have you try to work with table commad ... View more

hi camel can you check it in in server.conf in this path $SPLUNK_HOME/etc/system/local/. ... View more

Are you viewing the dashboard as the same user? ... View more

hw many search query did you have in the dashboard ... View more

hi moiezuddin can we have the time format pl ... View more

hi philip.wong since license slave are been control by master liense means that this can be possible you know that A license master controls one or more license slaves. From the license master, you can define pools, add licensing capacity, and manage license slaves mean that you can achieve on what you need ... View more

which version of splunk are you using ... View more

the problem is not the permission ... View more

were you Specify the new source type in forwarder inputs ... View more

HI baxiani were you make a change on your data before it is been index ... View more

Hi can you try to use the eval commad i think this may help o solve you problem ... View more

hi leroygsmith another possibility is to Uninstall Splunk Enterprise manually if you can't use package management commands, use these instructions to uninstall Splunk Enterprise. Note: These instructions will not remove any init scripts that have been created 1. Stop Splunk Enterprise. $SPLUNK_HOME/bin/splunk stop 2. Find and kill any lingering processes that contain "splunk" in its name. for macos kill -9 `ps ax | grep splunk | grep -v grep | awk '{print $1;}'` 3. Remove the Splunk Enterprise installation directory, $SPLUNK_HOME. For example: Note: For Mac OS, you can also remove the installation directory by dragging the folder into the trash. 4. Delete the splunk user and group, if they exist. i think i will give you a link i think this may help this can also help you if the above step do not work http://www.uninstallapp.org/uninstall-splunk-how-to-remove-splunk-from-mac-os-x-3 ... View more

i need to know how you did this also ... View more

hi madhan45 what my friend gave it i error .the app that you can use to monitor cpu usage i will give a link so so that you can deload and use it to monitor your cpu usage this is the link http://www.splunk.com/web_assets/pdfs/secure/Splunk_App_for_Windows.pdf ... View more

i am very sorry what there say above is error 10 is also a dafault number that indicate The maximum number of rows to display ... View more

hi khaling4 You can use Attach task to this log or simply create a new scheduled task. Use the trigger When a specific event is logged Choose the log you want to monitor (you can choose multiple logs in the advanced task settings) Set the action to Send an e-mail (and provide the nescessary information) If you want any error sending a message you have to refine the trigger. Edit the trigger and choose custom. Then you have to press the button new event filter... Tick Error in the error level part In the drop down menu by log you can choose the log you want to monitor With this event filter you get a message for each error that occurs. ... View more

HI fdio1 To configure how Splunk listens on IPv6: Edit a copy of server.conf in $SPLUNK_HOME/etc/system/local than add this listenOnIPv6=yes yes mean that splunkd will listen for connections from both IPv6 for any problem on this take a look the documentation http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Howtousethismanual thanks ... View more

what you ask is impossible to do that indexing time note that went you are add data you are uploading the file so during that moment you can not give a header name at that moment because you are uploading a file ... View more

what you ask me sir i am still think on it if it impossible at indexing time ... View more

what do you want to do exactly can you explain to me more detail ... View more

Hi helenashton, what you ask is impossible in splunk for the moment you know that bar chart is been display depending the request you make so it is impossible to set the width of the bar chart.the bar that you see depend the request you make so you can not know the number bar you need all the bars depend the value in the field. thanks ... View more

what you did is good ... View more

Hi kartik 13 i am not sure it can work HiddenSearch module but i try something with SearchSelectLister module. it work just add above code to this xml code it work with Searchseleclister <module name="SearchSelectLister"> <param name="settingToCreate">pref</param> <param name="label">City</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="search">| inputlookup myLookup2</param> <param name="searchFieldsToDisplay"> <list> <param name="label">city</param> <param name="value">city</param> </list> ... View more

Hi kartik i try something with two dropdown i thank it may help you <module name="StaticSelect"> <param name="settingToCreate">area</param> <param name="label">Country</param> <param name="staticFieldsToDisplay"> <list> <param name="label">USA</param> <param name="value">USA</param> </list> <list> <param name="label">Japan</param> <param name="value">Japan</param> </list> <list> <param name="label">China</param> <param name="value">China</param> </list> <list> <param name="label">Germany</param> <param name="value">Germany</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">area</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="area">$target$</param> </param> </param> <module name="SearchSelectLister"> <param name="settingToCreate">pref</param> <param name="label">City</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="search">| inputlookup citylookup</param> <param name="searchFieldsToDisplay"> <list> <param name="label">city</param> <param name="value">city</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">pref</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="pref">$target$</param> </param> </param> </module> <!-- End ConvertToIntention --> . . . </module> <!-- End SearchSelectLister --> </module> <!-- End ConvertToIntention --> </module> <!-- End StaticSelect --> ... View more

hi harish_ka can you do some thing like this sourcetype="access_c*" | xmlkv | table TransactionId ... View more