If I have selected 1 option in multiselect box, then it should display 1 panel. If i have 2 values selected in multiselect box as input, then it should display 2 panels. Is there any way to achieve it ? Queries remain the same ... View more

I am doing it using GUI as i dont have server access. I have lookup file serverrole.csv host,role,environment A,X,prod Lookup file is located :/splunk/etc/apps/mysearch /lookups/serverroles.csv Lookup definition is created : serverrole_lookup in supported fields it shows : host,role,environment Automatic lookup : serverrole_lookup host AS host OUTPUT environment AS env host AS host role AS role for sourcetype: perfmon:processor When I do search as : |inputllookup serverrole.csv it shows lookup file contents. But when I do search as : sourcetype=perfmon:processor | lookup serverroles.csv host,role OUTPUT host,role I am not getting role, environment fields in "Intresting fields" or "Selected fields" or in "Events".. I want search to work if i search : sourcetype=perfmon:processor| where role=X ... View more

I have this Splunk stanza below: [perfmon://CPUTime] interval = 30 object = Processor counters = % Processor Time instances = _Total disabled = 0 index = perfmon When I run this search, I get a result of around 50+% index = perfmon ( datacenter="iad" ) ( environment="prod" ) ( host="ms10191" ) ( counter="% Processor Time" ) ( instance="_Total" ) | eval name=host+"-"+counter+"-"+instance | timechart avg(Value) by name But when I check through the Performance Counter on the server, I am getting a value around 15-20% Is splunk showing wrong data? ... View more

My 1st search will be like this to get Peak Day and Peak Hour according to hits: earliest="06/08/2015:00:00" latest="06/14/2015:23:59" index=iis | stats count as hit by date_hour, date_mday | eventstats max(hit) as maxhit by date_mday | where hit=maxhit| sort hit desc|top limit=1 hit,date_mday,date_hour|fields date_hour,date_mday,hit Now after getting peak day and peak hour from the 1st result, using this peak day and peak hour, I want to run the search below: (earliest="result from above" latest="result of peak hour+1hr") index=perfmon host=web1 (counter="% Processor Time" OR counter="Get Requests/Sec" OR counter="Current Connections") |stats avg(Value) by host, counter Result should show Peak Hour, Peak Day, avg(Value), counter I have spent almost 2 days on this. Is it possible? ... View more

I am getting output for max hits at particular date and hour for a 1st search having index=iis . Now i want the date and hour from the 1st search to be input for 2nd search to find result for index=perfmon and show output fields of both searches. Is it possible? ... View more

We have 4 indexers in our environment and on each indexer there are different number of splunkd.exe processes. 1 Indexer has 3 while other Indexer has 5.. What is the reason for that? ... View more