...ecause after the transpose the referenced row ceases to exist. I had hoped that substituting $column.id$ would be a quick solution, but that doesn't seem to work.
Is there a way I can continue to reference...
I have a handful of searches that I want to build into reports and dashboards so I can collaborate with my team. Can you give me a sketch of how Splunk reports and dashboards work?
So, I have just been introduced to this tool through my work. I had a question about how to link some search criteria. What I would like my search to do is search first by an IP address that I input,...
Hi, Towards Splunk tool installation completion step, when I accept the license and start Splunk service I was asked to create a login which was successful and completed the installation process. Wh...
Hi All. I want to check if there is any means by which I can set up alerts if the current week's data is more than the avg of last 4 week's data. I have around 25 customers hitt...
It's been a while since we implemented Splunk Enterprise, and user engagement has stalled a bit. We also have a lot of people who are new to Splunk. Do you have any recommendations for how we can eng...
Hello,
Here is my dashboard before using the transpose command
index=oit_printer_monitoring AND type=Printer
| eval timeConvDate=strftime(_time,"%a %m-%d-%Y")
| eval timeConvTime=s...
I have a large query that keeps failing/timing out because search head has no enough ram. I want to run the data in half instead (twice). running one query to filter only half the alphabets of values...
Hi there,
I am looking for a way to truncate the characters of my results.
I am doing a simple search like sourcetype=ps OR sourcetype=top COMMAND | multikv | stats count by COMMAND
In t...