Hi rajadatta Try the following query : |set union [search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype ] [search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype ]|stats sum(NumberFailed) as total_NumberFailed ... View more

Hi krdo By running the query below you will not see _raw and message fields because the expression fields - _raw message exclude them in the list of fields. begin your search here| fields - _raw message |table * Upload tutorialdata and run the following query you will see that in the fields that will appear you will not have categoryId action _time clientip bytes fields.Just test sourcetype=access_* |fields - _raw categoryId action _time clientip bytes|table * ... View more

Hi Venkat_16 If you are sure that the query above is yours then copy and paste the following xml code in a view and test <dashboard> <label>enter something</label> <input type="time" token="time_tok" searchWhenChanged="true"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <row> <chart> <title>Field colors example</title> <search> <query> index=XXXX sourcetype=XXXX earliest=@d latest=now |bin span=5m _time|stats count(XID) as thisDay by ID |append [search index=os sourcetype=sysstat_proc host="apapnp05" earliest=-1d@d latest=@d |bin span=5m _time|stats count(XID) as LastDay by ID | eval new_time=_time+86400] | |eval _time=if(isnotnull(new_time), new_time,_time)|timechart span=5m sum(thisDay) as Today sum(LastDay) as Yesterday by ID </query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> </search> <option name="charting.axisY.scale">log</option> <option name="charting.chart">column</option> <option name="charting.fieldColors"> {"thisDay ": 0xFF0000, "LastDay ": 0xFF9900, "Today":0x0066FF, "Yesterday":0xC4C4C0 ,"NULL":0xC4EFC0} </option> <option name="charting.legend.placement">right</option> </chart> </row> </dashboard> ... View more

Hi PabloCarvalho To solve your problem , Firsly : Copy and paste the following xml code in a view and save <dashboard> <label>your_view_name</label> <row> <panel> <chart> <search> <query> index=_internal| timechart count as TARGET, count(eval(type="d")) as REACHED | eval %_REACHED=((REACHED*100)/TARGET)" </query> <earliest>0</earliest> <latest>now</latest> </search> <option name="charting.chart">column</option> </chart> </panel> </row> </dashboard> Secondly : Configure your chart in the oder to have a Chart overlay 1- Click on edit tab then check edit panels 2-Click on , check chart overlay then fill Overlay field by %_REACHED field. In Scale field click on Linear tab 3- Save the configuration and click on Done ... View more

Hi Arminder_Bhalla Note that in a world map we always have a pie chart that contain the informations about each region. Look at an request exemple: Example 2: Compute the average rating for each gender after clustering/grouping the events by "eventlat" and "eventlong" values. ... | geostats latfield=eventlat longfield=eventlong avg(rating) by gender Why don't you use the world map with the default options. for more information follow these links : http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Geostats http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/map http://answers.splunk.com/answers/108521/geostats-zoom-level.html ... View more

hi Scan001 Try search code with uniq command source="file1" |table Acct-Session-Id| uniq ... View more

Hi vitorvmiguel Instead of append or appendcols command you can use multisearch command Like below | multisearch [search index="raw_internet" produto="1" OR produto="L" OR produto="2" OR produto="W" |stats count AS Clientes] [search index="raw_internet" produto="1" OR produto="L" OR produto="2" OR produto="W" | eval Erros=if(match(tipo,"E"),1,0) | stats sum(Erros) AS ClientesErros by codigoAcesso | count(eval(ClientesErros>0)) AS Clientes_Impactados] ... View more

Hi shrey12 Do you want to extract xy in "name = xyz" string ? Please let me know ... View more

Hi kozhin I Think that you can - create two indexes A and B - put your files in index A -Then use This search code to tranfer its from A to B index=A |collect index=B ... View more

Hi andrews_jg You can use Statistics tab to see your results ... View more

hi chadman copy and test this xml code <dashboard> <label>enter a label</label> <description/> <row> <panel > <chart> <title>enter a title</title> <search> <query> sourcetype="_sort" earliest=-30d |where encrypt_c =2| dedup host |stats count as "num_encrypt=2" |appendcols[search sourcetype="_sort" earliest=-30d |where encrypt_c !=2| dedup host |stats count as "num_encrypt!=2" ] | rename host as "Serial Number" encrypt_c as "Encryption Complete"|table "Serial Number" "Encryption Complete" "num_encrypt=2" "num_encrypt!=2" </query> </search> <option name="charting.chart">pie</option> </chart> </panel> </row> </dashboard> ... View more

hi francescafilini Note that outputcsv command outputs search results to the specified csv file Look at the following example . It outputs search results to the CSV file 'mysearch.csv' sourcetype=access_* |stats count by categoryId | outputcsv mysearch for more information follow this link http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Outputcsv In your search code , replace host=$host$ by host=* and $host$.txt by hosttxt then re-test it ... View more

Hi bugnet Try this search code ......|rex field=_raw "cs1\=(? <field1>\S)\s+cs1lable\=(? <field2>[^\n])"|eval UserAgent=if(field2==UserAgent,[......|eval UserAgent=field1|return $UserAgent ] ,"none")|table UserAgent ... View more

jackson1990 if you have not only 5 courses , just add the following to the search code above .........\D(?&lt;course6&gt;\d+)\D(?&lt;course7&gt;\d+)\D(?&lt;course8&gt;\d+)\D(?&lt;course9&gt;\d+)\D(?&lt;course10&gt;\d+) and retest let me know if it work ... View more

Hi jackson1990 Try this search code index="college_index" | table ID,Name,Age,Dept| rex field=_raw "Dept\=[^\=](?<course1>[^\|])\D(?<course2>\d+)\D(?<course3>\d+)\D(?<course4>\d+)\D(?<course5>\d+)"|fillnull value="NONE"| table ID Name Age Dept course1 course2 course3 course4 course5 ... View more

Hi rogner Try this search code |multisearch [ sourcetype="WMI:CPUTime" host=$host$| timechart avg(PercentProcessorTime) as WMI_avg by host |return $WMI_avg] [ search sourcetype=cpu host=$host$| multikv fields pctIdle| eval Percent_CPU_Load = 100 - pctIdle| timechart avg(Percent_CPU_Load) as unix_avg by host |return $unix_avg ] ... View more

Hi Type is it a name of a field in your data ? If no try to use the following search by replacing Type field by _raw field LookupQuery - Count by _raw ... View more

Hi junxianli All the links below will help you http://questions308.rssing.com/chan-12672734/all_p1.html http://answers.splunk.com/answers/53606/role-permission.html http://answers.splunk.com/answers/97268/all-roles-are-deleted-except-user-help.html http://answers.splunk.com/answers/168300/admin-down-restarting-splunk-does-not-reload-autho.html ... View more

Hi Norling80 Just copy and test this dashboard xml code <dashboard> <label>dashboard_name</label> <row> <panel> <chart> <search> <query>index=main sourcetype="playerdata" | timechart span=1h dc(PlayerId) | appendcols [search index=main sourcetype="playerdata" ActionTaken=observe | timechart span=1h dc(PlayerId)]</query> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">true</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">area</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="charting.chart.overlayFields">dc_with_all_ActionTaken</option> <option name="charting.axisTitleY.text">dc_with_one_ActionTaken</option> </chart> </panel> </row> </dashboard> ... View more

Hi nagaraj Look at these two examples it will help you 1- The following search works finds all hosts who haven't sent a message in the last 24 hours | metadata type=hosts | eval age = strftime("%s","now") - lastTime | search age > 86400 | sort age d | convert ctime(lastTime) | fields age,host,lastTime 2- What hosts (not forwarder/TCP inputs) have logged an event to Splunk in the last 10 minutes? (Including rangemap.) | metadata type=hosts index=netops | eval diff=now()-recentTime | where diff < 600 | convert ctime(*Time) | stats count | rangemap field=count low=800-2000 elevated=100-799 high=50-99 server=0-49 ... View more

Hi cusello Try this search code ......|table uid |where isnotnull(uid) Look at an example sourcetype=access_* |table categoryId |where isnotnull(categoryId) It works well ... View more

Hi kpers This search code can also work SourceName="Microsoft-Windows-IIS-IISReset"|eval IIS=if(EventCode==3201 , "Start" , "Stop")|rename IIS as EventCode | chart count by host EventCode ... View more

thanks good ... View more

Hi Duxa in spite of one дщп has several types of log message , you must index it and make a search that sort this log messages by type ... View more

Hi darrel343 Try this search code i think it will help .......... status="processed" AND status!="completed" |stats count by order |table count ... View more