How is the case statement? EVAL-src_name=case(isnotnull(src), src, isnotnull(src_ip), src_ip,1==1,s_name) ... View more

Thanks HiroshiSatoh! skoelpin's query actually brought me closer to the solution. I posted my final query above. ... View more

The searches you posted as broken are working for me. Have you considered upgrading, just in case 6.6.3 might have a bug around this feature? It was new for 6.6. ... View more

Then again: your current stats about number of concurrent searches may be totally irrelevant if your new deployment has faster CPUs or faster storage, or thanks to performance improvements in splunk itself, causing searches to complete much faster (and as a result your concurrent searches going down considerably). ... View more

The term "join" is not helpful here. what are you comparing the memory of? is it the same host? Use host. The events you are combining appear to be in the same index and type. Are there more than one record? Do you want to take only the latest number of each type? if so, do you want the latest number of all, or the latest for each host? I'm going to assume that there are two different kinds of event data, and that you want the most recent of each. index=main type=test | fields index type .... list all the fields you need from either type... | eval rectype=case(if it is the first kind of record, "1", if it is the second kind of record, "2") | dedup rectype | stats values(*) as * Now all the fields from both events are together on a single record. ... View more

I think the same is true when using multiple fields, but what's wrong? (your search) FieldA$con_a$$FieldA$ FieldB$con_b$$FieldB$ FieldC$con_c$$FieldC$ ... View more

The screen image and the search sentence do not match. Please upload the correct search sentence again. Also please tell me the extraction period. ... View more

When the User setting for default App is set at the User level in 'Access Controls' - if the Launcher is not the default app then clicking the Splunk Enterprise Logo will always take the user back to the Default App. ... View more

@jiaqya, two major config parameters control the size of an index - frozenTimePeriodInSecs with a default of 6 years!! and maxTotalDataSizeMB with a default of 1/2 TB. You can reduce either one of them. ... View more

I used: index=monthly_budget | chart sum(TOTAL_BUDGET) over sports_category by department limit=0 | transpose 0 header_field=sports_category | addtotals fieldname=TOTAL | rename column as "Department" | appendcols [ search index=monthly_budget | stats values(Coach) as "Coach" by department | fields - department] | fillnull value="-" I know this isn't the best way to do this but it works for me. hehe It'll be really cool if there's another good way to do this. Thank you! ... View more

I am required to restart Splunk service on deployment clients at mid night everyday /// instead going for complex options, i would simply choose the linux's cronjobs - the simple and best solution for these kind of tasks. just write a short script(someone already given above on comments i think).. configure it to run at midnight, whatever min, hour as per your convenience. on the script you can include ideas like.. whether splunk restart was successfull or not, get that details and send a mail to you/your team.. All set! ... Happy splunking! ... View more

Is there a hint on this blog? https://helgeklein.com/blog/tag/acceleration/ ... View more

@pavanae Is your problem resolved? If so, please accept one of the answers. ... View more

Worked like a charm 🙂 Thank you!! ... View more

There's one small problem I'm facing. I'm not able to use the single value visualization for this. I need to put it as a dashboard panel. ... View more

Thanks. Definitely documented poorly, nothing in a Google search, and for something so basic too ... View more

Do not use map when it is not needed. Is the position of the $field1$ value always the word directly before the phrase "Successfully pushed to system"? To verify, try this... make sure the capitalization and wordign in the rex is exactly the same as the record... (index=foo2 "Successfully pushed to system") | head 10 | rex "\b(?\w+)\s+Successfully pushed to system" If the above properly extracts the field1 value, then run this... (index=foo1 "Sending message to queue") OR (index=foo2 "Successfully pushed to system") | dedup field1 keepempty=true | rex "\b(?\w+)\s+Successfully pushed to system" | eval unit=case(index=foo2,1) | stats sum(unit) as count by field1 ... otherwise modify the rex until it is properly extracting the field1 value from the message, then proceed with the stats command The lesson here is, if a human can tell what the field1 value should be by looking at the layout of the event, then there is a way to build the field1 field, so you do that then use stats. ... View more

Don't forget about some commands that might help take this in a different approach: Multisearch - to collect data from multiple streams Eval's coalesce - a more elegant 'case' structure for null checking While not perfect, it could allow you to solve this with a more streaming style approach. ... View more

Please check the search sentence generated from "Search job inspector". If start and end are correctly embedded, you should be able to search. ... View more

Perfect!! Thanks for your help ... View more

Set blacklist in inputs.conf. See blacklist setting in the default inputs.conf. [blacklist:$SPLUNK_HOME\etc\auth] Please add the setting in the same way. ... View more

Why it's not by default? Very strange. Trying to implement your advice anyway. Thanks a lot! I'll come back with the results! ... View more

Sure, I have this below query | rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "Used"=round(used_bytes/1024/1024/1024, 3) | eval "Quota"=round(quota/1024/1024/1024, 3) | eval "%used"=((used_bytes/quota)*100)| fields Pool "Used" "Quota" "%used" I want to change "Quota" to a fixed value instead of unlimited which currently set. ... View more

Wizardry! | fieldformat Elapsed = tostring(floor(Elapsed), "duration") Thanks a lot ... View more