I want to group usage into ranges like 0-1, 1-10, 10-50 , 50-100, 100 + and display a bar chart with count against each of the band. For example: 0-1 50 users, 1-10 100 users and so on... Here is the query: | pivot Accounting Accounting sum(Input) AS "Inp" SPLITROW _time AS _time PERIOD hour | eval tot_d=round(Inp/10,2) | stats sum(tot_d) as "Usage" Thanks in Advance. ... View more

Here is my search | tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h , Accounting.User_Name | eval tot=round((Inp+out)/100,2) | timechart span=1h sum(tot) as "Total" | sort -"Total" limit=500 by Accounting.User_Name Definitely not working. But the intent is to list the total usage by top 500 users total (input + output) at any given time. I am going to combine this graph with one having overall total that is (input + output) of all users at any given point. That query is working (for reference) | tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h | eval tot=round((Inp+out)/100,2) | timechart span=1h sum(tot) as "Total Usage" I need to combine these 2 queries to form a single graph to show usage by top 500 users and overall usage. ... View more

I wanted to accelerate my searches so I am using data models and pivot. | pivot Accounting Accounting sum(Input) AS "Input" sum(Output) AS "Output" dc(User_Name) AS "Distinct Count of User_Name" SPLITROW _time AS _time PERIOD hour SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 I want to do a simple sum(Input)/10000 as "input" (Division by 10000) that's all. I tried using stats before the sum and also eval, but it does not work on a pivot. How can I do this? ... View more

Can maps be plotted using IP address instead of coordinates? How can I use the IP address to plot a location in a map? ... View more

I am trying to display the top 5 memory used values by command - Meaning the top 5 commands with maximum usage, but I seem to be unable to get the output. Here is my search: index=os sourcetype=ps host=xyz | eval RSZ_MB=RSZ_KB/1024| stats max(RSZ_MB) as "Memory_Used" by COMMAND | sort -Memory_Used | top 5 Thanks, Sushmitha ... View more

I downloaded this app and am using this... It is simply awesome !! I was trying the "Link switcher" in this app, and it has one xml and three .js scripts in source code section. I do not know where to place, or write the .js scripts. I can only see an option for xml code while writing dashboard scripts. Could you please help? ... View more

Here is an amazing visual report I found for *.nix app. I am actually developing something very similar to this, but this report sets the bar to a totally different level. 1. I have no clue how to combine memory, CPU and IO on the same graph 2. How to set threshold on each item 3. An open in search for each Does someone know how to develop a form to do the same? Even something providing 50 % of what is available would be great... ... View more

I am trying to populate an input field using the following lines in XML dashboard source <populatingSearch fieldForValue="host" fieldForLabel="host"> <![CDATA[|metadata type=hosts index=os host="ABC*"]]> </populatingSearch> I am adding host="ABC*" for it to display only host names having ABC, but it is still displaying all the host names. How do I make it display just ABC host names? ... View more

I am trying to figure out how to retrieve the most recent value for the free memory and used memory in MB. I want to plot them in a pie chart to get an accurate picture of memory usage, instead of a timechart that gives usage over a period of time. How should I get recent value of the fields? Search: index=os sourcetype=vmstat host=$host$ | timechart median(memFreeMB) as Mem_Free, median(memUsedMB) as Mem_Used by host ... View more

I want to get these 2 types of graphs. I am getting data using splunk on unix app. 1. As in the image in this link, I want a box showing overview, where I can just write the number of servers for example: 10 servers, 300000 records indexed etc. Link : https://splunkbase.splunk.com/app/491/ A disk like graph for displaying CPU memory utilization. Link: http://blogs.splunk.com/2013/10/02/splunk-for-unix-6-0-is-finally-here/ I know sparkline , line and other graphs, but do not know how to get this one. Thanks, Sushmitha ... View more