If source 2 is reasonably static, you could use outputcsv to create a lookup file. Then do your search on source1 and enrich the data with the description using lookup You will need to define the lookup in transforms.conf - details here ... View more

I'm guessing this is a 1 off and you don't have the raw data inputs anymore ? If thats true, If index2 does not exist already, by far the easiest solution would be to make a copy of index1 called index2, delete everything but kind3 and kind4 from index2, then delete kind3 and kind4 from index1. If index2 exists already and you're wearing your rubber safety pants, you could try this : make a copy of index1 called index3 delete everything but kind3 and kind4 from index3 merge index3's buckets into index2 delete index3 deleting kind3 and kind4 from index1 It goes without saying, backup your indexes 1st, and please report back if it works : ) You are going to waste a lot of space though, deleting data from an index doesn't free up space, it just marks it as deleted. ... View more

See here for an answer ... View more

Try replacing -threat with _threat. I've read (but not tested) that using - in your extract name causes problems because '-' is a delimiter. In that case both your extracts woould be called Security_Firewall ... View more

finally a use for untable. ! (not really - it you don't do timechart 1st, you wont be in this predicament ) ... | untable _time fruit count | streamstats current=false window=1 global=false first(count) as p_count by fruit | eval delta=p_count-count | xyseries _time fruit delta realistically, you would do the streamstats, manually calculate the delta, then do timechart on the delta field ... View more

Could you not throw up a php server with a stub page that loads a symbolic link to the application.css ? You'd be able to tweak the css in the window that loaded the stub, then refresh the splunk page to see if it worked. ... View more

What version of splunk ? Try using the regex method instead ... View more

You need to flatten the results into unique lines 1st. There's 2 ways to do this, whats probably considered the right way ... | eval x=mvzip(dataset,datacount) | mvexpand x | makemv delim="," x | eval dataset=mvindex(x,0) | eval datacount=mvindex(x,1) | fields - x | ... or the regex way ... | eval x=dataset.",".datacount | mvexpand x | rex field=x (?<dataset>.*?),(?<datacount>.*) | fields - x | ... I'm a regex kinda person myself. ... View more

outstanding. Completely unaware of the fieldColors option. I've updated my answer, but this is the real source of information. ... View more

Is this on a dashboard with other charts ? There is a master legend for a page, and it tries to make every unique legend item a different colour (This also affects the bar colors) Add this, so that this chart does not use the master legend, you should have consistent colours. <param name="charting.legend.masterLegend"></param> If you want to set it to green you'll also need : <param name="charting.seriesColors">[0x006600]</param> Update - All credit to jkat54 Full example, I had to use FlashChart in 4.X since color options are unsupported for JSChart - might be different in 5.x <?xml version="1.0"?> <view objectMode="SimpleDashboard" template="dashboard.html"> <label>Stats Dashboard</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True"> <param name="search">* | timechart span=1d count</param> <param name="earliest">-7d@d</param> <param name="latest">@d</param> <module name="HiddenChartFormatter"> <param name="chart">bar</param> <param name="chart.stackMode">none</param> <param name="charting.legend.masterLegend"></param> <param name="charting.fieldColors">{"count":0x009900}</param> <param name="charting.axisY.minimumNumber">0</param> <param name="charting.axisTitleY.text">Progress (%)</param> <param name="charting.axisTitleX.text">Stage Name</param> <module name="FlashChart"/> </module> </module> </view> ... View more

You probably need a custom condition in your alert i.e. main search ... | stats count(eval(Variability==0)) as not_variable then a custom condition where search not_variable > 0 ... View more

Is enableResize set to False ? <module name="JSChart"> <param name="enableResize">False</param> </module> ... View more

Elaine, thats a very good idea to make the SingleValue more interactive. Example usage : <view objectMode="SimpleDashboard" refresh="-1" template="dashboard.html"> <label>wibble</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="DashboardTitleBar" layoutPanel="viewHeader"/> <module name="HiddenSearch" layoutPanel="panel_row1_col1_grp1" group="S V" autoRun="True"> <param name="search">* | head 10 | stats count | eval message="redirect woo"</param> <module name="SingleValue"/> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> <param name="label">View results</param> </module> </module> </view> ... View more

This goes against my understanding of things ... but The Gimp module clobbers intentions, and in the 1st dashboard, you have a gimp upstream of the 2nd HiddenSearch. I wouldn't have thought that Gimp would clobber the HiddenPostProcess, but it might do So .. try putting <module name="Gimp"/> before the 2nd HiddenSearch module If that doesn't work, add a another HiddenPostProcess within the 2nd HiddenSearch with <param name="search"> </param> This'll definately clobber your 1st PostProcess ... View more

For added lulz - round single values .SingleValue { background-size: cover; border-radius: 50% 50% 50% 50%; height: 100px; width: 100px; } .singleResult { position: relative; top: 40%; } .singleLabel { position: relative; top: 40%; } triangles on the other hand ... ... View more

| metadata type=hosts totalCount >0 | where lastTime < relative_time(now(),"-2h") now() is only available in eval and where clauses. You could not use relative_time() and just instead use now()-(60*60*2) ... View more

@Inguinn - maybe the 'view results' link ? ... View more

This : | gentimes start=11/01/12 end=11/30/12 | search starthuman!="Sun*" starthuman!="Sat*" | stats count This doesn't include 30th Nov, so if you want to include the end date in your calculation, add 1. Also assumes non-business days start with 'Sat' or 'Sun' ... View more

Thats because the example uses a search with lots and lots of data. ... View more

What about : earliest=-14d@d <other search stuff here> date_hour>0 date_hour<7 | bin _time span=1d | stats count as "Todays Count" by host _time | streamstats window=7 avg("Todays Count") as "7 day Average" by host | tail 7 add current=false to streamstats if you dont want todays values affecting todays 7day average This gives the the 7 day average derived from the previous 7 days, per day. If this is just an operations check and you dont really need a 'rolling' average, just the average over the previous 7 days for the current day : earliest=-7d@d date_hour>0 date_hour<7 | bin _time span=1d | stats count by host _time | eventstats avg(count) as average by host | eval average=round(average) | where _time >= relative_time(now(),"@d") | eval Day=strftime(_time,"%Y-%m-%d") | table Day host count average ... View more

Nice. My brain wouldn't accept that capture groups would work with alternatives. ... View more