ok let suppose that your souce name is mysource/poooo/jjjjjjj/yyyyyyy/............./ or yyyyyyyyyy/second/........ you can use the star(*) symbol to match any caracter in your source field. Something like this source=mysource* OR source=*second* (diameter=30 AND temp=77)|... ... View more

Hello! Try. .....source=firstsourcefile OR source=secondsourcefile (diameter=30 AND temp=77)|...... ... View more

No! you can only take block_num as a word inside the regex. Let me know block_num values, i think i can help you extract block_info ... View more

No No No ! By writing ...| rex field=_raw " Block number block_num (? < block_info>\w{1,}?)" , your are telling splunk to search for a word which is after the group of words Block number block_num . Splunk will not take block_num here as a field. So i am not sure that what you want is yet possible. ... View more

Hello! My proposition is not optimal, but it can help you as a start point. Let suppose you are working with the _internal index and you want the last sourcetype, the 24 hour average and the 7 day average of that value on the same chart. Here you go! index=_internal sourcetype=*|stats first(sourcetype) count as countvalue|join [search index=_internal sourcetype=*|bucket _time span=1d|stats count as total24h by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg24h=countfirst/total24h|table avg24h]|join[search index=_internal sourcetype=*|bucket _time span=7d|stats count as total7day by _time | eventstats first(sourcetype) count as countfirst by _time|eval avg7day=countfirst/total7day|table avg7day]|table countvalue avg24h avg7day dmaslin_splunk's link can help you uptimise that query, ... View more

here is my proposition ........| rex field=_raw "^(?P<end>[^,]+)[^:\n]*:\+\d+,(?P<begin>.+)"|table begin end ... View more

ok. So you are using a selection menu! There is a way to do it. Insert Tokens in your search query before save it as a Report. It will work. ... View more

Yes of course! You can call your saved search in each panel. Here is an example on how you can call your saved search. just do the same thing on each panel. <dashboard> <label>Inline Search</label> <description>Table, Chart and Event panels powered by inline searches.</description> <row> <panel> <table> <title>Report Table</title> <search ref="reporting_search_table"/> <option name="count">5</option> </table> <chart> <title>Report Chart</title> <search ref="reporting_search_timechart"/> <option name="charting.chart">area</option> </chart> </panel> </row> <row> <panel> <event> <title>Report Event</title> <search ref="nonreporting_search"/> <option name="count">5</option> </event> </panel> </row> </dashboard> ... View more

Hello! Can i get your time format? ... View more

Did you change splunkd default port also? ... View more

I was so far from what Konstantinow asked. I think that is the correct answer. Thanks again. ... View more

Are you the only user on your machine? If not, check if another user did not use the 8000 port on your machine. You can also think on changing your splunk-web port default value by reading here: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Changedefaultvalues#Change_network_ports ... View more

Ok try this: ............. |rex field=count2 "(?<count>\d+)"|table count or this ............. |rex field=count2 "(?<count>\d+)\("|table count ... View more

Ha ok. I think i get you now. Here you go: index=websrv sourcetype=iis NOT "10.1.1.3" NOT "10.1.2.3" NOT c_ip="10.1.1.50"|eventstats count(c_ip) as count_ip by c_ip|join [search index=websrv sourcetype=iis NOT "10.1.1.3" NOT "10.1.2.3" c_ip= "10.1.1.50"|stats count as count_proxy]|where count_ip>count_proxy|timechart count by c_ip ... View more

Hello! First you have to notice that, Advanced search-time field extractions use the REPORT extraction configuration in props.conf. Each REPORT extraction stanza references a field transform that is defined separately in transforms.conf. The field transform contains the regular expression that Splunk Enterprise uses to extract fields at search time, as well as other attributes that govern the way that the transform extracts those fields. Edit the props.conf file in $SPLUNK_HOME/etc/system/local/, or your own custom app directory in $SPLUNK_HOME/etc/apps/local. transform.conf: [My_transform] REGEX=The Error Number is (?< error_number> [0-9-]{5,5}) Let suppose that your events sourcetype is My_sourcetype props.conf: [My_sourcetype] REPORT-My_label = My_transform KV_MODE=none ... View more

Try this: ........|rex "\"(?<date>\d+\/\d+\/\d+\s\d+\:\d+\:\d+)\. "|table date ... View more

Yes of course! ... View more

Surprising! OK annother way to do it is to create an alert, wich, wen triggered, populate a summary index you have created. You can set a condition for the alert to be triggered as when the number of events is greatter than 0, or setup a Real Time alert. i did it and it is working perfectly! Let me know your impression! ... View more

Thanks for the explanation jptechnical. Please can you let me know how to get the hit count of an ip address? ... View more

I'm sorry, that property do not limit the number of results displayed per page. More explicitly, the property charting.data.count represent The number of results to retrieve from events. Set to 0, to get all results and default to 1000. You can decide to retrieve 1000 results from events, and display only 20 with limit, head, .... commands For more informations concernin charting options, start here: http://docs.splunk.com/Documentation/Splunk/6.0.1/Viz/ChartConfigurationReference ... View more