Hi, I have set up a couple of alerts and have chosen an inline table in the subsequent email. The contents of that table, however, seem almost totally random. Does anyone know where those fields come from and how they can be changed? I can see a display.events.fields setting in savedsearches, but I don't know if this has any bearing on it nor where the current fields in there came from. If I change them, it doesn't affect the content of the alert email. The search is simply looking for values over a particular numeric threshold: sourcetype=dbcsv | eval percent_used=((LogFileSizeMB/DataFileSizeMB)*100) | eval percent_used=round(percent_used,1) | search percent_used>90 Ideally I'd like the email to contain a table that I can produce on a dashboard: _time, DataFileSizeMB, LogFileSizeMB, percent_used Thanks. ... View more

Hi, I'd like to show how many events (logins in this case) occur on different days of the week in total. So (over the chosen time period) there have been 6 total on Sundays, 550 on Mondays, y on Tuesdays etc. So that's a total for each day of the week where my x axis would just be Monday to Sunday with a total for each one. Actually I need a total for each machine type per day of the week where there are 4 machine types. If I use timechart then it does the job per day for every day back tot he start of the time range but that's not what I'm looking for We wantt o look at usage patterns through the week. So root search | timechart span=1d count by CPS usenull=0 give me a count per day per login type (CPS) I want a chart for total numbers of logins per CPS per day of the week since the start of the time range. Thanks.. ... View more

Hi, We have the database connector v2 running on a hf talking nicely to a couple of sql servers. There's a couple of sql admin value they want to get from the servers as in database and log file sizes. None of the queries I found on the internet get the value and it looks like that's because the account in use would need a higher level of access that they don't want to provide to that account. It has datareader level access. I found this solution use "db_name" exec sp_spaceused And that works with this level of access but I have to set one up for each of the mul;tiple databases individually and would require manual intervention when a new database is added. There's supposedly this one but it doesn't work for me: EXECUTE sp_MSforeachdb 'EXECUTE sp_spaceused'. I get 'the statement did not return a result set'. So if anyone has any ideas of how to get this infomormation for multiple databases with that level of account access that would be great. Please doni't advise to install the sql app as it's not compatible with db connector v2 and the advise I was given on a previou post in here was to install the db connector v1 and hf software onto the sql servers themselves and that't not going to happen. Thanks. ... View more

Hi there, When I try to apply my newly acquired SSL certificate to Splunk Web then restart, it just hangs and won't start the web server. Sequence of events was: I raised a csr and gave to the server guys to obtain a certificate. They provided a link from where I download the cert in x509 format as a .crt file with an intermediate certificate too. I combined these to into one pem file with the server cert at the top and intermediately underneath it as I read on Splunk website. I took the password off the original key and placed it and the new pem file into etc/auth/splunkweb I edited web.conf and pointed it at the key and cert files per docs Restarted Splunk Web, but couldn't connect, so I restarted Splunk and it runs through and hangs when trying to start the web server, indefinitely. Check the web service log and nothing. Based on my steps have I done something wrong? Thanks. ... View more