The answer is that the span argument has two completely different meanings in those two locations. I agree that timechart should give some messaging around this though. The docs also seem to be wrong here. Currently the docs list "span" as two different args, in the two different sections. But the description in both places describes only the more common usage. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Timechart Run these two searches and note the differences. index=_internal | head 1000 | timechart span=10 count by kb This is more normal, and timechart has interpreted our "10" to mean "10 seconds" index=_internal | head 1000 | timechart count by kb span=10 You almost never see this but it's been a part of timechart since the beginning. This tells timechart to bucket the "kb" values on the fly into buckets of size "10". The key is that the "span" keyword follows a numerical split-by field. Try it out. UPDATE: actually I was misreading the docs. They don't seem to refer to the second type of "span" argument at all. Also, the chart command does this too, and you can do it separately for both fields. try this one. index=_internal | head 1000 | chart count over kb span=10 by eps span=5 ... View more

Based on your comment, you need the output to show certain values for EventType even if there is no rawdata with that value. The answer is a little weird. Here's your search with the real results from teh raw data. source="WinEventLog:" | stats count by EventType now if we tack on an extra append command, and then an extra stats command, we can fabricate some rows that have zeros as the count, but in which all EventTypes are reflected. | append [| stats count | eval EventType=split("1,2,3,4,5",",") | mvexpand EventType] | stats sum(count) as count by EventType Now all 5 EventTypes will be in the results regardless of their presence in the raw data. ... View more

OK I understand. you don't want to use bucket btw. If for some reason there are hours with zero events, bucket will completely ignore those hours and so those zeros affect your average at all (and you need them to). Instead you want timechart. Timechart will make a full set of buckets for all the hours even if some hours had no events in them. And using date_hour and date_wday would be tricky. Fortunately we don't need them. We can easily make our own with the strftime function in eval, just using the time values in the timechart output. So run this search over the last 30 days or something. | timechart span=1h count | eval weekday=strftime(_time,"%A") | eval hour=strftime(_time,"%H") | stats avg(count) by hour weekday timechart will get the hourly counts for every hour in the timeperiod. Then eval will make two little fields on each row, "weekday" and "hour", with the appropriate values. Then finally stats just calculates the average count for each combination of hour and day. ... View more

Not very easily, no. It's a good request and I'll look into adding a param or making it otherwise configurable somehow. Here's the "not very easy" way. (I just wrote this up for you in case you're wondering where it came from). 1) put this into your Table module. <param name="customBehavior">noShowDetailsLink</param> 2) Put this block of JS into application.js, in the app in question. If you had to create an application.js to do so, don' t forget to restart splunk web after application.js file exists on disk. if (typeof(Sideview)!="undefined") { Sideview.utils.declareCustomBehavior("noShowDetailsLink", function(tableModule) { tableModule.displayNoResultsMessage = function() { this.resultsContainer.html(""); var message = $("<p>") .addClass("status") .addClass("emptyResults") .append(_('No results found. ')); this.resultsContainer.append(message); } }); } This basically clobbers the base implementation of displayNoResultsMessage, and replaces it with a simpler one that just displays "no results found". ... View more

You can just use .HTML h2 { color:#369; } which if you put it in application.css, would change all h2's across all HTML modules across your whole app. If you want to scope it to a particular view, you can either put it in a custom css file (not application.css), which you then reference from the customStylesheet param of the SideviewUtils module, or the stylesheet attribute of the view tag. Or you can keep it/them in applicaiton.css and scope them this way. .splView-your_view_name_here .HTML h2 { color:#369; } ... View more

Well if you're trying to get field values out of Search A index=a sourcetype=sta , and you want to use the field values in there to run another search B, and A might run into the millions of rows, then you can't use a subsearch. I do however think you have your subsearch syntax backwards. The "first" search Splunk runs is always the inner one, and if I'm reading your question right that would be the index=a sourcetype=sta search. Therefore I think your hypothetical subsearch would look like: index=b sourcetype=stb [ search index=a sourcetype=sta | rename employeeID as empID | table empID] table empID empAddress] But again, the inner search will get truncated at 50,000 rows as you say so you can't use subsearches, join, append, etc... However here's the good news: 1) Just get all the events and let stats sort them out. (index=b sourcetype=stb empAddress=* empID=* ) OR (index=a sourcetype=sta employeeID=*) | eval empID=if(isnotnull(employeeID),employeeId,empID) | stats values(empAddress) by empID 2) If the search above seems to slow (because it gets many events off disk), then just run it once, or maybe once a day/week, to put the employeeID to EmpAddress mapping in a file based lookup. Then you'll be able to run very efficient lookups to go from ID to address for your searches going forward. Basic idea is same as #1, except you tack something like | outputlookup employeeAddresses on the end. further reading about lookups - 1) http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Useexternalfieldlookups 2) http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Usefieldlookupstoaddinformationtoyourevents ... View more

Keep it simple and just filter the output of the metadata command with a search command. <populatingSearch fieldForValue="host" fieldForLabel="host"> <![CDATA[|metadata type=hosts index=os | search host="ABC*"]]> </populatingSearch> ... View more

The answer is really weird it looks like. Reading its python source, httpstatus command for some reason is only written to do the work if there happens to be a field called "_raw". So I would try this. |dbquery "database" "SELECT SERVER FROM DLVRYIMPL_VE_DEVICE WHERE ISONLINE = 1 AND ROWNUM = 1" | eval url="http://".SERVER. ":80/userdata/qc/qc/e8/e858eb10-4fea-43e8-89cc-87cb0d531d53/qumu_48b4c6fd644e41e395e8c51b962fdc01Med.mp4?origin=10.10.10.10:80;server2:80" | eval _raw="silly_httpstatus_workaround" | httpstatus | table url, httpstatus ... View more