I would like to show the message_types from each event on a timeline. I think timechart would be the right element, but is there a way to specify that it shoud not span ? index=t | head 10 | timechart list(H_message_type) [[NOSPAN ?]] ... View more

I've a search module as child of a table for drilldown. The table that should display the result ist empty... Is there a way to display the search string from the nested search somehow ? I was not able the module that is used by Splunk-Search for "View results" in Sideview ? Here is the debug output of the table element after the search is run, and before I click a row: Debug Module : Table_0_5_0 Search values added/modified for downstream modules (none) Normal keys added/modified for downstream modules (none) Search values inherited from upstream search | dbquery "test" "SELECT SOMETHING" timerange over all time search id 1365677693.860 Normal keys inherited from upstream bpuic.element [object Object] bpuic.rawValue 8503130 bpuic.value 8503130 bpuic 8503130 Debug output from the search under the table: Debug Module : Search_1_6_0 Search values added/modified for downstream modules search index=t_cus | head 1 Normal keys added/modified for downstream modules (none) Search values inherited from upstream search | dbquery "kivdv_test" "SELECT TO_CHAR(l.ROW_ERF_TSTAMP,'YYYY-MM-DD HH24:mm:SS-FF'),BETRIEBSTAG,k.fahrt_bezeichner,k.vmnummer,k.start_bpuic,k.end_bpuic,l.* FROM KIVDV_PRODPLAN.VM_VDV k JOIN KIVDV_PRODPLAN.VM_FAHRT_PUNKT_VDV l ON k.ID=l.VM_VDV_ID WHERE BPUIC=8503130" timerange over all time Normal keys inherited from upstream bpuic.element [object Object] bpuic.rawValue 8503130 bpuic.value 8503130 bpuic 8503130 Code from the entire view: VDV Datenbank Abfrage <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="appHeader" /> <module name="SideviewUtils" layoutPanel="appHeader" /> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="maxSize">2</param> <param name="clearOnJobDispatch">False</param> </module> <module name="HTML" layoutPanel="viewHeader"> <param name="html"><![CDATA[ <h1>VDV Datenbank Suche</h1> ]]></param> <module name="TextField" layoutPanel="mainSearchControls"> <param name="default">8503130</param> <param name="label">BPUIC</param> <param name="name">bpuic</param> <module name="TimeRangePicker"> <param name="searchWhenChanged">False</param> <module name="Button"> <param name="label">Search</param> <module name="Search"> <param name="search"><![CDATA[ | dbquery "kivdv_test" "SELECT TO_CHAR(l.ROW_ERF_TSTAMP,'YYYY-MM-DD HH24:mm:SS-FF'),BETRIEBSTAG,k.fahrt_bezeichner,k.vmnummer,k.start_bpuic,k.end_bpuic,l.* FROM KIVDV_PRODPLAN.VM_VDV k JOIN KIVDV_PRODPLAN.VM_FAHRT_PUNKT_VDV l ON k.ID=l.VM_VDV_ID WHERE BPUIC=$bpuic$" ]]></param> <module name="Table"> <module name="Search"> <param name="earliest">0</param> <param name="search"><![CDATA[ index=t_cus | head 1 ]]></param> <module name="Table" layoutPanel="panel_row1_col1" /> <module name="SimpleResultsTable" layoutPanel="panel_row1_col2" /> <module name="PostProcess"> <param name="search"> search AB_ERW=1365494922.000 </param> <module name="Table" layoutPanel="panel_row1_col1" /> </module> <module name="JobStatus" /> <module name="HTML"> <param name="html"> &lt;h3&gt;DEBUGGING&lt;/h3&gt; &lt;b&gt;search:&lt;/b&gt; $search$&lt;br&gt; &lt;b&gt;postProcess:&lt;/b&gt; $postProcess$&lt;br&gt; &lt;b&gt;username:&lt;/b&gt; $row.fields.username$&lt;br&gt; </param> </module> </module> <module name="HTML"> <param name="html"><![CDATA[ <h3>DEBUGGING</h3> <b>search:</b> $search$<br> <b>postProcess:</b> $postProcess$<br> <b>username:</b> $row.fields.username$<br> $row.fields.VMNUMMER$<br> $row.fields.VIA$ ]]></param> </module> </module> </module> </module> </module> </module> </module> </view> ... View more

I've a DBconnect on a MSSQL My Timestamp in the DB looks like this : 2013-04-04 15:24:36.7170000 I've defined the folowing output.timestamp.format = "yyyy-MM-dd HH:mm:ss.SSS" output.timestamp.parse.format = "yyyy-MM-dd HH:mm:ss.SSS" The output from Splunk is 1970-01-01 00:59:59.999 ! I've tried to truncate the input to 2013-04-04 15:24:36.717 first, but same result ... View more

I would like to have a table base on the main search, and that clicking on the row, would update the postprocess search string. Goal is to display a postprocess table based on the fields from the selected source-table... ... View more

Is it possible to have on the same row, to have multiple possibility of drilldown, based on the same cells ? Is there a way to have a context menu ? Or how could I achieve that ? ... View more

I have logs in that form : field field field field field <verylong xml multivalued> field field field field field <verylong xml multivalued> If I want a result within seconds over all my events (but only a few fields), what is the best way to achieve that ? Have an logadapter, writer some how in the splunk api, the records I need, or writing only the few fields in a separate log file ? Or is there a way, to have an index with multiple columns field1,Field3,Field5 that are made by the indexer at index time ? so I could search within a second in that index, and make a drilldown to the whole event (that would last 30 seconds or more...) ?? ... View more

I try to make a search with a timechart , run it every 15 minutes, and indexing the result. Query works, and returns data, but if I try to search index=summary search_name="scheduled_search_name" I get no data ? ... View more

I have a couple of fields that I want to being able to search very quickly, because they are in XML files, and at search-time it takes too long. So I thought, the best way is to extract this fields at index-time... Now My questions : - can I make a real-time search on that index fields ? (I've seen the normal way for splunk is to do realtime search directly before the indexer has done his job, but if I'm indexing the fields anyway, it make sense to search on that). is it possible to automatically index the results of a real-time search as summary, so I can see on the one hand the actual situation on a real-time dashboard, and on the other hand, I'm able to request the same information from yesterday for example (without having to compute the result anymore) ? Is it possible to define how long each indexed summary is kept ? The same for index database table ? Can I keep a summary longer as the indexed Datasource ? Could you also say me what solution for that I have in 4.3.3 and 5 ? ... View more