Hello! You can do it using splunk Web, or the splunk CLI, or by editing your props.conf. Just read this: http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Monitornetworkports Thanks ... View more

Hello! first, start here: http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/AboutSplunkAppforStream next, go to the installation and configuration, http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/InstallSplunkAppforStream, http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/ConfigureStreams Thanks ... View more

Hello, Here is an option: source="output.csv" fullcommand="c2"|stats count(testname) as "Command2 Tests" |join [search source="output.csv" fullcommand!="c2"|stats count(testname) as "Other tests" ] |table "Command2 Tests" "Other tests" Thanks ... View more

Hello! Did you try RemoteIP=* ? whithout "" ? ... View more

Hello! add the type=inner to the join command. Some thing like this: ... | join type= inner thread_object_id [search ... | dedup thread_object_id sortby +activity_ts | eval first_comment_ts=activity_ts | fields thread_object_id first_comment_ts] Thanks ... View more

Here is the description of bucket according to the manual: Puts continuous numerical values in fields into discrete sets, or buckets, by adjusting the value of field so that all items in a particular set have the same value. It just means that, it may put the data in all the buckets if values of data returned by the search, allow him to do so. If not, it will return less than the number of buckets you have precised. Thanks ... View more

Ok try this: source="test.log" | eval item=split(items, ",") | mvexpand item|table item| stats count by item ... View more

Hello! The max_match command can be helpful ...|rex field=_raw max_match=0 "your extraction"|... Thanks ... View more

Hello! Try this: source="test.log" | eval item=split(items, ",") |table item| stats count by item Thanks ... View more

Hello! I don't know how is your search query, but notice that, schedule the report to run every minute does not means, you will get 1 event per minute. Just because, Based on the search criteria, you could have situations where none events are collected into your new index. For example a search like this: index=_internal "error"|collect index=error_index , will send events into error_index, only when the word "error" is found in the _internal index. The search takes some time to run before provide events, depending of the complexity of your query, and your computer performances. Means, a search can take more than 1 minute to run, before provide the first event. Thanks ... View more

Hello! Can i see all your search query? ... View more

Try this: index="raw_internet_cartonista" programa="WNHC" tipo="E" | stats list(idlogon ) as Clientes|dedup Clientes|join[search index="raw_internet_cartonista" programa="ILCL" tipo="I"|stats list(info10) as UserAgent ]|stats count(Clientes) by UserAgent Thanks ... View more

Run your search without a token and let know what happen Index=storage_arrays sourcetype=qos dev_name=* qos_class=* | eval qos_unit=if(qos_metric == "Bandwidth", qos_bandwidth, qos_thruput) | chart avg(qos_unit) as "QoS" avg(qos_metric_value) as Limit over _time by qos_class ... View more

Hello! Here you go index=indexName eventtype="failed_logins" |stats count Save it as an Alert! Title: Failed_alert Alert Type: Real Time Trigger Condition: Number of Results Trigger if Number of Results is : Greater than 3 in : 15 min For more information, Read here :http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Definerolling-windowalerts Thanks ... View more

Hello! I think the error should be your avg(qos_unit) and avg(qos_metric_value) . Make sure that qos_unit and qos_metric_value have numerical values since avg will only work with numerical values. If not, try another function Thanks. ... View more

Hello! Put the where clause after the count. eventtype="email_fetching" Fetching| stats count as totalcount | where totalcount>80 Thanks ... View more

OK! I will help you get the table above another way. Please try this and let me know if you have something: index=test sourcetype=iloscan|rex field=_raw max_match=0 mode=sed "s/\>(?<myfilnul>\<)/>not_defined</g"|rex field=_raw max_match=0 "\<name\>(?<servername>[^\<]+)"|rex field=_raw max_match=0 "\<version\>(?<version>[^\<]+)"|rex field=_raw max_match=0 "\ip\>(?<ip>[^\<]+)"|table servername version ip ... View more

Try like this .... |rex field=_raw "^(?:[^ \n]* ){2}(?P<IP>\w+)\s+[^\)\n]*\)\"\s+\"(?P<url>\w+)"|eventstats earliest(url) as start_url latest(url) as end_url by IP|transaction IP startswith=(url=start_url) endswith=(url=end_url)|stats count ... View more

Let me get the search query you are using please. ... View more

Hello! Try this and let me know what happen. If not working, please let me ge a sample of your raw data: [MyCustomSource] EXTRACT-CONTACT_NO =^ [|\t0]+(?P<CONTACT_NO >\d+)\s+ Thanks ... View more

Also, why don't you edit your props.conf for it? I think it will be easy! ... View more

Are you sure your query is the one giving the table above? Please let me get some of your ID's values. Thanks ... View more

Hello! Lets get the search you are using to build your table? ... View more

Just test this and let me know what happen: index=_internal sourcetype=scheduler thread_id=AlertNotifier*|table run_time alert_actions app status ... View more

Hello! Here his what you can do: First extract null values(As you wil see, since it is not possible to extract a null value, my null values here are < ), and then replace them with not_defined in your events, using mod=sed , (but i will replace them with >not_defined< ) and i think you wll understand why. ...|rex field=_raw mode=sed "s/\>(?<myfilnul>\<)/>not_defined</g" Now in your events you will have for example rows like <version>not_defined</version> You can now extract both fields and their values, and display them in your table, like this: ...|rex field=_raw mode=sed "s/\>(?<myfilnul>\<)/>not_defined</g"|rex field=_raw "\<(?<myfield>[^\/\>]+)\>(?<myfilnul>[^\<]+)"|table myfield myfilnul Thanks. ... View more