here you go: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendcols ... View more

I now understand. I thing the problem should be the appen command. Change appen and try use apppencols or join. Something like this, with appendcols: index=index host=host object="Network Interface" counter="Bytes Total/sec" | bucket _time span=1m | stats avg(Value) as bytesByHost by _time,host | stats sum(bytesByHost) as totalBytes by _time | appendcols [search index=index host=host object="Network Interface" counter="Current Bandwidth" instance!="isatap.*" | bucket _time span=1m | stats avg(Value) as connsByHost by _time | stats sum(connsByHost) as CurrentBandwidth by _time ] | eval total= exact(totalBytes*8/CurrentBandwidth * 100) | stats values(total) ... View more

Try this index=index host=host object="Network Interface" counter="Bytes Total/sec" | bucket _time span=1m | stats avg(Value) as bytesByHost by _time,host | stats sum(bytesByHost) as totalBytes by _time | append [search index=index host=host object="Network Interface" counter="Current Bandwidth" instance!="isatap.*" | bucket _time span=1m | eventstats avg(Value) as connsByHost by _time | stats sum(connsByHost) as CurrentBandwidth by _time ] | eval total= exact(totalBytes*8/CurrentBandwidth * 100) | stats values(total) ... View more

The problem is the text editor. replace "&lt;" with < and "&gt;" with > in the code bellow ...|rex field=_raw "^[^\n]Use%=(?P&lt;tmpuse&gt;d+)"|rex field=_raw "^(?:[^ \n] ){1,8}(?P&lt;tmpuse&gt;[0-9.]+)\%s*full"|table tmpuse ... View more

Here is what to type. |rex field=_raw "^[^\n]Use\%=(?P<tmpuse>\d+)"|rex field=_raw "^(?:[^ \n] ){1,8}(?P<tmpuse>[0-9.]+)\%\s*full"|table tmpuse ... View more

Which answer are you going to accept now? But, since the problem was the source i think you should accept mine. ... View more

Hello! When you use Values (X), The order of the values is lexicographical. Try the list function as follows and let me know what happen: sourcetype=xxx Status=Approved PartNo=$PartNo$ VendorCode=$VendorCode$ | Convert num(CurrentPrice) as CurrentPrice,num(VendorPrice1) as VendorPrice1,num(VendorPrice2) as VendorPrice2,,num(VendorPrice3) as VendorPrice3 | search ((VendorPrice1 &lt; CurrentPrice) OR (VendorPrice2 &lt; CurrentPrice) OR (VendorPrice3 &lt; CurrentPrice) ) |stats list(CurrentPrice) list(VendorPrice1) list(VendorPrice2) list(VendorPrice3) by RfqNo,PartNo,VendorCode ... View more

Hello! Try this: sourcetype=iis tag=webserver cs_uri_stem="/SearchQuery*" earliest=-3w@w latest=now |bucket span=7d _time|stats avg(TimeTakenMS) by cs_uri_stem, _time ... View more

Hello! Take a look at your TIME_FORMAT= %m%d %H%M%S:%3N and your data (0506 144145:629). I think in your TIME_FORMAT you did not well specify which values you need as the month, day, ........ Thanks ... View more

That is true. The order of the values is lexicographical when using the values function. In fact your results are sorting, but not as you want. To sole the problem, instead of use the values function, i will advise you to use the list function as follows: ..... |sort (src_ip)|stats list(src_ip) as sr_cip by dest_port, protocol, dest_ip | sort +dest_port, dest_ip I think it will be ok now! ... View more

Hello! Please let me know. Did you have a source named WMI:LocalPhysicalDisk_DFSR in your events? Please take the first query and change your if (soure=....... with if (sourcetype=.... .and let me know what happen. Thanks! ... View more

Hello! Here is what you can do. Working both for Windows/*Nix filesystems! .....|rex field=_raw "^[^\n]*Use\%=(?P&lt;tmpuse&gt;\d+)"|rex field=_raw "^(?:[^ \n]* ){1,8}(?P&lt;tmpuse&gt;[0-9.]+)\%\s*full"|table tmpuse Thanks! ... View more

which sample code did you use? ... View more

That is true. AND is not and. But i thing here you don't need to use the AND because index=mail (scriptName=ACF OR scriptName=ACE) is the same with index=mail AND (scriptName=ACF OR scriptName=ACE) Also, when you say index=mail and (scriptName=ACF OR scriptName=ACE) , this match all events where index= mail and that events must have the word and and then the sourcetype must be ACF or the scriptNAME must be ACE But when you say index=mail (scriptName=ACF OR scriptName=ACE) , this match all events where the index= mail, and sourcetype= ACF or sriptName=ACF Thanks ... View more

Please let me know. Where did you sort values(src_ip) ? Here you go: ..... |stats values(src_ip) as srcip by dest_port, protocol, dest_ip | sort +dest_port, destip, srcip hope this may help! ... View more

it is really surprising! Looking your dest_ip, here is the order you should have. 10.4.5.6 10.66.6.7 10.123.1.2 Please Try this and let me know! ..... |stats values(src_ip) by dest_port, protocol, dest_ip |eval desip=tostring(ip,"hex")| sort +dest_port, destip ... View more

No, Splunk already handles this automatically when you specify normal ranges (Mean to Max). if you have already had to deal with streaming data, you can see that a value can increase and decrease, the essential is the position of the needle, which always respects the interval. So by doing search|guage field 0 1 2 3 you will have the results you want. Just look the needle, as it can clilmb or fall. Thanks ... View more

Hello! How do you know that it is not working? By default your data are sorting in incresing order. Means from the smallest value to the heighest. By doing |sort +dest_port does not change any thing to the results. Test this and let me know how does it works ..............|sort -dest_ip ... View more

Hello! I'm sorry, but that is not yet possible with splunk without duplicating alerts! Means, - One alert for the 15 minutes there are no customers - One alert cron at 1AM-3AM - One alert for the weekends Thanks ... View more

Hello! It is working for me. I think it should be your data. Set C02K as the default value of your dropdown menu, to verify. If when swiching to c01k it's working, notice that the problem is comming from your data. If not, let me know. Thanks ... View more

But you can see users custom searches, not the export action. If a user have used the export command in the search query, you will see it in the custom.search column. Thanks ... View more

There is no authentication or user and role management when using Splunk Free. You can't modify the admin role, with splunk free. ... View more