Hi pkeller Note that in splunk web requests are executed in sequential manner Then when you write the first request below , the attribut span=12h is considered before the action is executed (host=aaa6* OR host=bbb24*) "[string to filter search]" (E=005 OR E=00D OR E=0Bb OR E=0Bz) | timechart span=12h count by E while with this other request the action is executed before the attribut span=12h is considered (host=aaa6* OR host=bbb24*) "[string to filter search]" (E=005 OR E=00D OR E=0Bb OR E=0Bz) | timechart count by E span=12h I think that the first request is the best .I advise you to work with it. ... View more

Hi hartfoml try this search code index=_internal OR index=_audit status="success" |timechart span=1w count by user ... View more

Hi HeinzWaescher In splunk web when you click on "open in search " function it autoRun the report if the report is not open . I don't think that you can disable its in splunk web ... View more

Hi giovere Try this search code And let me known if it work like you want ........| transaction UserId startswith="login" endswith="logout" | timechart span=1h count by UserId ... View more

Hi chadman to get last value of a host field you can use last() function with stats cammand see the following serch code sourcetype="my source" | where Available_D < 100 | dedup host |stats last(host) as last_host| sort Available_D a |table last_host Available_D ... View more

Hi landen99 Try the search code below examine attentively After extracting the fields which are in your event .....|rex max_match=0 field=_raw "\s+(?P<field1>\S+)\s+(?P<field2>\d+)\s+(?P<field3>\S+)\s+(?P<field4>\d+)"| eval fields=mvzip(field1,mvzip(field2,mvzip(field3,field4)))|mvexpand fields|eval fil=split(fields,",")|eval fiel1=mvindex(fil,0)|eval fiel2=mvindex(fil,1)|eval fiel3=mvindex(fil,2) |eval fiel4=mvindex(fil,3)|streamstats count as number_line|eval fi1=mvzip(number_line,mvzip(fiel1,mvzip(fiel2,mvzip(fiel3,fiel4," ")," ")," ")," ")|stats list(fi1) as test2 ... View more

Hi jannonan I think that this search request will help you ......... |foreach status [eval sta=if(status=="SUCCESS",1,0)]|streamstats sum(sta) as val|eval tu=if(status=="FAILURE",0,met)|table status tu Just test it ... View more

Hi Kartik Try this code : <view onunloadCancelJobs="False" autoCancelInterval="100"> <!-- autoCancelInterval is set here to 100 --> <label>Sample search</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter"></param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search"> index=foo $Select$ |stats count by User_Name</param> <param name="earliest">0</param> <param name="latest">now</param> <module name="StaticSelect"> <param name="settingToCreate">Filter Result</param> <param name="label">Select</param> <param name="staticFieldsToDisplay"> <list> <param name="label">Choice 1</param> <param name="value">tag=1</param> </list> <list> <param name="label">Choice 2</param> <param name="value">tag=2</param> </list> <list> <param name="label">Choice 3</param> <param name="value">tag=3</param> </list> <list> <param name="label">Choice 4</param> <param name="value">tag=4/param> </list> <list> <param name="label">Choice 5</param> <param name="value">tag=5</param> </list> <list> <param name="label">Choice 6</param> <param name="value">*</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">Filter Result</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="Select">$Select$</param> </param> </param> </module> </module> </module> </view> ... View more

Kartik Go to the advance xml code and delete the following <module name="ServerSideInclude" > <param name="src">filtered_map.html</param> </module> then re-run ... View more

Hi kartik Try with this Advanced xml code <view onunloadCancelJobs="False" autoCancelInterval="100"> <!-- autoCancelInterval is set here to 100 --> <label>Sample search</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter"></param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search"> index=foo $Select$ |stats count by User_Name</param> <param name="earliest">-2m</param> <param name="latest">-0m</param> <module name="StaticSelect"> <param name="settingToCreate">Filter Result</param> <param name="label">Filter</param> <param name="staticFieldsToDisplay"> <list> <param name="label">Choice 1</param> <param name="value">tag=1</param> </list> <list> <param name="label">Choice 2</param> <param name="value">tag=2</param> </list> <list> <param name="label">Choice 3</param> <param name="value">tag=3</param> </list> <list> <param name="label">Choice 4</param> <param name="value">tag=4/param> </list> <list> <param name="label">Choice 5</param> <param name="value">tag=5</param> </list> <list> <param name="label">Choice 6</param> <param name="value">*</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">Filter Result</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="Select">$Select$</param> </param> </param> </module> </module> <module name="ServerSideInclude" > <param name="src">filtered_map.html</param> </module> </module> </view> ... View more

Hi nibinabr Don't you want to use sendemail command ? If using sendmail command will satisfy you tell me ... View more

Hi Splunk2016 Thank you for your answer stats command Provides statistics, grouped optionally by field. while eventstats command Adds summary statistics to all search results. For more information , follow this link http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/WhatsInThisManual ... View more

I think that something like this could help him Please martin_mueller could you help to verify in your side ? index="_introspection" | timechart per_second(data.localTime) as X| streamstats current=t global=f window=2 range(X) as X1 ... View more

Hi martin_mueller I say that you can use timechart and streamstats in the same request , you make sure that timechart command come before streamstats : look at an example ... | timechart span=1h sum(value) as total by category | streamstats global=f sum(total) as accu_total ... View more

What do you want to do? It is better to change the way to write request Just tell the thing that you want to do ... View more

Hi Skippy As martin_mueller told , per_second() function is easily applicable to timechart command .Therefore , you can use a subsearch use timechart and per_second() function before use streamstats command ... View more

Hi kshanky143 You can also use this : ....|replace 1 with 0 in Item3Count ... View more

Hi ksolanki88 The following is a link between splunk SDK for Java and splunk web https://github.com/splunk/splunk-sdk-java ... View more

Please splunknewbie05 can you explicit well your problem ?What do you want to do ? ... View more

Hi splunknewbie05 Use this search code index="myindex" sourcetype="csv" "pen" | table * ... View more

Hi ksolanki88 If you want to start a java program from splunk web , you must install Splunk SDK for Java for more information follow this link : http://dev.splunk.com/java If it satisfy you please vote my answer Note that splunk is code in Python language ... View more

Hi mvaradarajam To refresh a search for a panel: 1) In the Panel Editor, click the Refresh icon. OR 2) use the option in your panel <option name="refresh.auto.interval"> 12 </option> ... View more

Hi jgcsco To see just the top 10 concurrency by sourceip add limit=10 in your search like below | rex "duration=(?.*?)," | eval StartTime=round(strptime(startTime,"%Y-%m-%d %H:%M:%S"),0) | concurrency start=StartTime duration=Duration | timechart limit=10 span=1m max(concurrency) by sourceip ... View more

Hi Barty001 which creation ? please let me known ... View more