I had a very similar problem which turned out to be something incorrect in my path specification for Java. and though I forgot what the path had been (something VERY much like the correct path below, but not identical), but changing that path to fixed the issue. In your case try this path : /opt/jre1.8.0_40/bin/java . or see this link it can help you: https://docs.oracle.com/javase/tutorial/essential/environment/paths.html ... View more

try like : your_base_search ... date_mday>=15| timechart span=1months count example: index = _internal date_mday>=15| timechart span=1months count ... View more

use props.conf and transforms.conf files to do it. this link can help you to do http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?utm_source=answers&utm_medium=in-answer&utm_term=props.conf&utm_campaign=refdoc http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf?utm_source=answers&utm_medium=in-answer&utm_term=transforms.conf&utm_campaign=refdoc or use rename command ... View more

try like : ... | rename FirstSourceType as "Total Time Taken" , SecondSourceType as "Total time taken by zzz" |... you can try like this in your case : index=xxx earliest=-7d@d latest=@d ( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) ) OR ( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0) | eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype |replace FirstSourceType with "Total Time Taken" in sourcetype |replace SecondSourceType with "Total time taken by zzz" in sourcetype ... View more

try like : " ./splunk search ' .. | stats dc(f_name) | outputcsv file_name' -uri " The file_name.csv file should be located in $SPLUNK_HOME/var/run/splunk. Directory. ... View more

in your /opt/splunk/etc/system/default/props.conf the Defaults CHECK_METHOD = modtime by in manuel it is CHECK_METHOD = endpoint_md5. note: erase all data already indexed and resumes a new index on the same indexed or a new index. with the new configuration props.conf ... View more

by default, CHECK_METHOD= modtime. The workaround is to set priority higher than the default stanza using source stanza in props.conf (If you use host or sourcetype in the props.conf will not work), specify CHECK_METHOD so it will not use modtime. For example: [source::.../abc.out] sourcetype=log_in_abc.out CHECK_METHOD = endpoint_md5 priority = 10 ... View more

try with CHECK_METHOD = endpoint_md5 in your stanza of props.conf ... View more

try with TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%N instead TIME_FORMAT=%Y%m in your props.conf ... View more

this link can help you: http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/WhatisSplunkknowledge ... View more

try like this : (index=ind1 OR index=ind2) | table field1 field2 | eval field2=if(field1=field2, field1,"") ... View more

as you don not have a DS(deployment server). you Can use cluster-bundle to distribute the lookup-files/definitions. ... View more

or you can try like : ...| timechart eval(sum(Field1)- sum(Field2)) as difference12 ... View more

What is the query that you're using to generate the results? ... View more

thx Mr renjith.nair you are right ... View more

try: yoursearch| eval abc= if(match(field1,"Orange")), field2, field2) | eval field3 = if(match(field1,"Orange")), field2, abc) ... View more

ok use the _indextime field because The _indextime field contains the time that an event was indexed. ... View more

use Extractions fields to do it http://docs.splunk.com/Documentation/Splunk/6.3.1/Knowledge/ExtractfieldsinteractivelywithIFX ... View more

try like this: ...| stats count by status| eventstats sum(count) as total| eval percent = round((count/total)*100) . " %"|sort -percent | fields - total or ...| top status | eval percent=percent."%" ... View more

go to : $SPLUNK_HOME/share/splunk/search_mrsparkle/modules/paginator/paginator.css and modify the paginator.css script to do it ... View more