One of the episode in my setup have not generated and i want to see the correlation search that run at that time. Is that possible, if Yes HOW? ... View more

I have a index say index1 having Air Details and ServerName of which some Air is missing for some serverNames. I have another index say index2 in this index i am getting the Air details that are missing in index1. Want to use index2 Air where i dont have values in index 1. ... View more

Not able to see my lookup while creating an automatic lookup. While creating an automatic lookup i am not able to see my lookups in the lookup dropdown. The permission of this lookup is set to global still no luck. Request you to please guide. ... View more

Want to get the external linked incident number in my email trigger of Correlation Search I have linked an incident ticket of snow to my episode and now i want to send this incident information in the email. Any help would be highly appreciated. ... View more

Hi Team, I have a KPI with split by entity say "Ent1". I have made a correlation search using this KPI and in the triggered email, i want to send this entity in the subject line. Can anybody help me in this regard. Thanks ... View more

I have 23 KPIs created for a service and all KPIs are green or normal but the overall service health is coming as N/A. Whats the reason of this, please help ... View more

We have KPIs setup for a service, whats happening is the Service health is calculated on the basis of the KPis getting the data, what we want is that the KPIs that are NA or not getting any data should be considered as Normal criticality while calculation of service health. ... View more

Hi Team, I have a service template with the KPI search as below: search Id="*" Environment=Production Status=Active | fields Id In the entity rules i have Id=100, so that i will get the results only for Id=100. But the service is returning the results containing all Id. ... View more

transaction id startswith="sourcetype=1" endswith="sourcetype=2" maxspan= in place of time range we want to have the +/-5min We want to calculate +/-5min time interval based on sourcetype1 event to validate if sourcetype2 event is falling under the same time interval. for ex say Sourcetype1 event1 occurred at 3:00pm so we want to check if sourcetype2 with the same id occurred for the interval 2:55pm to 3:05pm. Thanks ... View more

I have two sources of events say source_1 and source_2 Both the events are coming to splunk i need to check the id and Timestamp of the event and if the event coming from both sources at around same time i have to tag it as "Potential" otherwise "False". The catch is if i get the event at say 3pm from source_1 then my rule should check for the same event from 2:55 to 3:05 for sourcetype_2. If found tag it as "Potential" otherwise "False". Please help with this. ... View more

I have a search as below: |rex field=Field "^(?.+?)." | eval Srvr = if(sourcetype="Type_1", Field_1 , if(sourcetype="Type_2", Field_2, "NA")) | table Id sourcetype Field_1 Srvr I have two fields Field_1 that is in sourcetype="Type_1" Field_2 that is in sourcetype="Type_2" I want to take the values of these field in one field that is Srvr in the searxh above. Please suggest as the query is not picking up the values from the fields Field_1 and Filed_2 but the if condition is working with harcoded values. ... View more

I have a field FQ with the value as "ServerName.domain.com" I want to get only the server name in another field. Please help. ... View more

I want to pick up values from different lookup files according to the sourcetype. | lookup error_rules.csv EventSubType Criticality OUTPUT wait_time threshold_count window_limit Say i have two source type 1 and type2 For type1 i want to lookup EventSubType and Criticality_type1 in lookup error_rules.csv For type2 i want to lookup EventSubType and Criticality_type2 in lookup error_rules.csv Please suggest the solution for this scenario if case needs to be used let me know how it will be implemented. ... View more

| lookup error_rules_latest.csv EventType OUTPUT alert_type wait_time reoccurrence_window threshold_count reoccurrence_window_limit | transaction Id Message maxspan=5m | bucket _time span=240m | stats list(Timestamp) AS EventTimeStamp list(sourcetype) AS SourceOfData list(EventType) AS EventType first(wait_time) as WaitTimeLimit first(threshold_count) AS ReoccurenceThresholdCount first(reoccurrence_window_limit) count by Id Message _time The 240m and 5m needs to be taken from the lookup file as a variable. bucket _time span=240m should be taken from reoccurrence_window_limit maxspan=5m should be taken from wait_time Any help will be appreciated...Thanks ... View more

I have a stats result with the count field. I want to compare if this count is greater than another field. I.e., a threshold field in my stats result dynamically. I want to compare count with threshold and then tag the event as False or True. ... View more