Hello, I have a lookup that will only have one column (MY_COL), this column will always have at least one row but could have multiple. I am trying to take the value of the row(s) and use them in a search query like this index=my_index RuleID=(INSERT LOOKUP VALUES HERE, IF MULTIPLE MAKE IT AN OR STATEMENT) | table RuleID, etc, etc, Is there a clean way to do this? Thanks in advance! ... View more

I have some json data events that has multiple "date" fields. The date field I am looking to use as my timestamp comes at the end of every event and it appears that Splunk is using whichever date field it reads first. Is there a way to specify which date field to use? The fields are in different time formats and even though I am specifying the time format for epoch time, it still appears to be incorrectly reading the first timestamp. props.conf: [sourcetype] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true AUTO_KV_JSON=false CHARSET=UTF-8 INDEXED_EXTRACTIONS=json KV_MODE=none TRUNCATE=20000 category=Structured description=JavaScript Object Notation format. For more information, visit http://json.org/ disabled=false pulldown_type=true TIME_PREFIX="date":+ TIME_FORMAT=%s%3N MAX_TIMESTAMP_LOOKAHEAD=13 Data Sample: {"message”:”[messageType] This is a message",”type":"IntegrationLog","level":"WARN","details":{"_incomingData":{"_parsedData":{"hostNotificationNumber":"1","date":"2020-04-01”},”dateType”:”blah”,”integrationName”:”blahblahblah”,”incomingDataId”:”xxxxxxxxxxxxxxx”}},”date":1585775200775} ... View more

I have json files that have multiple events per file. However when I ingest the data, Splunk parses some of the timestamps correctly and gives other events from the same file the timestamp of when the data was indexed. Anyone else had this problem and know a solution/explanation? All-time search of the source(which is path name that ends with json filename) in picture to show results Thanks in advance props.conf [sourcetype] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true AUTO_KV_JSON=false CHARSET=UTF-8 INDEXED_EXTRACTIONS=json KV_MODE=none TRUNCATE=20000 category=Structured description=JavaScript Object Notation format. For more information, visit http://json.org/ disabled=false pulldown_type=true TIME_PREFIX="date":+ ... View more

I have json data that comes in tracking ID's. An event is created when an ID is "created" and an event is created when an ID is "closed". Each event has the same alert ID and I'm struggling with a query that dedups the alert ID, and puts the times the ID's were created and closed in the columns. Looking for a table something like this: the times can be when the events were created or there is also a json field that's extracted as "date" Thanks in advance. ID| Created_Time | Closed_Time | x | xxxxxxxxxxxx | xxxxxxxx ... View more

I have json data that can vary greatly in size with the timestamp field coming at the end of each event. I'm able to parse all the timestamps correctly using the config TIME_PREFIX="timestamp":+ except for the events that are very large. My question is, in order to parse the timestamp for the very large events, do I need to add a MAX_TIMESTAMP_LOOKAHEAD? Or if I added a larger TRUNCATE would the TIME_PREFIX config still need the MAX_TIMESTAMP_LOOKAHEAD? props.conf [mysourcetype] CHARSET=UTF-8 INDEXED_EXTRACTIONS=json KV_MODE=none LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true SHOULD_LINEMERGE=true category=Structured description=JavaScript Object Notation format. For more information, visit http://json.org/ disabled=false pulldown_type=true TIME_PREFIX="timestamp":+ ... View more

When upgrading apps/add-ons in a distributed environment, is there a recommended best practice or is it similar to deploying the app initially where I can just paste the newer downloaded version from Splunkbase over the existing app and then push the new bundle to the peers to fully update the app? And also is there any scenario where a rolling restart for this wouldn’t be required? Thanks in advance ... View more