If you set the coldToFrozenDir attribute in indexes.conf, the indexer will automatically copy frozen buckets to the specified location before erasing the data from the index. So the data still resides on the location you specified on the disk. If you don't specify either of these attributes(coldToFrozenDir or coldToFrozenScript), the indexer runs a default script that simply writes the name of the bucket being erased to the log file $SPLUNK_HOME/var/log/splunk/splunkd_stdout.log. It then erases the bucket. Reference : http://docs.splunk.com/Documentation/Splunk/6.3.1511/Indexer/Automatearchiving ... View more

Your question is too general to answer for splunk. However, you can update your lookup files using a scheduler. Run a scheduled script every month and download the details to lookup location of splunk , for eg: in linux use a script to run a curl command. It's recommended to take a back up of your previous file before updating it. In case you want the data to be indexed instead of lookup, use splunk's input method with custom scripts. ... View more

Have you tried if or case from http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Commonevalfunctions Eg: ... | eval description=case(error == 404, "Not found", error == 500, "Internal Server Error", error == 200, "OK") ... View more

You can use join, transaction, or simply stats to obtain this. Join: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Join Example: index=a source=abc ... | join referenceid [search index=b source=xyz ....] Transaction: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Transaction Example: index=abc sourcetype=access_* | transaction referenceid maxspan=30s maxpause=5s Stats: https://answers.splunk.com/answers/204782/how-to-join-two-search-events-that-have-a-common-f.html Example: A OR B OR C | stats values(Name) as Name, values(IP) as IP,values(Email) as Email by referenceid Also refer to http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Commandsbycategory ... View more

Yes it's possible in HTML. Easiest way is to create it in xml and convert it to html Here is an example of adding a dropdown to existing html dashboard. Add div tags for the element <div class="fieldset"> <div class="input input-dropdown" id="input1"> <label>MyLabel</label> </div> </div> Add a search to populate the drop down. You can skip it if you have only static values var search2 = new SearchManager({ "id": "search2", "latest_time": "now", "earliest_time": "-24h@h", "cancelOnUnload": true, "status_buckets": 0, "search": "index=*|stats count by sourcetype", "app": utils.getCurrentApp(), "auto_cancel": 90, "preview": true, "runWhenTimeIsUndefined": false }, {tokens: true}); Create the element and add a function to handle dropdown change. Static values can be added in choices var input1 = new DropdownInput({ "id": "input1", "choices": [ {"value": "*", "label": "All"} ], "labelField": "sourcetype", "selectFirstChoice": false, "default": "*", "valueField": "sourcetype", "showClearButton": true, "searchWhenChanged": true, "value": "$form.srctype$", "managerid": "search2", "el": $('#input1') }, {tokens: true}).render(); input1.on("change", function(newValue) { FormUtils.handleValueChange(input1); }); If you don't have dynamic values managerid can be removed which has a reference to the previously created search . Please refer here for more details : http://dev.splunk.com/view/webframework-htmldashboards/SP-CAAAETK ... View more

Try adding a different field name instead of user for field extraction and then use a field alias to link both http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addaliasestofields ... View more

You have to amend the JS and xml file according to your requirements. By default : A. The visualization assumes that your field name is count. If your field name is different, then either change the field name to count or change the table_icons_inline.js to adjust the field name as below canRender: function(cell) { return cell.field === 'count'; }, B. The visualization assumes that your table id is table1. Ether change the table id to table1 or change the files custom_table_icon_set_inline(LINE 6) and table_icons_inline.js(line 34) to adjust the table id as below. table_icons_inline.js mvc.Components.get('table1').getVisualization(function(tableView){ custom_table_icon_set_inline.xml <row> <table id="table1"> <title>Render Icons based on rangemap result</title> C. The visualization sets the icons based on these values if(count > 3000) { icon = 'alert-circle'; } else if(count > 1000) { icon = 'alert'; } else { icon = 'check'; } If you have another range the table_icons_inline.js (line 18) to accommodate your changes. Once all changes are done, copy the js and css files to $SPLUNK_HOME/etc/apps//appserver/static and refer it in your xml () and refresh your web or restart splunk web to take effect the changes. Hope this helps to some extent. ... View more

Try this <your search to get details> | stats sum(<your data amount field> by domain ... View more

Try index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*|stats count by CLIENT_ID Start referring to http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/SplunkEnterpriseQuickReferenceGuide as well ... View more