Hey guys. So i have a search which created a bar chart     | rex field=_raw "(.Net Version is)\s+(?<DotNetVersion>.+)" | stats latest(DotNetVersion) as DotNetVersion by host | fillnull value="-" | eval status=case(match(DotNetVersion,"Not!"),"noncompliant",1=1,"Compliant") | chart count by status         I have tried most options in the xml but i cant get it to be green/red =/   Any ideas? Thought the ".fieldColors" would do the trick, but i think maybe my field is called "count" instead of Compliant/noncompliant

Hi, is it possible to roll specific buckets to frozen? I have some buckets which the customer wants to be deleted (don't ask why), and I would kindly ask if this is possible without stopping Splunk. br Tom

I pack an splunk app by tar command in an linux host, running as a root user. As a result the owner and group owner are both 'root'. After I installed to Splunk Enterprise, I found that the depressed directory and its files are all owned by 'root['. However, other installed app directories and files are belong to 'splunk'.  So, should I su to splunk first and then pack the app file?

Honored Splunkodes, I am trying to keep track of the manpower in each of my legions, so that if any legion loses too many troops at once, I know which one to reinforce. However, I have many legions, and thus I track all of their manpower without knowing which ones will be important each day. I can't leave my myrmidons without reinforcements! I'd like to generate statistical information about them at the time of graph generation. Currently I'm doing this, it's dirty but it works. I get my legion manpower by querying that index, dropping any that don't fall in the top 50. index=legions LegionName=* | timechart span=1d limit=50 count by LegionName | fields - OTHER | untable _time LegionName ManPower | outputlookup append=f mediterranean_legions.csv Then I load up my lookup: | inputlookup mediterranean_legions.csv | convert timeformat="%Y-%m-%dT%H:%M:%S" mktime(_time) as _time | bucket _time span=1d | timechart avg(ManPower) by LegionName | fields - OTHER | untable _time LegionName ManPower | streamstats global=f window=10 avg(ManPower) AS avg_value by LegionName | eval lowerBound=(-avg_value*1.25) | eval upperBound=(avg_value*1.25) | eval isOutlier=if('ManPower' < lowerBound OR 'ManPower' > upperBound, "XXX".ManPower, ManPower) | search isOutlier="XXX*" | table _time, LegionName, ManPower, * This gives me a quick idea which legions have lost (or gained) a lot of manpower each day. Now ideally, I'd like to generate standard deviation and determine if they are outliers based on z score rather than just guessing with the lower and upper bound values. If this worked, I'd get what I want. Is there a way to accomplish this? | streamstats global=f window=10 avg(ManPower) AS mp_avg by LegionName, stdev(ManPower) as mp_stdev by LegionName, max(ManPower) as mp_max by LegionName, min(ManPower) as mp_min by LegionName

Hello, I'm experiencing the following issue on one of my search heads (total of 3): Knowledge bundle size=2608MB exceeds max limit=2000MB. Distributed searches are running against an outdated knowledge bundle. Please remove/disable files from knowledge bundle or increase maxBundleSize in distsearch.conf.   Why is the SH behaving like this when the others have the same config?  

I would like to create a dashboard that has field inputs so that I can share with end users who are not familiar with spunk. I just want them to present two fields that they can just provide the input like an IP address and click GO and will get the results back of my particular search query.   If that's possible, what do I have to look into? Helpful if I can get a link as well. Thank you in advance.

Hello community, on my desk, I have a pretty edgy request that is giving me quite a headache. I would need to collect (with | collect) the output of a search in a new sourcetype created dynamically within the search itself. Here you can find a simple ad hoc example: | makeresults | eval letter1="A", letter2="B", letter3="C" | eval variabile="NewSourcetype" | eval _raw=_time + ": " + _raw | collect index=garbage sourcetype=variabile Problem is that the event is stored under  sourcetype=variabile instead of sourcetype=NewSourcetype. Any idea how to manage such a situation? Thanks in advance for your kind support.