Since you're working with a multivalue field, you want to use multivalue commands https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/MultivalueEvalFunctions#mvfilter.28X.29. Below are two examples of things that should work (matching a regex block or filtering down to just that row): | makeresults count=2 | streamstats count | eval letter=if(count=1, "a", "b") | stats values(letter) as letter | eval letterExists=if(match(letter, "a"),1,0) | eval letterFiltered=mvfilter(match(letter, "a")) Hope this helps 🙂 ... View more

There are a number of ways, including looking in the monitoring console (settings -> monitoring console -> search -> scheduled search history). To look at alerts that have fired/triggered, try index=_internal earliest=-{inputNumberOfHours}h result_count>0 | stats count by savedsearch_id ... View more

index=windows EventID=4728 OR EventID=4732 OR EventID=4756 | lookup AD_groups Group AS Group_Name OUTPUT is_privileged AS privileged | where is_privileged="True" I think you renamed is_privileged to privileged and then searched for is_privileged instead of privileged . As a side note: debugging line by line is a really powerful way to figure out where your bugs are in Splunk code, since SPL is a unix based language the output of one search goes directly into the input of another. So to find a bug in the last pipe, go pipe by pipe until you find the bug. In your case, if you run the search just after the lookup command you would probably see values for privileged, which could clue that the values are there and the field name might be incorrect. Hope this helps! EDIT: I prefer search for string comparison, as that's it's core functionality and I'm less likely to hit a mismatch in comparisons. where is more commonly used for field comparisons, i.e. field1 = field2, field1 > field2 etc ... View more

Based on @adonio's idea: index=_internal savedsearch_id="{savedSearchName}" earliest=-8h result_count>0 | stats count And alert when the count is 0, running at 12 PM (or whatever time frame you want). Do a fuzzy search for the savedSearchName if you haven't worked with the _internal index before, ours followed something like user;app;name as the format. Hope this helps! ... View more

Is the fillnull command not an option? You can fill either a specific field, i.e.: | fillnull Counter_Id value=0 or a catch all fill null: |fillnull value="N/A" You can also do checks with the |where or |eval command for if things are null, and then filling them accordingly (a little more abstract for this use case but in general it's helpful to use sometimes) https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/InformationalFunctions#isnotnull.28X.29 Either: | where isnotnull(fieldName) or |eval fieldName=if(isnull(fieldName), someAction, fieldName) Hope this helps! ... View more

You're definitely on the right track - I like doing something like this for readability, as you clearly create a variable for pass and fail, and set it to a bool. Then, you can just sum them by whatever you want (I did src in this case), then do a simple divide eval command to get the percent. index=foo | stats count by src, action |eval pass=if(action="pass", 1, 0) |eval fail=if(action="fail", 1, 0) |stats sum(pass) as numPass, sum(fail) as numFail by src |eval failPerc=numFail/(numFail + numPass) * 100 Hope this helps! ... View more

Also if you're using a rex command, you can specify a max_match of 0 to return all matches, see the documentation here: https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Rex ... View more

Hey - check out the answer I posted here - https://answers.splunk.com/answers/790088/splunk-searches-delayed.html#answer-790351, I leverage the Monitoring Console really heavily for their built in searches! ... View more

Also, you're returning a multivalue field because there are multiple errors in the time frame you're searching. You'll need to narrow it down to a more specific time frame , probably by adding a | bin _time span=d as day before the stats command and adding day after host, i.e. by host, day . This will bucket events by day, but you can bin the _time to be smaller, or use another field to better correlate the issues with each other, otherwise an OS issue from last week could correlate to a loggingservice issue from 2 weeks ago. ... View more

Oops, I updated it. We want to search for the value to be 1 for the one event type and 0 for the other. In the future, going line by line down to debug is a good way to determine what the issue would be. In this case, after removing the where clause I would see there was a 1 and a 0, not a value and a null field, so I know i need to change the filtering criteria. You can write this without the two eval statements, just passing through a field from each log that is distinct, and searching for the absence of one of them, which is why I wrote it with a null check instead of a value check. Both ways work, this one is a little more verbose but clear what you're trying to accomplish. Please accept/upvote the answer if this works! ... View more

Something like the following should work, where you pull in both sets of information, create a joining field, and aggregate with a stats field. Make sure to run this over a finite enough time frame that you won't be pulling in multiple sources of information, else you'll have to add a bin statement to bucket time in a way that makes sense for what you're trying to do: index=wineventlog (EventType=4 EventCode=12 OR EventCode=13) OR (EventCode=1100 ComputerName!=HD* ComputerName!=HL*) | eval host=coalesce(host, ComputerName) # assumption made here that ComputerName and host represent the same values | eval EventTypeFromOS=if(EventType IN (4, 12, 13), 1, 0) | eval EventTypeFromLoggingService=if(EventType=1100, 1, 0) | stats values(EventTypeFromOS) as EventTypeFromOS, values(EventTypeFromLoggingService) as EventTypeFromLoggingService by host |search EventTypeFromLoggingService=1 AND EventTypeFromOS=0 At a high level, this pulls in both events, creates a host field which is the coalesced field of host and ComputerName which I assume represent the same value, if not, change it to one that does, create a verbose field that represents if the event is from the first set of logs or the second, take the values of that by host (the field we created), and search for where loggingservice is not null and OS log is null (meaning it's an issue on one end and not the other). Hope this helps ... View more

Oh, yeah in the second one it should be max, not latest. latest only works if you have a _time field still, which we don't have in the csv. Alternatively, change the top search to be stats latest(_time) as _time, then you can move the inputlookup one command higher in the second one and remove one of the stats commands. Your call! ... View more

We have a concept with our deployment of an "all hosts" csv, which is the current representation of all of our reporting hosts. In this sense, you could do something similar, setting up a csv which represents the most recent sourcetype ingest by host. The base of that search could be something like: index=my_index custom_tag=tag sourcetype="my_srctype" | stats latest(_time) AS Latest by host sourcetype |inputlookup append=t sourceIngestByHost.csv |stats latest(Latest) as Latest by host, sourcetype |outputlookup sourceIngestByHost.csv and then you can use that csv as a reference in the bottom of your search: index=my_index custom_tag=tag sourcetype="my_srctype" | inputlookup sourceIngestByHost.csv append=t |eval _time=coalesce(_time, Latest) | stats latest(_time) AS Latest by host sourcetype | eval check1hour=(now()- Latest)/3600 | eval status=if(check1hour>1,"fail","success") | eval LastIngestionTime=strftime(Latest, "%Y/%m/%d %H:%M:%S %Z") | rename LastIngestionTime as "Last Ingestion Time" | table host sourcetype "Last Ingestion Time" status | sort - _time The first time you run the top command you'll probably need to run it without the inputlookup command, you should then have a file of host, sourcetype, Latest -> you can pipe this into your other search, coalesce the _time fields so they play nicely in the stats command, and then get the latest time by sourcetype regardless of whether they're in the last day search, as the csv search (which you can run nightly), will have this historical data. Does this make sense? Hope it helps 🙂 ... View more

It works for me either way, you just want to make sure you're running the eventstats command before you convert, since you can't take the max() value of a string. ... View more

index=yourIndex sourcetype=yourSourcetype earliest=-month | bin _time span=d as day | eventstats max(day) as mostRecentDay | where day=mostRecentDay Doesn't work? The earliest token is kind of irrelevant ... View more

You can use time tokens in a search to specify exact boundaries of time by snapping to relative times. Example: index=AWS sourcetype=AWS otherInfo=Value earliest=-d@d latest=@d This will snap the search to "at earliest, minus 1 day and snapped to the beginning of the day, and at latest, snap to the beginning of this day". You can do similar things with minutes, weeks, months, etc. In your case, you would want to run this at any time on December 31st to capture December 30th's info, and so on. By default, this configuration will always capture yesterday's full info set. Really powerful stuff! Take a look at this doc sheet: https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/SearchTimeModifiers#Define_the_time_amount. Hope this helps 🙂 ... View more