Hi, I am starting with splunk admin and is confused about one topic. It might be silly. While creating an index, we get the option to set the Searchable Retention (in days), I have read from the documents that splunk has 4 bucket, hot, warm, cold, and frozen. My question is suppose I have set it as 90 days, while this 90 days period will the data be in hot bucket for the entire 90 days and will roll to frozen after 90 days period is over. Also how different is setting 90 days under the Searchable Retention and setting this below- [main] frozenTimePeriodInSecs = 7,776,000  Please explain. Thanks in advance. ... View more

Hi, I have an output like this - Location EventName ErrorCode Summary server1 Mssql.LogBackupFailed BackupAgentError Failed backup.... server2 Mssql.LogBackupFailed BackupAgentError Failed backup....   Now I am trying to combine all the values of Location, EventName, ErrorCode and Summary into one field called "newfield" , lets say using a comma "," or ";" I am trying this command -     | eval newfield= mvappend(LocationName,EventName,ErrorCode,summary)     but the output it is giving is -   server1 Mssql.LogBackupFailed BackupAgentError Failed backup....   Output I am expecting is - server1,Mssql.LogBackupFailed,BackupAgentError,Failed backup ... View more

Hi Team, Hope this finds all well. I am trying to create a alert search query and need to create the splunk url as a dynamic value. Here is my search query- index=idx-cloud-azure "c899b9d3-bf20-4fd6-8b31-60aa05a14caa" metricName="CpuPercentage" | eval CPU_Percent=round((average/maximum)*100,2) | where CPU_Percent > 85 | stats earliest(_time) AS early_time latest(_time) AS late_time latest(CPU_Percent) AS CPU_Percent by amdl_ResourceName | eval InstanceName="GSASMonitoring.High.CPU.Percentage" | lookup Stores_IncidentAssignmentGroup_Reference InstanceName | eval Minutes=(threshold/60) | where Enabled=1 | eval short_description="GSAS App Service Plan High CPU", comments="GSAS Monitoring: High CPU Percentage ".CPU_Percent. " has been recorded" ```splunk url=""``` | eval key=InstanceName."-".amdl_ResourceName | lookup Stores_SNOWIntegration_IncidentTracker _key as key OUTPUT _time as last_incident_time | eval last_incident_time=coalesce(last_incident_time,0) | where (late_time > last_incident_time + threshold) | join type=left key [| inputlookup Stores_OpenIncidents | rex field=correlation_id "(?<key>(.*))(?=\_\w+\-?\w+\_?)"] | where ISNULL(dv_state) | eval correlation_id=coalesce(correlation_id,key."_".late_time) | rename key as _key | table short_description comments InstanceName category subcategory contact_type assignment_group impact urgency correlation_id account _key location and here is the url of the entire search I am trying to convert into dynamic for line no 11- https://tjxprod.splunkcloud.com/en-US/app/stores/search?dispatch.sample_ratio=1&display.page.search.mode=verbose&q=search%20index%3Didx-cloud-azure%20%22c899b9d3-bf20-4fd6-8b31-60aa05a14caa%22%20metricName%3D%22CpuPercentage%22%0A%7C%20eval%20CPU_Percent%3Dround((average%2Fmaximum)*100%2C2)%0A%7C%20where%20CPU_Percent%20%3E%2085%0A%7C%20stats%20earliest(_time)%20AS%20early_time%20latest(_time)%20AS%20late_time%20latest(CPU_Percent)%20AS%20CPU_Percent%20by%20amdl_ResourceName%0A%7C%20eval%20InstanceName%3D%22GSASMonitoring.High.CPU.Percentage%22%0A%7C%20lookup%20Stores_IncidentAssignmentGroup_Reference%20InstanceName%0A%7C%20eval%20Minutes%3D(threshold%2F60)%0A%7C%20where%20Enabled%3D1%0A%7C%20eval%20short_description%3D%22GSAS%20App%20Service%20Plan%20High%20CPU%22%2C%0A%20%20%20%20%20%20%20comments%3D%22GSAS%20Monitoring%3A%20High%20CPU%20Percentage%20%22.CPU_Percent.%20%22%20has%20been%20recorded%22%0A%7C%20eval%20key%3DInstanceName.%22-%22.amdl_ResourceName%0A%7C%20lookup%20Stores_SNOWIntegration_IncidentTracker%20_key%20as%20key%20OUTPUT%20_time%20as%20last_incident_time%0A%7C%20eval%20last_incident_time%3Dcoalesce(last_incident_time%2C0)%0A%7C%20where%20(late_time%20%3E%20last_incident_time%20%2B%20threshold)%0A%7C%20join%20type%3Dleft%20key%20%0A%20%20%20%20%5B%7C%20inputlookup%20Stores_OpenIncidents%20%0A%20%20%20%20%7C%20rex%20field%3Dcorrelation_id%20%22(%3F%3Ckey%3E(.*))(%3F%3D%5C_%5Cw%2B%5C-%3F%5Cw%2B%5C_%3F)%22%5D%20%0A%7C%20where%20ISNULL(dv_state)%0A%7C%20eval%20correlation_id%3Dcoalesce(correlation_id%2Ckey.%22_%22.late_time)%20%0A%7C%20rename%20key%20as%20_key%0A%7C%20table%20short_description%20comments%20InstanceName%20category%20subcategory%20contact_type%20assignment_group%20impact%20urgency%20correlation_id%20account%20_key%20location&earliest=-60m%40m&latest=now&display.page.search.tab=statistics&display.general.type=statistics&sid=1704721919.326369_52C57BD9-5296-4397-B370-BF36A375A0A5 ... View more

Hi All, Here is my how my event looks like -   20/11/2023 12:47:05 (01) >> AdyenProxy::AdyenPaymentResponse::ProcessPaymentFailure::Additional response -> Message : NotAllowed ; Refusal Reason : message=MessageHeader.POIID: NotAllowed Value: P400Plus-805598742, Reason: my POIID is P400Plus-805598450   I am trying to extract the part "POIID: NotAllowed Value: P400Plus-805598742, Reason: my POIID is P400Plus-805598450" I am using this regex - | rex field=_raw "MessageHeader.+(?<POIID_Error>)-*" But the field vale POIID_Error seems to be blank after running the query. Attaching the ss for reference. Little suggestion to fix this is appreciated. ... View more

Hi Everyone, Hope everyone is alright.  I have the below base search. I am trying to built an alert index=idx-cloud-azure "*09406b3b-b643-4e86-876e-4cd5f5a8be57*" metricName=MemoryPercentage OR metricName=CpuPercentage This is the below condition which I have to follow-  CPUPercentage > 85 MemoryPercentage > 85, where CPUPercentage and MemoryPercentage are values of a field called metricName. I am doing like this - index=idx-cloud-azure "*09406b3b-b643-4e86-876e-4cd5f5a8be57*" | eval metricCount=if((metricName="MemoryPercentage" OR metricName="CpuPercentage"),1,0) | stats count by metricCount | where MemoryPercentage > 85 OR CpuPercentage > 85 not sure if this is correct way to do. Could anyone pls suggest a better way. Thanks in advance 🙂 ... View more

Hi All, Hope this find you well, I have built a pretty simple search query for my dashboard, plotting line chart graph (for monitoring payments done by different debit/credit card types e.g., Giro, Mastercard etc. for every 5 minutes) using transaction command and then searching for the card type in the log and then extracting the value using regex in the field named "Card Type".       index=idx-stores-pos sourcetype=GSTR:Adyen:log | transaction host startswith="Transaction started" maxpause=90s | search "*Additional Data : key - cardType*" | eval Store= substr(host,1,7) | eval Register= substr(host,8,2) | rex field=_raw "AdyenPaymentResponse.+\scardType;\svalue\s-\s(?<CardType>.+)" | eval girocard=if((CardType=="girocard"),1,0) | timechart span=5m sum(girocard) AS "Girocard"     Now I have to modify the query in order to filter it out based on Country and Store, query I am using is-     index=idx-stores-pos sourcetype=GSTR:Adyen:log | transaction host startswith="Transaction started" maxpause=90s | search "*Additional Data : key - cardType*" | eval Store= substr(host,1,7) | eval Register= substr(host,8,2) | rex field=_raw "AdyenPaymentResponse.+\scardType;\svalue\s-\s(?<CardType>.+)" | eval girocard=if((CardType=="girocard"),1,0) | append [| inputlookup Stores_TimeZones.csv where Store=tkg* ] | timechart span=5m sum(girocard) AS "Girocard" latest(Country) AS Country latest(City) AS City     I am unable to get the output for Country and City, what am I doing wrong? Please help. Thanks in advance 🙂 ... View more