Good day, I have this SPL: index=test_7d sourcetype="Ibm:BigFix:CVE" earliest=-1d | search FixletSourceSeverityTxt="Critical" OR FixletSourceSeverityTxt="Urgent" | eval ReleaseDtm=strptime(FixletSourceReleaseDtm, "%Y-%m-%d") | where ReleaseDtm>1672531199 ```Epoch time for 12/31/22 23:59:59, this gets only 2023 fixlets``` | eval _time = ReleaseDtm | makemv FixletCVETxt | eval cvecount=mvcount(FixletCVETxt) | eval cvetotal=cvecount * RemediatedComputerCount | timechart span=1mon sum(cvetotal) as cvetotal sum(RemediatedComputerCount) as RemediatedComputerCount by ComputerDatabaseId     That has the output of:   _time RemediatedComputerCount: 0 RemediatedComputerCount: 1 cvetotal: 0 cvetotal: 1 2023-01 113575 29512 7177373 1619396 2023-02 230629 42239 4779801 1063153 2023-03 253770 55769 7246548 1792831 2023-04 139419 36156 8175076 2192272 2023-05 144117 40335 2781698 740369 2023-06 314684 81621 5574141 1420760 2023-07 163672 47112 13643474 3957452 2023-08 281891 65004 6481422 1587176 2023-09 4596 6508 62384 98312   I would like to add the 'RemediatedComputerCount: #' columns to a total column by month next to the existing columns.  Then add another column with totals for 'cvetotal: #'.  I don't want totals of each column for a grand total at the bottom, just the total of the like columns in a new one by _time. Suggestions?  Thanks! ... View more

I am getting the log file imported to Splunk, but each line is an event with no field name.  Can I break up the line into columns?  If not, how do I parse the line to extract a number? Index is: index=test_7d sourcetype=kafka:producer:bigfix Events are: 2023-06-22 09:15:44,270 root - INFO - 114510 events have been uploaded to topic DC2_Endpoint_Configuration_IBM_BigFix_Patch_Join on Kafka 2023-06-22 09:15:37,204 root - INFO - Executing getDatafromDB 2023-06-22 09:15:35,704 root - INFO - 35205 events have been uploaded to topic DC2_Endpoint_Configuration_IBM_BigFix_Patch_Join on Kafka 2023-06-22 09:15:33,286 root - INFO - Executing getDatafromDB 2023-06-22 09:15:32,703 root - INFO - 167996 events have been uploaded to topic DC2_Endpoint_Configuration_IBM_BigFix_Patch_Join on Kafka 2023-06-22 09:15:22,479 root - INFO - Executing getDatafromDB 2023-06-22 09:15:19,031 root - INFO - 181 events have been uploaded to topic DC2_Endpoint_Configuration_IBM_BigFix_Patch_Join on Kafka Each line/event starts with the date, the wordwrap is making it look incorrect.  I need to parse the bold number of each line after '- INFO -' and add a zero if no number.  I can do this with a eval, but how do I parse if there is no field name to add to the 'regex' command? For example, here I'm using 'regex' to remove Operating Systems from dataset on a fieldname 'operating_system' which is one column of an sourcetype: | regex operating_system!="(Linux|AIX|CENTOS|WINDOWS|Digital UNIX|FreeBSD|HP-UX|Hyper-V|Juniper|Mac|Windows|NetBSD|OpenBSD|OpenVMS|Server 2012|Server Core 2012|Server 2016|Server 2019|Ubuntu|Solaris|Unix|ESX|vCenter Server|rbash|[\*\*\*\*\*\*]|\A[\-\-\-\-\-\-\-\-\-\-]|[\=\=\=\=\=\=\=\=\=\=])" I found the erex command that works, | erex ImportCount examples="0,35205,114510" But you have to enter a sample of the text you are looking for.  So it only works for one day and it has to be changed, the sample are values in the dataset, but everyday the log file changes with new values updated.  Can regex be used in place of the examples? ... View more

I am getting the log file imported to Splunk, but each line is an event with no field name.  Can I break up the line into columns?  If not, how do I parse the line to extract a number? Index is: index=test_7d sourcetype=kafka:producer:bigfix Events are: 2023-06-22 09:15:44,270 root - INFO - 114510 events have been uploaded to topic DC2_Endpoint_Configuration_IBM_BigFix_Patch_Join on Kafka 2023-06-22 09:15:37,204 root - INFO - Executing getDatafromDB 2023-06-22 09:15:35,704 root - INFO - 35205 events have been uploaded to topic DC2_Endpoint_Configuration_IBM_BigFix_Patch_Join on Kafka 2023-06-22 09:15:33,286 root - INFO - Executing getDatafromDB 2023-06-22 09:15:32,703 root - INFO - 167996 events have been uploaded to topic DC2_Endpoint_Configuration_IBM_BigFix_Patch_Join on Kafka 2023-06-22 09:15:22,479 root - INFO - Executing getDatafromDB 2023-06-22 09:15:19,031 root - INFO - 181 events have been uploaded to topic DC2_Endpoint_Configuration_IBM_BigFix_Patch_Join on Kafka Each line/event starts with the date, the wordwrap is making it look incorrect.  I need to parse the bold number of each line after '- INFO -' and add a zero if no number.  I can do this with a eval, but how do I parse if there is no field name to add to the 'regex' command? Thank you for looking at this problem! ... View more

I have a log file that Splunk is monitoring.  The problem is, I think, that a custom python script runs and outputs the results at one time to the log file.  The forwarder it taking the entire entry from the script as one event, but I need each line to be an event.   How do I configure the forwarder to parse the output to the log file?  Here is what I have configured: input.conf: [monitor://D:\Tools\DailyChecks\Reports\Actionable_report_output_PROD.txt] index=test_7d sourcetype=Ibm:BigFix:DailyChecks disabled=0 props.conf: [Ibm:BigFix:DailyChecks] EVENT_BREAKER_ENABLE=false EVENT_BREAKER=([\r\n]+) SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=false CHARSET=UTF-8 MAX_TIMESTAMP_LOOKAHEAD=30 # disabled=false TZ=UTC Sample of the log file: -------------Report for-----------PROD DETAIL Take Action==> Number of encryption certificates of bes license: [0] FAIL Take Action==> 1.7.6: Actionsite Size Check Actionsite Size Check FAIL Take Action==> ActionSite Size is too large: ['63733 KB'] DETAIL Take Action==> Total Stopped/Expired Action count (more than 30 days old): [['Total: 96', 'Single Top-Level:4', 'Baseline Component: 92']] FAIL Take Action==> 1.10.5: Duplicate Computers (by Computer Name) Check for Duplicated Computers FAIL Take Action==> There are at least 100 duplicates of the following computers: ['PL-MTL-P-151', 'PL-MTL-P-41', 'SIMICS-MACHINE', 'SIMICSLESS-VM', 'localhost.localdomain', 'simics-vm061', 'simics-vm062', 'simics-vm063', 'simics-vm064', 'simics-vm065', 'simics-vm066', 'simics-vm067'] ... View more

Good morning/afternoon/evening, I have a field (registeredIp) that sometimes will not have an IP address in it, it will be an error message instead.  I use this field as my primary key for removing duplicates so I need this field to have the IP.  I also capture all associated IPs (management cards, multi homed NICs, etc.) that show the IP as a mv field array such as in this example: ipAddress: (10.42.103.94,172.19.22.224,143.182.146.182,10.9.35.59) I've used an IF statement with MATCH to get the first IP address (usually the production IP I need) but it only returns true in the registeredIp field. | eval registrationIp=if(registrationIp="null" OR registrationIp="Singular expression refers to nonexistent object.",match(ipAddress,"^(?:[0-9]{1,3}\.){3}[0-9]{1,3}"),registrationIp) In this case I need registrationIp to equal 10.42.103.94, not True. Any help getting the first IP address into this field would be appreciated.  Thanks!   ... View more

I have a query that works, but the output calculates a percentage column in a chart.  I need to show the total of TAM and the correct percentage value for all the returned rows.  I'm using this: | inputlookup Patch-Status_Summary_AllBU_v3.csv | stats count(ip_address) as total, sum(comptag) as compliant_count by BU | eval patchcompliance=round((compliant_count/total)*100,1) | fields BU total compliant_count patchcompliance | rename BU as Domain, total as TAM, patchcompliance as "% Compliance" | appendpipe [stats sum(TAM) as TAM sum(compliant_count) as compliant_count | eval totpercent=round((comp/TAM)*100,1)] | eval TAM = tostring(TAM, "commas")   The output is: Domain TAM compliant_count % Compliance BU1 1,180 1146 97.1 BU2 2,489 2420 97.2 BU3 409,881 96653 23.6 BU4 3 3 100.0 BU5 1,404 1375 97.9 BU6 119,003 90100 75.7 BU7 33,506 30669 91.5 BU8 2,862 1997 69.8 BU9 239,897 216401 90.2 BU10 3,945 3832 97.1 BU11 569 482 84.7   814,739 445078     If I add to the appendpipe stats command avg("% Compliance") as "% Compliance" then it will not take add up the correct percentage which in this case is "54.6" but the average would display "87.1". How do I calculate the correct percentage as a total using the totals of columns TA ... View more