Hello. I thing this will interest you: http://docs.splunk.com/Documentation/Splunk/6.3.1511/Data/HowSplunkextractstimestamps http://docs.splunk.com/Documentation/Splunk/6.3.1511/Data/Configuretimestamprecognition Thanks ... View more

Hello. You can do it through configuration files (props.conf and transforms.conf). Read this: http://docs.splunk.com/Documentation/Splunk/6.3.1511/Data/Configureeventlinebreaking Thanks ... View more

Hello. Here you go: http://docs.splunk.com/Documentation/Splunk/6.3.1511/DMC/DMCoverview Thanks ... View more

Hello. Start reading here: http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Aboutindexesandindexers http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Howindexingworks Thanks ... View more

Hello! Here is all what you must know about the join command: http://docs.splunk.com/Documentation/Splunk/6.3.1511/SearchReference/Join Thanks ... View more

Hello. Try this: index=....... dir="up"|stats sum(time) as sum_time_up sum(speed) as sum_speed_up sum(weight) as sum_weight_up|eval average_time_up=time/sum_time_up|eval average_speed_up=speed/sum_speed_up|eval average_weight_up=weight/sum_weight_up|join [search index=... dir="down"|stats sum(time) as sum_time_down sum(speed) as sum_speed_down sum(weight) as sum_weight_down|eval average_time_down=time/sum_time_down|eval average_speed_down=speed/sum_speed_down|eval average_weight_down=weight/sum_weight_down]|table average_time_up average_time_down average_speed_up average_speed_down average_weight_up average_weight_down Thanks ... View more

Hello! Can you be more specific? please? ... View more

Yes of course.Start here to learn how to configure the application http://docs.splunk.com/Documentation/StreamApp/6.4.1/DeployStreamApp/AboutSplunkAppforStream http://docs.splunk.com/Documentation/StreamApp/6.4.1/User/ConfigureStreams ... View more

Hello try this: auditSource=tamc auditType=OutboundCall | rex field=_raw "\"Surname\":\"(?[^\"]+)\"" ... View more

True. Since the timechart command uses the _time field in your event data, that search query will not work, unless you have an _time field in your csv file. Thanks ... View more

Here you go: <your base search> |were Data!=" "|stats values(Name) as Name, values(Data) as Data by Number|table Number Data Name ... View more

Hello. The Contextual Drilldown(Inpage) dashboard, of the splunk 6.x dashboard example app can help you. Here is the code: <form> <label>In-Page Drilldown with Perma-linking</label> <fieldset submitButton="false"> <!-- Create an input to store the drilldown value. It will be hidden using custom javascript when the dashboard is loaded. --> <input type="text" token="sourcetype" searchWhenChanged="true" /> </fieldset> <row> <table id="master"> <title>Master</title> <searchString>index=_internal | stats count by sourcetype</searchString> <earliestTime>-60m@m</earliestTime> <latestTime>now</latestTime> <!-- Set the type of of drilldown, since we will always consume the same field, use row--> <option name="drilldown">row</option> <drilldown> <!-- Use set to specify the new token to be created. Use any token from the page or from the click event to produce the value needed. --> <set token="sourcetype">$row.sourcetype$</set> <!-- If we also set the form.sourcetype the input will get updated too --> <set token="form.sourcetype">$row.sourcetype$</set> </drilldown> </table> </row> <row> <!-- depends is the way we tell the content to only show when the token has a value. Hint: use comma separated values if the element requires more than one token. --> <chart id="detail" depends="$sourcetype$"> <title>Detail: $sourcetype$</title> <searchTemplate>index=_internal sourcetype=$sourcetype$ | timechart count</searchTemplate> <earliestTime>-60m@m</earliestTime> <latestTime>now</latestTime> </chart> </row> </form> ... View more

Hello! Just try some thing like this <your base search> |were Data!=" "|table Name Number Data Thanks ... View more

Hello! Try this: ... earliest=-30d| bucket _time span=1h| stats max(data_used_mb) by host _time ... View more

Hello! Try somethink like this: index=... source=... sourcetype=...| stats values(ip_source ) as ip_source values(ip_destination ) as ip_destination|join [search index=... source=... sourcetype=... ip_source =* ip_destination =*|where ip_source =ip_destination |eval sumip=ip_source + ip_destination |table sumip]|table ip_source ip_destination sumip or this index=... source=... sourcetype=...ip_source =* ip_destination | eval sumip=case(ip_source =ip_destination ,ip_source +ip_destination )|stats values(ip_source ) as ip_source values(ip_destination ) as ip_dest values(sumip) as sumip Thanks ... View more

Thanks. And i was thinking that you was only look at the count value 233322 . Isn't it? Because i think that the top command will give the count and also the percent fields! ... View more

Hello! Try this: index="ABC" sourcetype=* Customers=ABCD | top limit=1 Customers |table count Thanks ... View more

Hello! Did you use the join like this? ...... host="intern-Studio-1737" | rare limit=20 ip_destination|join [search host="intern-Studio-1737" | rare limit=20 ip_source ]|table ip_destination ip_source ... View more

Yes! Because i have used the max() command, means, 2015-06-30T15:00:40.940 is the max time. But you can also use a subsearch to get the top time, something like this: index=pcindex sourcetype=parlayx [search index=pcindex sourcetype=parlayx|top 1 time|table time]|transaction corr | search "lvl=ERROR"|table SMS_MSISDN corr time ... View more

True. try this index=pcindex sourcetype=parlayx|eventstats max(time) as time| transaction corr | search "lvl=ERROR"|table SMS_MSISDN corr time Hope, it may help ... View more

Hello! try this to get the last time value : index=pcindex sourcetype=parlayx| transaction corr | search "lvl=ERROR"|stats values(SMS_MSISDN) values(corr) first(time) You can also try other functions, last(), max(), ... Thanks ... View more

Hello! Are you sure you read the adequate document . Read here: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/CreateworkflowactionsinSplunkWeb Thanks ... View more

ok. I understand. The acceptFrom = < parameter> in your inputs.conf, let you list a set of networks or addresses to accept connections from. Each rule can be in the following forms: 1. A single IPv4 or IPv6 address (examples: "10.1.2.3", "fe80::4a3") 2. A CIDR block of addresses (examples: "10/8", "fe80:1234/32") 3. A DNS name, possibly with a '' used as a wildcard (examples:"myhost.example.com", ".splunk.com") Means, if you exactly know which machine is sending cisco ASA syslog, you could be able to do something like this: [udp://<remote server>:<port>] acceptFrom =10.1.2.3 sourcetype = cisco:asa index = cisco_asa source=udp1026 ....... Do the same for your Cisco ISE logs Thanks ... View more