Hi chrismeyer75 You can use these search code |set union[search sourcetype=....... Transactionid= '12345' ] [search sourcetype=...... trans= '12345']|table_raw |multisearch [search sourcetype=....... Transactionid= '12345' ] [search sourcetype=...... trans= '12345']|table_raw Run these example |set union[search sourcetype=access_* method=GET ][search sourcetype=access_* method=POST]|table_raw |multisearch [search search sourcetype=access_* method=GET][search sourcetype=access_* method=POST]|table _raw ... View more

Hi saikatr - retry stopping splunkd - if it already no work just copy all your apps which are in app directory - then uninstall splunk instance and re install another instance. ... View more

thanks you ... View more

Hi Navanitha you forgot to vote my answer ... View more

Hi lennys26 Can you post me your dashboard xml code ? i don't understand well your problem ... View more

Hi vkale look at an example of search using pivot command example : Using the Tutorial data model, create a pivot table for the count of "HTTP Requests" per host. | pivot Tutorial HTTP_requests count(HTTP_requests) AS "Count" SPLITROW host AS "Server" SORT 100 host For more information see the manuel Splunk-6.2.2-PivotTutorial.pdf ... View more

Hi this is the difference between "AND" and "OR" when we use : AND make sure that all the condition is verified OR make sure that at least one condition is verified ... View more

Hi dovelsh12223621 Please explain me well your question If possible post me your xml code ... View more

Hi lohit Try this search index="abc" |rename uri as url |table a b c url|appendcols[search index="xyz" |table x y z url ] | stats values(a),values(b), values(x), values(y) by url ... View more

hi edyke dashboardexample6.x app will be help you . install this app and go see his drilldown example ... View more

Hi avilandau It is better for you to delete this panel in your dashboard search code instead of search the way to disable the panel. ... View more

Hi splunker12er At index time: Index-time processes take place just before event data is actually indexed. The following processes occur during (or before) index time: . Default field extraction (such as host, source, sourcetype, and timestamp) . Static or dynamic host assignment for specific inputs . Default host assignment overrides . Source type customization .Index-time field extraction . Event timestamping . Event linebreaking .Event segmentation (also happens at search time) At search time: Search-time processes take place while a search is run, as events are collected by the search. The following processes occur at search time: . Event segmentation (also happens at index time) . Event type matching . Search-time field extraction (automatic and custom field extractions, including multivalue fields and calculated fields) . Field aliasing . Addition of fields from lookups . Source type renaming . Tagging for more information about Index time field extraction & Search Time field extraction see the link as strive has give : http://docs.splunk.com/Documentation/Splunk/6.1.3/Indexer/Indextimeversussearchtime http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Configureindex-timefieldextraction ... View more

thank for your accepted answer ... View more

now i need that you vote me ... View more

i need that you vote me ... View more

thank for the accepted answer ... View more

Hi Hindoo If your searches inbound and outnound don't have a fields your request will look like below: sourcetype="syslog" host="192.168.0.1"|eval Bandwidth= [|set union [search Inbound ][search Outbound ] ]|timechart span=1m values(Inbound) as "Inbound Traffic (bps)",values(Outbound) as "Outbound Traffic (bps)",values(Bandwidth) as "Total Bandwidth (bps)" Note that in your request the problem is about Banwith=Inbound+Outbound ... View more

Hi catherine Note that when you use if () function , you use == and not = equality Now replace = by == and re run your request |sort _time |delta _time as StepTime p=1 |eventstats sum(eval(if(Step=="stepB",StepTime,0))) as StepABTime, sum(eval(if(Step=="stepD",StepTime,0))) as StepCDTime by TId |transaction TId |eval TotalTime = duration |table TotalTime, StepABTime, StepCDTime transactionduration ... View more

Hi NPR per_second() function is easily applicable to timechart command .Therefore , you can use a subsearch using timechart and per_second() function before use streamstats command. Mean that you can use timechart and streamstats Or stats command in the same request , you make sure that timechart command come before streamstats or stats command in your request : look at an example index="_introspection" | timechart per_second(data.localTime) as X| streamstats current=t global=f window=2 range(X) as X1 you can follow this link for more information http://answers.splunk.com/answers/228525/how-to-use-the-per-second-function-with-streamstat.html#answer-228580 ... View more

Hi rajparekh08 In your dropdown input add this <default>*</default> And define your panel title like this <title> drop_Token="$drop_Token$" </title> ... View more

Hi KolGr001 As the difference between your searches is SourceSystem, i advise you to use the search code below |set union [search Inbound][search Outbound]|table InvoiceNumber, Amount, SourceSystem|outputcsv inbound_invoice_list_4152015.csv Use it like this |set union [ search index=contract_gateway sourcetype=esb_audit bp_bp_name=InvoiceAudit SourceSystem=ESB OR SourceSystem=ESB2 earliest=-1d@d | stats latest(Amount) as Amount, latest(InvoiceNumber) as InvoiceNumber, latest(SourceSystem) as SourceSystem by bp_context_id | sort 0 SourceSystem,InvoiceNumber | dedup InvoiceNumber | fields InvoiceNumber, Amount, SourceSystem ] [ search index=contract_gateway sourcetype=esb_audit bp_bp_name=InvoiceAudit SourceSystem=CTG earliest=-1d@d | stats latest(Amount) as Amount, latest(InvoiceNumber) as InvoiceNumber, latest(SourceSystem) as SourceSystem by bp_context_id | sort 0 SourceSystem,InvoiceNumber | dedup InvoiceNumber | fields InvoiceNumber, Amount, SourceSystem ] | table InvoiceNumber, Amount, SourceSystem | outputcsv inbound_invoice_list_4152015.csv ... View more

Hi jbleich Try this search code ......| timechart span=1d count by "Failover Time" limit=0 where count >1 ... View more