Hi lyndac I think that you must simply retry like this : index=myIndex | fillnull value=NONE subsystem | chart count(ticket) by subsystem Look at this example it works well sourcetype=access_* |fillnull value=NONE categoryId |chart count(action) as c by categoryId And the result ... View more

good thanks ... View more

Hi tmeader Try this search code | set diff [search sourcetype="ossec\_agent\_control" earliest=-1d@d | dedup reporting\_host |fieldformat yerster_day = strftime(earliest, "%m/%/%Y:%H:%M:%S")|fields reporting\_host status yerster_day] [search sourcetype="ossec\_agent\_control" earliest=d@d | dedup reporting\_host |fieldformat to_day = strftime(earliest, "%m/%/%Y:%H:%M:%S")| fields reporting\_host status to_day]|table reporting\_host status yerster_day to_day ... View more

Hi leotoa Try this search code |set union[search sourcetype=A_LOG NOT Source_IP=10.* |fields Source_IP][search sourcetype=B_LOG NOT Source_IP=10.*|fields Source_IP ] |table Source_IP ... View more

Hi a212830 To combine remotehost and FS_Name fields to a unique field Use this request : index=coreops sourcetype=sitescope_monitorstat MonitorType=FileSystem remotehost=lrtp17 OR remotehost=lrtp21 OR remotehost=lrtp22 OR remotehost=lrtp23 OR remotehost=lrtp24 OR remotehost=lrtp25 OR remotehost=lrtp26 FS_Name="/fiis/" OR FS_Name="/dis" earliest=-15m|eval fiel1=mvzip( remotehost , FS_Name)|eval fiel2=split(fiel1,",")|table fiel2 Then you can add at the end of search code above this |stats first(fiel2) as remotehostFS_Name to obtain the latest value of combined field ... View more

thanks good ... View more

Hi nekbote It is simple form> <label>Demand Billed Dashboard-DBQuery Clone</label> <fieldset submitButton="false" autoRun="true"> <input type="time" searchWhenChanged="true"> <label>Select a time:</label> <default>Last 24 hours</default> </input> </fieldset> <row> <panel> <table> <title>Demand Billed Demand Billed there are $earliest$</title> You can also use the following <title>Demand Billed Demand Billed between $earliest$ and $latest$</title> where : -1d@d represent 1 day ago -2d@d represent 2 day ago ... View more

Good thanks ... View more

Hi nitesh218ss Try with this xml code search index="uk" sourcetype="ukpro" serviceType=1 message="Deleted m_pReceivingSocket" | rename time as time2, message as Responce | stats count as req|appendcols[search index="uk" sourcetype="ukpro" serviceType=1 message="Received * bytes from IP*" | rename time as time1,message as Request] | eval itime=strptime(time1,"%H:%M:%S.%3N") | eval ptime=strptime(time2,"%H:%M:%S.%3N") | eval TimeDiff=ptime -itime | table time2 time1 TimeDiff audit Request Responce req | stats avg(TimeDiff) as AVG, max(TimeDiff) as MAX, min(TimeDiff) as Min,count(Responce) ... View more

Hi kmattern Try this search code sourcetype="solaris3-web-access" /uhpo/ status="200" |timechart count(status) as Logins|appendcols[search sourcetype="solaris3-web-access" /uhpo/ status="200" | convert timeformat="%H:%M:%S" ctime(_time) as timestr|eval n=substr(timestr, 1, 8) ]|rename n as Hours| table Hours Logins ... View more

Hi a212830 Click on this link i think it will help well http://answers.splunk.com/answers/210608/how-to-include-an-app-name-as-a-part-of-the-search.html ... View more

Hi cgekoski Re try with the search code below note that you must use where command index=firewalls NOT ("x.x.x.x" OR "x.x.x.x" OR "x.x.x.x" OR "x.x.x.x" OR "Deny" OR "No matching connection" OR "Teardown" )| regex src_port="^25$|^110$|^465$|^995$|^143$|^993$|^2525$" | chart count by dest_ip src_port| where count>500 | sort -count | rename dest_ip AS Source ... View more

as rmaccum says you forgot to close the second subsearch with "]" close it and rerun your search let me know if it work ... View more

Hi aferone If the xml code above is exactly that you have , i advise you to use exactly the code below , it works <dashboard> <label>put your label here</label> <description>Show your description here </description> <row> <chart> <title>Title</title> <search ref="Splunk - Search"></search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">pie</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="charting.fieldColors">{"Available":0x336633,"Used":0xE60000}</option> <option name="height">450px</option> <option name="charting.chart.showPercent">true</option> </chart> </row> </dashboard> ... View more

Hi chustar To do this 1- Go to search bar write and run your request . 2-Click on save as tab then on Alert , and begin to fill the form which appear. After fill the first form , click on next to fill the second where you will click on Send Email and in Include you will choose the format of your report. 3- For more information follow the link below http://docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Aboutalerts ... View more

I don't know exactly how are your data ... View more

Hi aferone Use your dashboard xml code without 1- <panel> </panel> 2- Then use the option , note that you can change the height like you want <option name="height">650px</option> in the <chart> </chart> 3- Look at an example : <dashboard> <label>Searches power dashboards</label> <description>Show the various searches to power a panel.</description> <!-- This row contains three panels --> <row> <chart> <title>(Inline Search) Top Source Types</title> <!-- Inline Search --> <search> <query> index=_internal | top limit=100 sourcetype | eval percent = round(percent,2) </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="rowNumbers">true</option> <option name="charting.chart">pie</option> <option name="height">650</option> </chart> </row> </dashboard> ... View more

Hi HattrickNZ This search code will help you , just run it ...|eval sumTraffic=c84163237+ c84163338| timechart span=1h sum(c84163237) as sumTraffic1 , sum(c84163338) as sumTraffic2 ,sum(sumTraffic) as sumTraffic3 by LABEL In your result you will have 4 fields : _time , sumTraffic1 , sumTraffic2 ,sumTraffic3 ... View more

Hi ilyazs Look at this xml code , it will be help you well , just try it. <form> <label>Dropdown Form Input Element</label> <description>display results by index</description> <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="index_tok" searchWhenChanged="true"> <label>Select an index:</label> <default>*</default> <choice value="*">All</choice> <choice value="xyz">xyz</choice> <choice value="yzx">yzx</choice> </input> </fieldset> <row> <chart> <title>Chart of Events for index="$index_tok$" </title> <searchString>index=$index_tok$ sourcetype=aaa | eval project_names=if($index_tok$=="xyz","proj_n=""","project_n=""") | chart count(host) as hostnames by project_names</searchString> <earliestTime>0</earliestTime> <latestTime>now</latestTime> <option name="charting.chart">column</option> </chart> </row> </form> ... View more

Hi shengcow Use simply the following search code : |set union[ search index=firewall1 dst=8.8.8.8 ][search index=firewall2 starttime="03/23/2015:12:13:45" endtime="03/23/2015:13:13:55" dst=8.8.8.8] ... View more

Good ...... ... View more

Good ....... ... View more

good thanks ... View more