Repeat question of http://answers.splunk.com/answers/235160/how-to-pass-the-values-from-django-view-to-python-1.html ... View more

Hi, As you are constructing week and month from now, following case will be always true now < week < month Also, for all the events, you will get same values for now, week, and month. Can you please explain what is required? If possible, share some sample events and what is the expected output. Thanks!! ... View more

Hi, Can you please validate is the predic1 is numeric? You can check it by command isnum. Thanks!! ... View more

Hi, You can try the answer mentioned @ http://answers.splunk.com/answers/232781/find-all-events-of-type-x-that-do-not-have-an-even.html#answer-234747 Its possible to generate the dynamic query depending on subsearches. Thanks!! ... View more

Can you please try any solution listed @ http://stackoverflow.com/questions/24528211/refused-to-execute-script-from-because-its-mime-type-application-json-is ... View more

This looks ok. What about stanza [mimetype-extension-map]? Can you please share the configuration? ... View more

Can you please share the server.conf settings for stanza [httpServer]? server.conf can be found @ splunk/etc/system/default folder. ... View more

HI, How about finding the different time ranges for every occurance of X and then use this to find all the events which do not have the occurance of Y within specified time range (i.e. 1 min in your case). Following query can give you some idea: index=_internal [ search index=_internal log_level="ERROR" | eval latestTime = (strptime(strftime(_time,"%m/%d/%Y:%H:%M:%S"),"%m/%d/%Y:%H:%M:%S") + (1* 60) ) | eval earliestTime = (latestTime-(1 * 60)) | table latestTime earliestTime | eval QueryToken = "(earliest=".earliestTime." latest=".latestTime.") OR" | stats values(QueryToken) as QueryValues | makemv delim="||" QueryValues | eval QueryFilter = substr(QueryValues , 1, len(QueryValues)-3) | return $QueryFilter] log_level!="WARNING" |chart count over _time by log_level usenull=f Following is the logic: Search for events which has log_level as ERROR (using subsearch) (this is filer X). Find out the latest time and earliest time for every event ( 1 min early an 1 min later). Construct the dynamic query filter which will have the different earliest and latest times (depending on the events from point 1) Use this dynamic query along with log_level!="WARNING" filter (i.e. not Y filter) for the main search. Hope this will help to solve the problem. Thanks!! ... View more

Can you verify if the result is missing due to subsearch limits? This can be verified from Search Job Inspector. Thanks!! ... View more

Can you try running the entire query against these 20 results? Ideally, the join should give you some result. ... View more

Hi, The app bar is loaded by AJAX calls. Can you please check if any JS error is coming? This can be tested in Chrome - console tab. ... View more

Can you please check if both the searches are returning valid results? Try to limit the result to 10 rows for testing. ... View more

Hi, The first query and subquery should have a field named audit. Also, there should be some correlation between these searches. Try outer join to see if there is any correlation between the data returned by both the searches. Thanks!! ... View more

Can you please provide the search query (which you executed mannually) along with the search which needs lookup changes? ... View more

Hi, You can try using eventstats instead of stats. Ideally, the join command expects one or many common fields on both sides of the command. i.e. first query should have "audit" field and the subsearch should also have "audit" field. Thanks!! ... View more

Is there any value of the CurrentPrice which is lesser than any of the VendorPrices? In current example, the current price value .3345 is largest among all the prices. Thanks!! ... View more

Can you please share the expected output? Thanks!! ... View more

Can you please share the sample table generated and what additional column you want to add (i.e. the table output from above query and expected table)? Thanks!! ... View more

Hi, You can try using addcoltotals command? More details @ http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Addcoltotals Thanks!! ... View more

Subsearch has a limit. If you are looking at large data set (events more thant 50,000), then subsearch will not work. Any specific reason why you want to use subsearch? ... View more

Hi, You can index the UserDirectory records (assuming that its size is small and will not consume too much splunk license). Then, you can set up a scheduled search to take the latest unique records from UserDirectory (i.e. latest unique 70,000 records). This schedule search will have outputlookup command at the end which will generate the lookup dynamically. Thanks!! ... View more

Hi deepthi5, What output you are getting? And what is the expected output? Thanks. ... View more