Hi I have two time stamps in my logs. . say 12:10:2012T05:40:34+1.00/L:TIME and TIMESTAMP=2012-07-11T06:59:00.008+01:00 .. How can i say splunk to take one of time as _time . i need the TIMESTAMP to be taken as my loggig event time..so that i can calucate the difference between the events with the help of transacition command... Please help.. ... View more

Hi, I need to calucalte the time difference between two events in splunk..using the transaction command ....how can i do that ..?? in my logs i have my own field called "TIMESTAMP" . Please help.. ... View more

Can I create a lookup table with wildcard character * ? I have a lookup like input,output user*,USERNAME so anything that comes like user or user1 or username will match user* and output USERNAME . ... View more

Hi I have created a Dashboard which consists of a table of results.I need to disable the viewresuls link on the dashboard which is appearing at the bottom of the table. how can i do it ?? Thanks in advance !! ... View more

Hi. I have a created a form with a textbox and dropdown list.In the droplist i have options like A,B,C etc..Basing on the value selected in the dropdown list the label for the textbox should change..ie if i select "A" in dropdown..label for inputbox should change as "Enter value for A" and that value will be entered in the textbox/inputbox to perform the form search.. Please help asap..Thanx.. ... View more

Hi For Every Search Query i excute . I could see the list of the dupliate events associated with each search query . How can make them disable and display only the unique events associated with my search Query. I am getting these duplicate events ..since accidently i got the source files indexed twice.I know i can i delete them...but i dnt want to delete..cause it may effect the other search queries..can you pls give me a solution to see the unique events for my search without deleting the dulicate source files... thanx.. ... View more

I have a table like this .. Table 1 : Information to be searched **Company A | Company B abc xyz lmn pqr def pgf** Where the values mentioned inside the table are searchparameters . Now i need the count of the search parameters in splunk like this .. Table 2: Output Company A | Count A | Company B | Count B abc 30 xyz 10 lmn 40 pqr 23 def 50 pgf 29 my sourcetype is "A". sourcetype="A" abc | stats count as Count A has given abc count..I need count for all the values in A and B mentioned in Table 1 as in Table 2.i.e Table 2 should be the output for my search results...How do i accomplish this..please help.. ... View more

Hi I have to use a query similar to sql like this in splunk. select * from table1 where color NOT IN [select color from table2] I have tried like this..but it didnt worked..plesae help sourcetype="X" "OrderPending" Label_Text="Message sent to Customer" buyerID NOT in [search sourcetype="X" "RequestOrder" Label_Text="Message received from customer" | fields buyerID ] I need to display all the records which doesnot cotain the buyerID in the requests message... sourcetype="X" "OrderPending" Label_Text="Message sent to Customer" sourcetype="X" "RequestOrder" Label_Text="Message received from customer" These two are two seperate events...having buyerID in common...how do i write the query..pls help... ... View more

Hi, I Have created a table dashboard for my search query. Here my SearchQuery gives me 300 hundred results..but in the table view its displaying only 10..how can make it 30 per page... Thanx.. ... View more

Hi , I have query which uses the chart command . Now i need only top ten values to be displayed for that query . used top but didnt get the proper results. sourcetype="X" | eval a=mvfilter(eventtype LIKE "%_Metrics") |stats count by UniqueID,a |chart sum(count) by UniqueID,a | fillnull value="0" here a contains the eventtypes my results are something likethis.. UniqueId A_metrics B_metrics C_metrics abc 0 56 0 sds 34 5 94 dss 0 53 39 ere 24 45 19 .... ... ... I need to display only the count top 10 UniqueId's..How can i do tat ?? Used top at the bottom but couldnt the same result as above..please help. ... View more

Hi, i have created 5 eventtypes say A,B,C,D and used the chart command to display the count of all the events in the evenntypes on the particular searchlogic..For few searchlogic few eventtypes didnt contain any events..in that case nothing is displaying..I need to display "N/A" to that field instead of displaying blank. How can i do this.. My search query is something like this .. sourcetype="X" (somelogic) | chart sum(count) by uniqueId,eventtype My output is . UniqueID A B C D E ddd 4 5 5 7 sss 5 4 7 8 I need the output like this. UniqueID A B C D E ddd 4 N/A 5 5 7 sss N/A 5 4 7 8 Thanx ... View more

Can we combine eventtypes based on a category? ie I have four eventtypes which fall into a specific category like purchase..so can I combine these four eventtypes into a single eventtype. If so, how i can i do it? And can you please provide an example for this. Thnx. ... View more

Hi , I have created a view to display my search results..i have three search queries say Query1,Query2 and Query3 . Now i need to display these search query results in a tabular format ..so i have used the html tag like this in the module....but its not workin ...please help on this. My three queries are : Query1 : soucetype="x" somelogic | stats count as A Query2 : soucetype="y" somelogic | stats count as B Query3 : soucetype="z" somelogic | stats count as C soucetype="x" somelogic | stats count as A soucetype="y" somelogic | stats count as B soucetype="z" somelogic | stats count as C <module name="HTML"> <param name="html"> <![CDATA[ <center> <table> <tr> <th>A Count </th> <th>B Count</th> <th>C Count</th> </tr> <tr> <td>$results[0].A$</td> <td>$results[0].B$</td> <td>$results[0].C$</td> </tr> </table> </center> ]]> </param> </module> Its Working fine when i have only one search query inside the module ..but not working for three param tags..need help on this asap..thnx ... View more

Hi i have my query something like this . sourcetype="X" (some logic) |transaction keepevicted=true uniqueID |where duration>0 | stats count as Total | eval cond=(duration/60) | where cond < 30 | stats count as Passed | table Passed,Total But i am not getting the results.. In the Total field i need the count of events that are below duration < 0 In the Passed field i need the count of events that are below duration < 0 and cond < 30 How can i get this ?? Please help... ... View more