good spot. ... View more

Try : stats sparkline(avg(ProcV)) as ProcV sparkline(avg(DiskV)) as DiskV sparkline)avg(ProcQueue)) as ProcQueue avg(DiskQueue) as DiskQueue avg(ByteT) as ByteT avg(Curcon) as Curcon avg(RWT) as RWT by host ... View more

for anyone interested in using a search similar to mine for getting avg response time. ...| eval seconds=spent*1.0e-6 | eventstats avg(seconds) AS Avg_Response_time_in_sec | eval Avg_Response_time_in_sec=round(Avg_Response_time_in_sec, 0) | chart count AS #Requests by Avg_Response_time_in_sec So it take processing time in microseconds and converts to seconds, does an average of the total count of seconds and puts into the Avg_Response_time_in_sec field, then charts it out... ... View more

turns out that query is an external command was was too slow for my use - i encountered timeouts (which i could bump up). changing the variable name from query to search worked though (the implicit format handles it slightly differently) - no double quotes and WAY faster than return. ... View more

use css then. I'm not going to write the css for you. Just google css table columns, experiment with firebug and drop it in application.css ... View more

If you want to hide an entire column worth of data, you should look at using the Sideview Table module, because it has a "hiddenFields" param. Setting fields in that param makes those fields hidden from the screen, but the dashboard still has access to all the hidden values for drilldown searches and drilldown logic. ... View more

Sigh... Some admin please delete this question. The initial search was correct. Turns out some collection process had stopped and that range of hosts were not being updated, that's why I was seeing any results, there weren't any to show.. ... View more

There is a valid case. I want to use it for my local splunk free installation and prototyping. This way do not have to type admin/admin every time. ... View more

would you mind explaining the stanza conflict ? ... View more

I removed the trial extended license we got from splunk and went back to the free license and the problem is solved. It's something to do with the license we got. I'll have to contact them. Thanks everyone for our input. ... View more

Splunk.Module.HardWorkingBrother extendeth Splunk.Module.AbstractWorker ... View more

Didn't even think of that thanks. So the logic on my example is the same. The problem is the fields return values like 1234 which mean Data Center A. So I was using the case statement to make "friendly" names, if I simply string them together with "DC".datacenter."_".appgrp the problem is it would like DC3456_apA, which unfortunately doesn't mean much to our operations partners. Lookups work perfect though, I created a quick test and it is does exactly what i need. Thanks for the help, Ethan ... View more

No problem - just a point of interest, buttons dont look like that in splunk 5 any more, thats a splunk 4 screenshot. ... View more

OK thanks for the info. I think you may have indirectly answered my question. Your observation that the subsearch notation does not work seems to be the key. If I instead use your suggested notation, it works as expected. I also noticed that the parser is very particular about the exact format – ‘search=”…”’ works while ‘search = “…”’ (notice the spaces around ‘=’) does not work. This is probably what steered me towards the subsearch notation earlier. I wonder if subsearches make sense here since technically they are run first, which would not useful in this scenario ... View more

Cheers Jeff, good to know, even if I now have to go and doublecheck a whole bunch of reports for accuracy ... ... View more

index="index" host="machine" | rex field=_raw "[^:]+:[^:]+:[^:]+: (? \w+):" | transaction qid keepevicted=true | stats max(delay) by field | sort desc delay | join field [search index="index" host="machine" [search index="index" host="machine" delay>60 | dedup queue_id | fields queue_id] field=* | top field | fields field count] here's what I got. Hope this helps someone ... View more

It looks like report acceleration is a solution geared at making queries that you run often faster ( vs. being able to truly run an adhoc query ). While that helps some use cases, it does not help my use case. ... View more

Yep - underscore is punctuation ... View more

well the output of the script is in the log file in question, but it comes into the log file as the tasks are completed. It gives an idea of where the script is based on the output in the log OR if a part of the script breaks, it gives us an idea where. The log file that I'm indexing is a "summary" of all the runs of the script until it gets big enough to be rotated. The script is dumping a summary to this log every 2 minutes and runs constantly. ... View more

RFE: Please add a way to format arbitrary fields as a relative time text like reltime does for _time . Looking at the source for reltime.py , it looks like it should be straightforward to add, although from a user's perspective it might be more obvious to look for this sort of thing in eval . ... View more

thank you for the quick reply - it works ... View more

The following are the timings shown - looks like command.search also is taking time. There are 26,128 matching events. 1.249 command.search 0.525 command.search.typer 0.436 command.search.rawdata 0.355 command.sort 1.518 dispatch.fetch 13 - - 2.799 dispatch.preview 1.514 dispatch.stream.local 1.779 dispatch.timeline 1.173 dispatch.tmpevents 0.546 startup.handoff ... View more

Filename can come through sources file And then overwrite _time to timestamp extracted from source ... View more

yeah its really.. 🙂 ... View more