=agent_status, so I want to run a report to understand from the population of servers in the lookup table, which of those have the agent and in what status. I tried what you suggested, although I'm not sure is doing what I'm looking for, ... View more

I was reading this as I'm looking something similar, that I haven't been able to figure it out. So, I have different token values within a Dashboard and I want to add all these values into a single value component. I thought it would be as simple as |makeresults |eval Total=$token1$+$token2$+$token1$ but it'snot working. Any idea? the single value component is showing "Search is waiting for input..." error ... View more

It worked but it's not consistently fixing the 1st and 3rd week of the month. I just realized if I play with dates, it shows the 2nd and 4th monday. In any case thank you for your help ... View more

first of all, many thanks in advance for your help on this. It partially worked, so I was originally using : ...|timechart span=2w@w7 count by exploitAvailable So I replaced with your suggestion: ...| timechart span=w@w1 count by exploitAvailable | reverse | streamstats current=t count AS SERIAL | where SERIAL > 1 | reverse | fields - SERIAL | timechart span=2w@w1 count by exploitAvailable _time NULL 2019-02-11 2 2019-02-25 2 2019-03-11 2 2019-03-25 2 2019-04-08 2 2019-04-22 2 2019-05-06 2 2019-05-20 1 So it worked for the dates, so it's not "spanning" using the 1st and 3rd mondays, but the counts I'm getting don't make sense, For my original search: ...|timechart span=2w@w7 count by exploitAvailable I was getting these results: _time No Yes 2019-02-17 1012 51867 2019-03-03 1088 60388 2019-03-17 757 41096 2019-03-31 781 58903 2019-04-14 912 74508 2019-04-28 850 79864 2019-05-12 1781 114675 2019-05-26 428 36136 ... View more

@DavidHourani any chance you can give me how that example would look like? ... View more

Hey, thanks for your response, I was using that for other metrics but, best I can say that value is not always giving me what I need, as the W1 stands for any Monday and 2W@ for every 2 weeks, but I'm looking to fix it only to 1st and 3rd Mondays. ... View more

It worked. I got confused with the |makeresults, command but once I removed that and the first eval, it worked pretty good. Many thanks!! ... View more

| rex mode=sed “s/“|\//g” this part give an error, that I cannot solve. Any idea? Error in 'SearchParser': Missing a search command before '\'. ... View more

These are 4 different records, where the value of the field Output contains a list of usernames as follows: "RTS851""SASPROD""SYS""JYCX""DEVUSER""SCFL""SYSTEM""CZ""VATUSER""CYBERDBUSER""ILOG666" "SYSTEM""LBS$MAUGAETE""LBS$AORELLAN""SYS" "SYSTEM""LBS$MAUGAETE""LBS$AORELLAN""SYS""ESTADISTICA" "LBS$ACISTERN""SYS""ADMINDBA""LBS$AORELLAN""LBS$ROLGONZA""LBS$PRANA""SYSTEM" What I want, is to be able to have the value of each field "Output" like it follows: RTS851 SASPROD SYS JYCX DEVUSER SCFL SYSTEM CZ VATUSER CYBERDBUSER ILOG666 ... View more

Just have in mind \"RTS851\"\"SASPROD\"\"SYS\"\"JYCX\"\"DEVUSER\"\"SCFL\"\"SYSTEM\"\"CZ\"\"VATUSER\"\"CYBERDBUSER\"\"ILOG666\" is just the value of the filed I want to split into multiple values. the same field will have different values. To explain this better, the field contains multiple "Usernames". Each line will have different Usernames all together in the same field value. I want to splint the field having 1 line per Username, so instead of having "RTS851""SASPROD""SYS""JYCX""DEVUSER" I get something like "RTS851" "SASPROD" "SYS" "JYCX" "DEVUSER" Is it clearer? ... View more

Many thanks!! ... View more

I found it...sorry, I needed to use AS to match IP Address from Table 1 and Table 2. Many thanks!! ... View more

Thanks for your reply. I was just trying what you've suggested. So for a particular IP address, I want to list all the fields in the 3 different lookups I have. Is there any match or Join I need to do to get that? ... View more

I have the same issue. Did you solved? ... View more

Awsome!! Many Thanks ... View more