Hi See this search code which use Collect command perhaps it will help you index=endeca |collect index=endeca-summary for more information about collect command see this link http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Collect ... View more

HI You can configure email notifications when you save a search as an alert. You can also configure email notifications for when editing an alert's actions. The procedure is the same in both cases. After running a search, save the search as an alert and configure email notification settings. 1) Run the search. 2) Select **Save As > Alert.** 3) Provide a Title and other information about the alert. 4) From the Add Actions menu, select Send email. 5) Specify the following: To, CC, and BCC email recipients. Specify a comma-separated list of email recipients. Priority Enforcement of priority depends on your email client. Subject Message Include You can include the following items: Information about the search Link to the alert Search string Trigger condition Trigger time Information about search results Link to results Inline listing of results, as a table, raw events, or CSV file Results as a PDF attachment Results as a CSV attachment Type Select HTML & Plain Text (multi-MIME message) or Plain Text 6) Specify other alert actions. See set up alert actions for more information. 7) Click Save. to complete what i am saying click on http://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification you can also use Sendemail command to use it see this link : http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Sendemail ... View more

Hi Use this search code and look at the difference in the results index=_internal | stats dc(source) AS C1| appendcols [search index=_audit| stats dc(source) AS C2 ] |table C1 C2 ... View more

Hi try this search code index="sdp" Level !="Not Assigned" Urgency="*" | chart count over Level by Urgency | eval Level=case(Level=="Intensive", "1. Intensive", Level=="Intermediate","2. Intermediate", Level=="Moderate","3. Moderate", Level=="Minimal", "4. Minimal") ... View more

HI xvxt006 Try this | rex field=uri mode=sed "s/(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)|(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)/XXX/g" | table uri ... View more

Hi try this example and tell if it help you index=_internal |timechart count by date_month where (date_mday>=15 and date_mday=<31) ... View more

In "Searches, reports, and alerts" page , we can see all the schedules or not schedule report , we can also see the reports that belong to a specific app that we choose in App context ... View more

do you fill a displayed form ? What happen when you do it ... View more

Hi HeinzWaescher Yes in you splunk web , go to Settings then click on "Searches, reports, and alerts" and find you report in the opening page ... View more

After clicking the link above , in the opening page click on Older releases in the second opening page click on the Operating System which concern you and see all the version of splunk Enterprise instance that you can download ... View more

Hi you can download splunk Enterprise instance version 6.3.2 for Windows 7 or 8 , Linux , Mac OS or Solaris Just click on the following link and in the opening page choose the instance of the Operating System that you want . This bring you in another page where you are calling to fill a form before continuous downloading http://www.splunk.com/en_us/download/splunk-enterprise.html ... View more

here i use intersect to filter the events of the "aurth-frontend" and the "per-frontend" which have both detail.IdaUser field ... View more

you say you want to count the detail.IdaUser from events which have both the "aurth-frontend" and the "per-frontend" use this search code | set intersect [search index=main auditSource=auth-frontend auditType=Login | fields tags.X-Session-ID detail.IdaUser] [search index=main auditSource=per-frontend auditType=RequestReceived | fields tags.X-Session-ID detail.IdaUser]| stats dc(detail.IdaUser) ... View more

Hi Try separately these two searches and let know the result first search index=main auditSource=auth-frontend auditType=Login | rename tags.X-Session-ID as sessionID|table sessionID| stats dc(detail.User) second search index=main auditSource=per-frontend auditType=RequestReceived| rename tags.X-Session-ID as sessionID|table sessionID | stats dc(detail.User) ... View more

give me some values of detail.User field ... View more

Hi Try this index=main (auditSource=auth-frontend auditType=Login) OR (auditSource=per-frontend auditType=RequestReceived)| rename tags.X-Session-ID as sessionID | table sessionID | stats dc(detail.User) ... View more

HI IRHM73 I added detail.User field in fields command Just re test and let know if it works | set union [search index=main auditSource=auth-frontend auditType=Login | fields tags.X-Session-ID detail.User] [search index=main auditSource=per-frontend auditType=RequestReceived | fields tags.X-Session-ID detail.User]| rename tags.X-Session-ID as sessionID| table sessionID| stats dc(detail.User) ... View more

tags.X-Session-ID is it a field ? ... View more

Hi vamsi92 You can use collect command to add data to an index which contain your originate data. For example if you indexed data in an index called downloadcount you can make a search and put result into this index in a proportion as you make search . Look at a search cde example using Collect command Put "download" events into an index named "downloadcount". eventtypetag="download" | collect index=downloadcount For more information about collect command see the following link http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Collect ... View more

Hi jedatt01 Try this search code | set union [search index=my_index UserName=myuser| fields _time MacAddress Message] [search index=my_index NOT UserName| fields _time MacAddress Message]|table _time MacAddress Message ... View more

Hi carrotball These two search codes are the same the difference is between the time range which is difference. Note that the visualisation change with the time range. ... View more

look very well your data and re test this search it work well ... View more

Hi IRHM73 Just test this search i think that it will help you | set union [search index=main auditSource=auth-frontend auditType=Login | fields tags.X-Session-ID] [search index=main auditSource=per-frontend auditType=RequestReceived | fields tags.X-Session-ID]| rename tags.X-Session-ID as sessionID| table sessionID | stats dc(detail.User) ... View more

HI JohnWright8 Perhaps your schedule reports stop to trigger go to Settings ---> Searches, reports, and alerts Open your schedule reports and verify the following options For example the attributes of Alert that is : Condition check for example always Throttling Uncheck After triggering the alert, don't trigger it again for Expiration specify How long Splunk keeps a record of each triggered alert. And re test ... View more

Hi boopaljothi I advice you to use another browser to launch you search and wait a few minutes before concluding. ... View more