Please clarify your requirement - do you want the alert to trigger if any of the values occurs 5 times e.g. 2 warnings, 2 errors and 1 critical, or only if any of them individually occur 5 times e.g. 5 warnings or 5 errors or 5 criticals? ... View more

Do you mean something like this? | spath NewList{} output=NewList | table NewList | mvexpand NewList | spath input=NewList | fields - NewList ... View more

Please can you repost your sample data in the correct format as what you posted does not match the structure show in your screen grab and is not valid JSON. Also, please paste into a code block </> to preserve format information. ... View more

Set up a "fake" to address and use that. However, you should consider that while Splunk may be able (to attempt) to send the email, the email system, either the senders or receivers, may deem a message with no real to address and only bcc address as spam and will junk the messages. ... View more

You could do something like this | eval sameday=if(relative_time(starttime,"@d")=relative_time(endtime,"@d"),"true","false") ... View more

This appears to be a duplicate of this question splunk dashboard studio result variance - Splunk Community ... View more

It is not clear what your events look like, but you could try something like this | stats count by field1, field2 ... View more

<main index> NOT [search <other source> NoHandlerFoundException | stats count by xCorrelationId | fields xCorrelationId | format] However, depending on how may exceptions you have, you may run into limitations as the sub-search with the format command will essentially return a long string which might be too large to be parsed in the main search. Another way to do it is to search both sources, and correlate by xCorrelationId and exclude those xCorrelationId's which have the exception, but this still means you are retrieving both full sets of events and correlating them before you can filter out any. ... View more

It is unlikely that Splunk is adding them to the data it receives - what is your ingest path, i.e. how does the data get into Splunk and what configuration have you used along the way? ... View more

Except that the screen grab you showed is not from this SimpleXML code   ... View more

It looks like it is the control characters which are giving you grief. You could try replacing "\x" with "\\x" and then reparsing (with spath) (you may need to remove all the other fields already parsed though) ... View more

All you have shown is a screen grab of something that isn't working without any detail of what you have actually tried i.e. the SimpleXML you are using in this instance. Please share some useful information. ... View more

| eval devices=mvappend(old_device,new_device) | stats values(user) as users by devices ... View more

Please can you share some anonymised representative events demonstrating your issue? ... View more

Try like this: <panel id="pqr"> <input type="time" token="time"> <label>DateTime</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> </panel> <panel id="abc"> <title>Latest time token $latest_Time$</title> <input type="dropdown" token="timedrop"> <label>Time Dropdown</label> <choice value="now">Now</choice> <choice value="+3d">3d</choice> <choice value="+4d">4d</choice> <choice value="+5d">5d</choice> <default>now</default> <change> <eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval> </change> </input> </panel> There doesn't seem to be a way to set an initial value on a time input - perhaps this is a bug? ... View more

How quickly are your events getting indexed? For example, if you look at the _indextime field and compare it to the _time field you will notice a lag. If this is over a minute, it could be that the events between -2m and -1m are not indexed before -1m and would therefore not show up in your alert search ... View more

I am not sure why you are getting different results in Fast and Verbose mode, but there appear to be some oddities with your search: | eval newtime=strftime(_time,"%m/%d/%y %H:%M:%S") This creates a string - what is the maximum of a string? | stats ... max(newtime) as "event time" Field times does not exist (after previous stats command) | eval times=mvindex(times, 0, 2) I am not sure whether these make a difference though ... View more

Rest assured, if I had any suggestions, I would have given them by now. ... View more

OK so I'll ask again another way, what output would you like, for example from the 8 lines you shared earlier? ... View more

Your output looks correct. Is it not what you expected? If not, what did you expect? ... View more

As I suggested, it might be your data because the way you appear to be doing it should work. Can you identify values of field1 which should have joined which don't appear to have joined? Also, bear in mind that sub-search (as used by your inner search on the join) are limited to 50,000 events so it could be that the missing inner events have fallen outside the 50k limit. Try reducing the timeframe for you search to see if there is a point at which you get the results you expect. ... View more

match uses regex so the * at the end of each string is probably superfluous (unless you were matching for "File put Succesfull" or "File put Succesfullyyyyy") Other than that, it looks like your mvdedup mvfilter should work. Please can you share some example events for which this is not working? ... View more

So, what are you saying is not working, are you getting no results when you were expect some or results when you were expecting none? Either way, it sounds like a problem with your data not being as you expected. Are the fields extracted as you expected? Do you have any "hidden" blank spaces which cause the join to give unexpected results? You could try including the "inner" search in the main search and set a field based on whether the event can be identified as coming from the inner search or not e.g. | eval inner=if(index="index1", "true", "false") | stats values(inner) as innerouter by field1 If innerouter has both "true" and "false" then value in field1 appeared in the inner search and at least one of the outer searches, etc. ... View more