please sfatnass Can you explain well your problem? ... View more

HI kabiraj This search code works well . Try it .......|mvexpand error|rex field=error "(?P<error1>[^\,]+)"|eval error1=error1.":"."TargetBandwidth"|eval error=error1.","|stats values(error) as error Look at an example ... View more

can you make your question more explicit please ... View more

Hi Try this search code ......|eval COMBINED_STRING=A." "."\"".B."\"" ... View more

Hi kumina If msgid and sc are not constant , use the max_match option and mvindex command to solve your problem Try this search code index=rx_connect "USER: BROADCAST"|rex field=_raw max_match=0 "\|\s\w+\:\s(?P<msgid1>[^\|]+)\s"|eval msgid=mvindex(msgid1,7) |rex field=_raw "\[(?P<sc>[^\|]+)\]"|rex field=_raw "\|\s(?P<field1>[\w]+)\:\sCINTERFACE"|rex field=_raw "\|(?P<field2>[\w]+)\:\s\[Profile]"|eval someNewField = field1."-".field2." (".msgid."-".sc.")" |table msgid sc field1 field2 someNewField see result ... View more

Thanks too . Test the second result and think to vote and accept ... View more

Thanks but you forgot to vote ... View more

the following link will be help http://answers.splunk.com/answers/73745/max-data-points-that-charts-can-handle.html ... View more

Hi kumina Try this search code it works well index=rx_connect "USER: BROADCAST" |rex field=_raw "MSGID:\s(?P<msgid>[^\|]+)\s"|rex field=_raw "SC:\s\[(?P<sc>[^\|]+)\]"|rex field=_raw "\|\s(?P<field1>[\w]+)\:\sCINTERFACE"|rex field=_raw "\|(?P<field2>[\w]+)\:\s\[Profile]"|eval someNewField = field1."-".field2." (".msgid."-".sc.")" |table msgid sc field1 field2 someNewField Look at the following screen capture ... View more

Hi ksextonmacb Try this search code tag=authentication user!=NULL | eval myVar=if(tag=="success","success","failure") | chart count by myVar , user limit=8 useother="f" usenull="f" ... View more

Hi DavidHourani try this search code .....|stats count by User webpage |top limit=0 User webpage |appendcols[search .....|stats count by BWu BWs |top limit=0 BWu BWs] ... View more

Hi SasiB137 Make sure that TIMEOUT_VAL field is present in the list of your field and that it is a numeric field ... View more

Hi PabloCarvalho what about the answer above ? Let see if it satisfy you and tell ... View more

Hi Venkat_16 have you test the xml code above ? If no let test and see ... View more

Retry with union operation and add the expression |fields DeviceId in each subsearch Try this |set union [search host=server* Identifier=name EventType=Stuff earliest=-60d@|fields DeviceId ][search host=server* Identifier=name EventType=Stuff earliest=-7d@|fields DeviceId ]|stats count(DeviceId ) as count_DeviceId Don't add something else in the query ... View more

In this case , i advise you to use stats command instead of eventstats Try this enter something here | stats count as total | chart span=1000 count over EntsBWElapTime |eval Percent=(count/total)*100|table EntsBWElapTime count Percent ... View more

Hi nmulm Try this search code enter something here | eventstats count as total | chart span=1000 count over EntsBWElapTime |eval Percent=(count/total)*100|table EntsBWElapTime count Percent ... View more

What about my answer .Let examine it.And tell if it works ... View more

Good thanks ... View more

Note that the search which contain a set command always begin with | set ... View more

Don't add something to the search code that i gave you just run it it works well will my data Delete index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) and re-run ... View more

Hi Hartmannish Use set command with intersect operation Try this search code |set intersect [search host=server* Identifier=name EventType=Stuff earliest=-60d@ ][search host=server* Identifier=name EventType=Stuff earliest=-7d@ ]|stats count(DeviceId ) as count_DeviceId ... View more

Hi MikeBertelsen Run the query that Woodcock gave you . Save it as alert by filling the important field ... View more