Ha ok. The manual is clear: Restrictions on search, such as user quotas, maximum per-search time ranges, and search filters, are not supported with splunk free. http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/MoreaboutSplunkFree As i said bellow, The delete operator can only be accessed by a user with the delete_by_keyword capability. The admin role does not have this capability by default. With splunk free, There is only one role (admin), and it is not configurable. Thanks ... View more

Hello! How a bout just give the value of fieldName directly to fieldValue? ..|eval fieldValue=FieldName Notice that i did not use "FieldName " ... View more

Hello! Here is what you want to know! The delete operator can only be accessed by a user with the delete_by_keyword capability. By default, Splunk ships with a special role, "can_delete" that has this capability (and no others). The admin role does not have this capability by default. Splunk recommends you create a special user that you log into when you intend to delete index data. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete So you have to create a user and grant him a delete capability. Use that user to delete your events, and let me know if you can still see your events afeter they have been deleted. Thanks! Stephane ... View more

Hello! Try this index=INDEX sourcetype=INDEX_LOG....... |rex field=_raw "^(?:[^'\n]*'){3}(?P<Unable to connect to server>[^']+)"|table "Unable to connect to server" or this index=INDEX sourcetype=INDEX_LOG....... |rex field=_raw "^(?:[^'\n]*'){3}(?P<Unable_to_connect_to_server>\d+\.\d+\.\d+\.\d+)"|table Unable_to_connect_to_server ... View more

Wo Wo Wo. I'm not sure it is possible. In fact, to affect a value to a token is not yet possible with splunk. Thanks. ... View more

Hello! Try this: Extraction of fields|Search $token$ |continu my query Example, let suppose that you have a token named token, and you want to search on it. here you go ......|rex "^Message=(?P<DocumentNum>[^,]+),\s+(?P<DocumentT>\w+\s+\w+\s+\w+)|search $token$|stats count by Document ... View more

try this: ..........|rex "^Message=(?P<DocumentNum>[^,]+),\s+(?P<DocumentType>\w+\s+\w+\s+\w+)\sowned\sby\s(?P<username>[^ ]+)\son\s(?P<device>[a-f0-9]+)\swas\s(?P<location>.+)"|table DocumentNum,DocumentType, username, device, location And if you are working with a csv file, means Message is a field in your csv, try this: ..........|rex field=Message "(?P<DocumentNum>[^,]+),\s+(?P<DocumentType>\w+\s+\w+\s+\w+)\sowned\sby\s(?P<username>[^ ]+)\son\s(?P<device>[a-f0-9]+)\swas\s(?P<location>.+)"|table DocumentNum,DocumentType, username, device, location if not working also, please let me see the entire first line of your events. ... View more

Hello! Here you go |rex "^Message=(?P<DocumentNum>[^,]+),\s+(?P<DocumentType>\w+\s+\w+\s+\w+)(?:[^ \n]* ){3}(?P<username>[^ ]+) on (?P<device>[a-f0-9]+) was (?P<location>.+)"|table DocumentNum,DocumentType, username, device, location ... View more

Hello! Try this: [json_no_timestamp] TIME_PREFIX = "id":\s\" TIME_FORMAT = %Y-%m-%d_%H-%M-%S ... View more

Hello! I don't know if i have understood very well your problem . But i think, If you just want to pass in a -server parameter or a -awesomelevel parameter into dosomethingawesome.py, Just write annother script, let say setparameter.py, which can take your server parameters and pass it into dosomethingawesome.py. And then create your alert that run setparameter.py as an action. When the alert triggered, your parametters will be sent to dosomethingawesome.py by setparameter.py. Thanks. please let me know if i got you. ... View more

Hello! What you are asking is not yet possible . As you can see on Settings-->Acess controls-->Roles , you can not limit the number of results a user can export. Once you allow a user to make searches (by giving him a search Role ), you can only set Searches restrictions , like Restrict search terms,Restrict search time, the maximum number of concurrent search jobs range, etc.. Now, to know any searches lauched by any user, here is the query you need: | rest /services/search/jobs|table author custom.search Thanks ... View more

Yes of course. If you are the administrator, you can set a user default app using splunk web. Just go on Settings--> Access Controls--> User-->the user name , there you can decide about the app you need as your default one or a user default app. Thanks! Stephane ... View more

Hello! By following the link you gave above, i think you should use this to compare type1, and type2 count(pro_id_TY1) is the count of ID in events where there is no CategoryID, (means the last event in your sample data.) count(pro_id_TY2) is the count of ID in events where there is a CategoryID (means, the first and the second event in your sample data) if url is a field in your events, here you go ........|rex field=url "^[^&\n]\?ID=(?P \d+$)"|rex field=url "^[^&\n] &ID=(?P \d+)"|rex field=url "^[^&\n]*\?ID=(?P \d+)&Category"|stats count(pro_id_TY1) count(pro_id_TY2) if url is not a field, means you are working with raw data, here yu go: ...|rex field=_raw "^[^&\n]\?ID=(?P \d+$)"|rex field=url "^[^&\n] &ID=(?P \d+)"|rex field=url "^[^&\n]*\?ID=(?P \d+)&Category"|stats count(pro_id_TY1) count(pro_id_TY2) If anny issue, let me know. Thanks Stephane ... View more

Here is an example: <form > <label>Single Value Customization: Panel Color</label> <fieldset submitButton="false" autoRun="true"> <input type="time" token="time" searchWhenChanged="true"> <label/> <default> <earliestTime>0</earliestTime> <latestTime>now</latestTime> </default> </input> <input type="dropdown" token="index" searchWhenChanged="true"> <label>Choose one index</label> <choice value="*">All</choice> <populatingSearch fieldForLabel="index" fieldForValue="index">| eventcount summarize=false index=* OR index=_*</populatingSearch> <default>*</default> </input> </fieldset> <row> <single id="id1"> <title>Count of all events in index=$index$</title> <searchString>index=$index$ OR index=_$index$|stats count</searchString> <earliestTime>$time.earliest$</earliestTime> <latestTime>$time.latest$</latestTime> <option name="field">count</option> <option name="beforeLabel">There is</option> <option name="afterLabel">Total Events</option> <option name="underLabel">All events</option> </single> </row> </form> ... View more

Are you sure that your query is correct? Complete it as follows and let me know the result. | sendemail to=user@mydomain.com format=html server=my.server.net from=Splunk.Alert@mydomain.com sendresults=true subject="search email test" message=search_results ... View more

ok. That is how your qury works. First the firs part of the query : index=my_index sourcetype=my_sourcetype host=hostname ((signature_number=1) OR (signature_number=2)) ((dest_ip=192.168.0.0/16) OR (src_ip=192.168.0.0/16)) will find all the events where: 1. signature_number=1 and dest_ip=192.168.0.0/16 2. signature_number=1 and src_ip=192.168.0.0/16 3. signature_number=2 and dest_ip=192.168.0.0/16 4. signature_number=2 and src_ip=192.168.0.0/16 Let suppose that the search will take 2min to accomplish. The second part of your search | where signature_number=1 AND dest_ip=192.168.0.0/16 will come and filter all the events you received wif the first part of the query, to give only events where signature_number=1 and dest_ip=192.168.0.0/16 let suppose the filter will take 1min. 2min+1min=3min Now the second query: index=my_index sourcetype=my_sourcetype host=hostname signature_number=1 dest_ip=192.168.0.0/16 will return only events that you need.That query is more efficient than the first one. To have your large sense rusult it will be better that you do something like this: index=my_index sourcetype=my_sourcetype host=hostname signature_number=1 (dest_ip=192.168.0.0/16 OR src_ip=192.168.0.0/16) ... View more

Is your splunk instance is in the cloud? because emails goes from one server to anothers you will not be able to send emails until your splunk instance is hosted. Thanks ... View more

Please let me know exactly what you want to do! ... View more

Only if you want to send an email message, you can add a message ... View more

I think the INPUT Multi-token Setter in dashboard 6.x example app should help you. Something like the one bellow. Take a look at it and let me know if you have any issue <input type="dropdown" token="level"> <label>Log Level:</label> <choice value="ANY">ANY</choice> <choice value="ERROR">ERROR</choice> <choice value="WARNING">WARNING</choice> <choice value="INFO">INFO</choice> <default>ANY</default> <change> <condition value="ANY"> <set token="new_search">index=_internal sourcetype=splunkd | table _time sourcetype message</set> </condition> <condition value="*"> <set token="new_search">index=_internal sourcetype=splunkd | table _time source sourcetype message</set> </condition> </change> </input> <table> <title></title> <search> <query>$new_search$</query> <earliest>-60m@m</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">5</option> </table> ... View more

Try something like this: 1) Alert when there are 50+ jobs running | rest /services/search/jobs|stats count |eval triggerer=(if( count>50,"ok","no"))|where triggerer="ok"|table triggerer 2) alert if a job is running more than an hour | rest /services/search/jobs |where runDuration>1600 3) See searches per hour by user (i'm not yet able to let you see searches per hour ) | rest /services/search/jobs|chart values(custom.search) by author ... View more