Hi, I'm trying to identify the users who updated which look file and what information they updated. I was planning to track such information using dashboards. Thank you for your assistance in advance. The one I tested is below since it only displays a limited collection of data such as user, app, and lookup file name. index=_internal "Lookup edited successfully" | table _time user namespace lookup_file   ... View more

Hi Experts, Please help with regex to  parse the hh:mm:ss into separate filed as show below. message: hello this is the first message from splunk 12:45:13 hai this is the second message from splunk  hello this is the third message from splunk 19:43:53 expected outpout:   subject:                                                                                                        time: hello this is the first message from splunk                              12:45:13 hai this is the second message from splunk  hello this is the third message from splunk                              19:43:53 | rex field=message "(?<subject>.\w+)\s*(?<time>.\d+:\d+:\d+)?" but not worked. plz help thanks in advance. ... View more

Hi,  how to compare search1 results with search2 and list out how many matched and not matched. EX: search1: index=test sourcetype=sample | rex "type=(?<Job>.*) " |dedup Job |table Job search2:  index=** sourcetype=** |rename JOBS AS Job |dedup Job |table Job sample data from search1: Jobs xxx yyy zzz aaa sample data from search2: Jobs aaa bbb ccc ddd xxx ttt Expected sample output: search1 is returning 100 jobs and search2 is returning 200 jobs, we need to list out the jobs those are not matching search1 with search2 for example: out of 100 jobs if 40 matched with search2 remaining 60 not matched jobs list in search1  Output: Jobs bbb ccc ddd ttt Tried |set diff command but not worked, Please help. Thanks in advance.         ... View more

Hi Experts, I am trying to create a tag based on event occurrence. for example if domain=web event occurred ,then automatically create a tag for it using macro. Please help me on this. Thanks in advance. ... View more

Hi, I am facing a problem while passing latest value to drill down form, So when I click on each row i want the drill to show the transactions in that time range alone dynamically.   <dashboard> <label>Sample</label> <row> <panel> <chart> <search> <query>index=_internal | timechart count by sourcetype</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">all</option> <drilldown> <set token="name2">$click.name2$</set> <eval token="ear">$click.value$</eval> <eval token="lat">relative_time($click.value$,"+59m")</eval> </drilldown> </chart> </panel> </row> <row> <panel> <chart> <title>$name2$</title> <search> <query>index=_internal sourcetype=$name2$ | timechart span=1m count</query> <earliest>$ear$</earliest> <latest>$lat$</latest> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> </dashboard> Above dashboard working fine as expected but if select more then 24 hours getting a problem. Expected result: If i select <= 24 hours, latest time value should be  i.e, <eval token="lat">relative_time($click.value$,"+59m")</eval> same like 7 days - "+1d", 30days  - "+7d", YeartoDate - "+1mon" Please help me on this. Thanks in advance.     ... View more

Hi Experts, Hi have existing inputlookup file like test.csv which contains 3 fields like host source sourcetype, i want to add extra one new filed called _time with these 3 fields. I have tried with basesearch | table host source soursetype _time|outputlookup test.csv append=true but new field is not appending for example if I have this existing csv file contains 100 rows, then these 3 fileds along with new filed results shold be added from 101th row onwards in the csv. Plz help on this and thanks in advance. ... View more

Hi experts, I have a multiple errors like "***error occured" , "failed error **** " and etc, I need to check what are errors occurred in the last 24 hours, whether the same errors occurred in the last 60 days or not, if not occurred in the past then trigger a alert which means these are the new errors we considering. Please help on this. Thanks in advance. ... View more

Hi experts, I have a filed called names as shown below, if i search with first line of strings then search returning the complete filed event but not second and third line of filed strings. I used | eval names= mvfilter(names="32") and also | eval names= mvfilter(match("32", names)) but not worked for me. Please help me on this, Thanks in advance. names 1121 - sample name 3247 - sample names 9876 - simple name required out put: if I search with names=1121* or names=3247* or names=9876* then complete event has to be returned.i,e as i shown above. ... View more

Hi Experts, I have a inputlookup file which consists of two fields i,e _time and names fields as shown below, _time names 02/02/2020 user1 user2 08/02/2020 user1 user2 user3 10/02/2020 user2 I want to expand multi value filed i.e, names filed and show unique users list based on time, i tried |inputlookup filename.csv |stats values(names) as name |mvexpand name |dedup name |table name| sort - name but not worked for me,. Please help on this, Thanks in advance. ... View more

Hi experts, please help me with regular expression to match the value in each event at search time as shown below :{\"buaid\":{\"business\":[\"12345\"],\"exclude* required output: bss_value=12345 thanks in advance. ... View more

Hi Experts, I have a one month data inputlookup file i.e, sample.csv which contains two fields test and _time. I want to compare weekly data. sample.csv test _time 101 202/04/02 14:02:18 102 202/04/01 20:21:50 101 202/04/05 02:09:12 101 202/03/31 08:11:29 Expected output: test count week 101 2 thisweek 102 1 lastweek 103 1 prior week 101 1 prior week like this.. please help on this and thanks in advance. ... View more

Hi, I have sample xml as shown below, I'm trying to show the panel based on the choice but it is not working. Please help on this. required: If I select first drop down panel will be displayed dynamically and than if i select any value in 2nd drop down, Corresponding panel will be displayed at the same time first panel has be hided. same like 3rd drop down, if select any value in 3rd drop down than 1st & 2nd panels will be hided and 3rd panel will be opened. Could you please check with my sample xml and suggest me where it wrong. Thanks in advance. <form> <label>Test</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="tkn_sourcetype" searchWhenChanged="true"> <label>Select Sourcetype</label> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <choice value="*">ALL</choice> <initialValue>*</initialValue> <change> <condition label="sourcetype"> <set token="token_sourcetype"></set> <unset token="token_component"></unset> <unset token="token_group"></unset> </condition> </change> <search> <query>index=_internal sourcetype=* | dedup sourcetype | table sourcetype</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="tkn_component" searchWhenChanged="true"> <label>Select Component</label> <fieldForLabel>component</fieldForLabel> <fieldForValue>component</fieldForValue> <choice value="*">All</choice> <initialValue>*</initialValue> <change> <condition label="component"> <set token="token_component"></set> <unset token="token_sourcetype"></unset> <unset token="token_group"></unset> </condition> </change> <search> <query>index=_internal sourcetype="$tkn_sourcetype$" component=* | dedup component | table component</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="tkn_group" searchWhenChanged="true"> <label>select group</label> <fieldForLabel>group</fieldForLabel> <fieldForValue>group</fieldForValue> <choice value="*">All</choice> <change> <condition label="group"> <set token="token_group"></set> <unset token="token_sourcetype"></unset> <unset token="token_component"></unset> </condition> </change> <search> <query>index=_internal sourcetype="$tkn_sourcetype$" component="$tkn_source$" | dedup group | table group</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset> <row depends="$token_sourcetype$"> <panel> <chart> <title>test</title> <search> <query>index=_internal sourcetype="$tkn_sourcetype$" | stats count by sourcetype</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> <row depends="$token_component$"> <panel> <chart> <title>test</title> <search> <query>index=_internal component="$tkn_component$" | stats count by component</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> <row depends="$token_group$"> <panel> <chart> <title>test</title> <search> <query>index=_internal component="$tkn_group$" | stats count by component</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> </form> ... View more