Ok first up you need to convert Day into a date that splunk'll understand. | inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y") Next up, you want to plot it. So we can add | timechart span=1d avg(AvgBest95) as AvgBest95 avg(AvgWorst5) as AvgWorst5 You can then drill into the timeranges. Even though we're using avg(AvgBest95) - because you have 1 pont a day (or i'm assuming you do) the average will be the same as the single value for the day anyway. This works on splunk 4.3.x I've you're running a previous version, you may have to resort to the xyseries method outlined here another tip - if your dates on the x-axis look messed up even after converting to a format splunk can process adding this, fixes it a lot of the time | makecontinuous _time ... View more

What you're doing just removes duplicates where machine_type and username are the same. So when you do machine_type+"-"+machine_type its concatenating 'machine_type' with itself (in the same event) You probably want to do something like sourcetype="usermachines" | stats values(machine_type) as machine_types by username | eval machine_types_by_user=mvjoin(machine_types,"-") | table username machine_types_by_user This groups all the different values of machine_type for the users. It then takes the multivalue field 'machine_types' and flattens it by joining the values with a '-' This might be all you need though : sourcetype="usermachines" | stats values(machine_type) as machine_types by username ... View more

I'm pretty sure that this technique will fall apart if you want to do anything more complicated, but .. | inputlookup example.csv | fields - uid | search msg="click" | stats count(AB*) | transpose | rex field=column ^count\((?<column>.*?)\) | rename column as field | rename "row 1" as count returns field count AB_test1 4 AB_test2 4 ... View more

So if you tag what's OK, then look for the latest OK-ness based on what makes the event unique ( I'm assuming ComputerName EventName and EventType ) then you can eliminate what's no longer an issue. ... | eval status=if((Action=="Blocked" AND Status=="Cleanable") OR (Action=="Cleaned up" AND Status=="Resolved"),"ok","issue") | stats latest(status) as current_status latest(EventTime) as LastEvent by ComputerName EventName EventType | where current_status=="issue" ... View more

Is Time listed as an extracted field in the field picker (in the sidebar) ? If not, you'll have to extract it yourself .. ... | rex .*Time=(?P<Time>\d+) | ... Then you can do ... | where Time > 3000 I'd be surprised if Time wasn't automatically extracted though. Update .. (aka formatting ate my backslashes) Sorry about that. In regex stuff in brackets (....) is a capture group. so given the string : "My name is 6" the regex : "My (\w+) is (\d+)" puts "name" in capture group 1, and "6" in capture group 2. \w+ is 1 or more word characters \d+ is 1 or more digits you can name the capture groups too the regex "My (?<attibute>\w+) is (?<value>\d+)" is the same as "My (\w+) is (\d+)" apart from you can refer to capture group 1 as "attribute" and capture group 2 as "value" (?P means you can use the named capture group elsewhere in the rest of the regular expression. in your case its not needed, its just habit. Here's an example : * | head 1 | eval string="Process=XXXX ID={XXXXXX-696B-4136-9162-5DE0FA5D5F64} Time=3214" | rex field=string .*Time=(?P<Time>\d+) | table Time ... View more

You invoke saved searches in the search bar like this : | savedsearch "Top five sourcetypes" (note the pipe at the front) From the look of your XML snippet, you want the user to be able to select from a list of saved searches. If you want the search to run now, and not use cached events (i.e. your saved search is not scheduled - the syntax of your question implies this) You could do something like this : <?xml version="1.0"?> <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html"> <label>Example</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="DashboardTitleBar" layoutPanel="viewHeader"/> <module name="StaticSelect" layoutPanel="mainSearchControls"> <param name="label">search </param> <param name="settingToCreate">search_selecter</param> <param name="searchWhenChanged">True</param> <param name="staticFieldsToDisplay"> <list> <param name="value">Errors in the last hour</param> <param name="label">Latest errors</param> </list> <list> <param name="value">Top five sourcetypes</param> <param name="label">Top Sourcetypes</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">search_selecter</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="selected_search"> <param name="fillOnEmpty">True</param> <param name="prefix">"</param> <param name="suffix">"</param> <param name="value">$target$</param> </param> </param> </param> <module name="HiddenSearch"> <param name="search">| savedsearch $selected_search$</param> <module name="SubmitButton" layoutPanel="mainSearchControls"> <module name="SimpleResultsTable" layoutPanel="panel_row1_col1"/> </module> </module> </module> </module> </view> Retrieving cached data from a scheduled search, chosen from a drop down list, is altogether more difficult. ... View more

When do pie charts collapse values into "other" (see sliceCollapsingThreshold) By default, values that make up less that 1% of the whole are collapsed into "other" If this is in a dashboard, you could edit the XML to change the value of this parameter to 0 to disable collapsing. Update. You could do something like ... | top limit=5 useother=t bytes This will (should) show the top 5 values, and lump everything else into 'other' ... View more

Splunk recognises the timestamp formatting, so you don't need DATETIME_CONFIG=NONE The only other difference is the regex - This works for me - not sure if the formatting of the log has changed by posting it here though [sitescope_alert] BREAK_ONLY_BEFORE = ^\d{2}:\d{2}:\d{2} \d{2}/\d{2}/\d{4}\s+alert$ NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = true Also - is [some html goes here] actually part of the log message? If its a really big log entry, it'll split after 256 lines anyway unless you set MAX_EVENTS to something bigger update: this is more efficient SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?=\d{2}:\d{2}:\d{2} \d{2}/\d{2}/\d{4}\s+alert[\r\n]+) ... View more