Can you provide your base search? ... View more

Can you check the navigation xml of the app you are currently in? For e.g - It should have the entry for dashboards like below. <nav search_view="search" color="#65A637"> <view name="search" default="true" /> <view name="data_models" /> <view name="reports" /> <view name="alerts" /> <view name="dashboards" /> </nav> Details here - http://dev.splunk.com/view/webframework-developapps/SP-CAAAEP9 ... View more

Since you want it in two separate columns do it this way - <your search > | table records | appendcols [ search <yoursearch> | dedup records | rename records as records_after_dedup ] ... View more

Great! Please accept the answer and upvote any comment that has helped you arrive at a solution. ... View more

You already have a condition in your query where count > 10 , so your query will return a result only if count is > 10. ... View more

The number of rows would differ once you have removed the duplicates, instead use a multi-valued field - <your search> | eval record_new=lower(records) | stats values(records) as records,values(records_new) as records_after_dedup ... View more

Do you want ignore the case and remove duplicates? ... View more

You have to run it every hour on top of the hour - Run this for -1h@h to @h ... View more

Your query will return results only when the count is > 10 because of the where condition - sourcetype=marketops_cmva_extract_generator ORA-08103 | stats count | where count >10 Run this for -1h@h to @h and set the cron as 0 * * * * condition as number of events > 0 ... View more

Your query will return a result only when the host hasn't reported in last 30mins - | metadata type=hosts index=* | search host="nmshost01"| eval age = now()-lastTime | where age > 1800 | sort age d | convert ctime(lastTime) |fields host age lastTime Hence the condition selected should be "number of events" greater than 0. ... View more

Agreed! Your point on evicted and orphaned searches is transactions is right. Thanks for sharing the flowchart. ... View more

I agree that using stats can provide a performance improvement in this case, but transaction supports multiple field list - http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Transaction Optional arguments field-list Syntax: ... Description: One field or more field names. The events are grouped into transactions based on the values of this field. If a quoted list of fields is specified, events are grouped together if they have the same value for each of the fields. ... View more

You can use the | delete command to make the data inaccessible to the users. This won't free up space on the indexers though. http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Delete For this you need a user with can_delete role(if you already don't have then create a temporary user and assign this role) and then run the query to return all data and delete. index=tomcat earliest=0 | delete and delete the data. To permanently remove event data from a single index, type: $SPLUNK_HOME/bin/splunk clean eventdata -index <index_name> Details are provided here - http://docs.splunk.com/Documentation/Splunk/6.6.1/Indexer/RemovedatafromSplunk For freeing up space, remove any monitors sending data to this index, remove index configuration from indexes.conf, push bundle and delete the index directory from the indexers $SPLUNK_HOME/var/lib/splunk/tomcat . ... View more

Yes, use the below endpoint to get the list of indexers from any search head - | rest /servicesNS/-/-/search/distributed/peers splunk_server=local | table title host_fqdn OR curl -s -k -u admin:password https://<search_head>:8089/servicesNS/-/-/search/distributed/peers ... View more

Great!! 🙂 ... View more

Can you check if the input app has reached the forwarders $SPLUNK_HOME/etc/apps directory? You can check the list of monitors on any forwarder by running this - $SPLUNK_HOME/bin/splunk list monitor -auth admin:password ... View more

Can you provide a sample of your data and the output you are expecting? ... View more

Ops, I didn't read the question body. Yes the above search gives all scheduled searches in a dashboard. Use below one for the scheduled searches that aren't used - | rest /servicesNS/-/-/saved/searches splunk_server=local | where is_scheduled=1 AND disabled=0 | rename "eai:acl.app" as app| table title app is_scheduled next_scheduled_time disabled | rename title as savedsearch_name | join savedsearch_name type=left [ | rest /servicesNS/-/-/data/ui/views splunk_server=local | table title eai:data eai:acl.app | rename "eai:data" as source | rex max_match=0 field=source "\<param\sname\=\"savedSearch\"\>(?<savedsearch_name>[^\<]+)" | rex max_match=0 field=source "searchname\"\:\s\"(?<savedsearch_name>[^\"]+)" | rex max_match=0 field=source "search\s*(id=\"\w+\")?\s*ref\=\"(?<savedsearch_name>[^\"]+)" | rex max_match=0 field=source "\<searchName\>(?<savedsearch_name>[^\<]+)" | search savedsearch_name=* | table title savedsearch_name | rename title as dashboard_name | mvexpand savedsearch_name ] | search NOT dashboard_name=* ... View more