May I misunderstand your question, but it's simple: index= testing field1="write" field2="*@abc.com" |table field1, field2, .... if "@abc.com"  is a user name and not a domain (as I assume) you do not need to put the wildcard (*) before. If you put it, it will result in every user with @abc.com. Like, user1@abc.com, user2@abc.com... alternative: index=testing | stats count by field1 field2 | search field1="write" AND field2"*@abc.com" Regards, ... View more

@jaibalaraman , your searches return a consistent set of results regardless of the time zone you are in. ... View more

Use this index=testing | timechart max("event.Properties.duration") as maxDuration | eval maxDuration=round(maxDuration/1000, 3)   ... View more

PowerCoonnect from RHONDS includes tons of out-of-the-box dashboards for SAP's SaaS offerings. You should reach out to them. You can see more information HERE ... View more

Instead of dealing with the messiness of a natural language, it might be better to use standard notation of duration, like | fieldformat max(event.Properties.duration) = tostring('max(event.Properties.duration)', "duration") Instead of 40 mins , 30 mins or 1 hrs, you get 00:40:00, 00:30:00, 01:00:00, and so on. ... View more

Try something like this index=events event.Properties.errMessage!="Invalid LoginID" event.Properties.errMessage!="Account Temporarily Locked Out" event.Properties.errMessage!="Permission denied" event.Properties.errMessage!="Unauthorized user" event.Properties.errMessage!="Account Pending Verification" event.Properties.errMessage!="Invalid parameter value" | stats count by event.Properties.errMessage ... View more

Create a composite field with the two labels concatenated and count by that I am not sure how to create composite filed, could you please advice on this please   ... View more

The below 2 commands are not working  | `histogram("event.Properties.duration", 31)` bin "$var$" bins=$bins$ | stats count by "$var$" | makecontinuous "$var$" | fillnull count   What type of graph or visualization would you like to create? Just want to create a dashboard tile to show the metric  ... View more

Hello, Here's the image. I want to have the time range change based on the selected Grade. For example: If I select Kindergarten, the time will change to "last 24 hours" Thank you ... View more

After a timechart split by a field you cannot use the field name after the timechart as it no longer exists. The field names are the values of your 'series' field. You need to use the foreach method in your initial post The reason why index=aws returns nothing is that the data you are searching for does not exist in that index. What makes you think it did? It is in the _internal index, so you should definitely include that Change your earliest/latest settings to define the time period you want to search for, or use the time picker instead and remove the earliest and latest totally.   ... View more

Open the dashboard and click on the edit option Then click on the edit Data Overview button Click on the pencil for the search you want to update Or create a new search Paste your search into the Search with SPL box ... View more

Don't be confused, just use the first row example where each element uses a separate <single> configuration inside the one panel. You could theoretically do it in trellis by combining all the searches, but there would be little point. ... View more

OK. To find which of your servers are vulnerable (use the vulnerable library) you need a completely different tool - some form of software inventory solution and/or vulnerability scanner/manager. To find out whether someone already tried to exploit this CVE, you have a nice splunk blog post https://www.splunk.com/en_us/blog/security/log4shell-detecting-log4j-vulnerability-cve-2021-44228-continued.html ... View more

Did you google it?  Not much to do with Splunk....but the short answer is no. The long answer is that you cannot find out exactly what model iphone this is based on your string above. except that it is an Apple IOS Mobile device (32 bit) and not a tablet. ... View more

Sorry, I assumed you were using the my suggested case statement - rather than your original nested if statement. Are you saying that if statement is what gives you the results in your screenshot? As for your question on examples of the lookup command, my earlier post showed you how to use the lookup command to get what you want, you will just need to create your lookup as I suggeted. You will not need the case statement if you use a lookup. See the lookup description here https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchTutorial/Usefieldlookups and how to set up wildcard lookups here https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/Addfieldmatchingrulestoyourlookupconfiguration   ... View more

See https://splunkbase.splunk.com/app/1843/#/details ... View more

Hi  Why don't you just use a lookup? Or even better - do an automatic lookup so it fills a "human-readable" type into a separate field. Could you please help me on this,  i don't know how to use lookup command.  ... View more

This is rather challenging to do in SPL, which explains why the TAs use external commands to parse the URLs.  Perhaps reviewing the TAs will give you ideas on how to accomplish your goal. ... View more

The query you ran does not have a command that generates statistics so you won't see anything in the Statistics tab.  Look at the results in the Events tab or add commands to the given query.  It was not meant to be complete - just to answer the question asked. ... View more

Here is some links to how to collect data from APC UPS via syslog and some example dashboards. https://community.splunk.com/t5/Archive/APC-UPS-log-field-identification/m-p/61417 https://www.nathanhunstad.com/blog/2015/05/monitoring-my-ups-with-splunk/ https://www.juniper.net/documentation/en_US/jsa7.3.1/jsa-configuring-dsm/topics/task/operational/jsa-dsm-configuring-your-apc-ups-to.html https://community.spiceworks.com/topic/1948442-apc-ups-event-logging-tool Unfortunately there is no ready to use dashboard code examples. r. Ismo ... View more

Hi @jaibalaraman, Your problem seems that User_Agent field is not exist as it is or there is no event returns from search before stats command.   1. Run below search to see any results? index=aws sourcetype = * Website="*" If there is no results, please check if Website and User_Agent fields are correct in Interesting Fields section. You can try again using correct field names. Please keep in mind that the field names are case sensitive. 2. If above returns results, try below; index=aws sourcetype = * Website="*" User_Agent=*  I think there will be no results, please check if  User_Agent field is correct in Interesting Fields section. You can try again using correct field name. Please keep in mind that the field names are case sensitive. ... View more

Hi  No, i am still waiting for an answer. Thanks ... View more

The example was just that - an example.  As I mentioned in my first reply, you'll have to account for multiple uses of the same field (named capture group). ... View more