Hi, What is the size of UserDirectory information? If it is less than 1 Mil records, then lookup can work in your case. Thanks!! ... View more

Hi, Can this help? |rest /services/saved/searches | table author qualifiedSearch Thanks!! ... View more

Hi, Is this working for you? Thanks!! ... View more

Hi, Is this working for you? Thanks!! ... View more

Hi, Is this working for you? Thanks!! ... View more

Is this working for you? ... View more

Hi, You can try using dbquery command from DBConnect app. You can also combine the splunk commands once you get the results. http://answers.splunk.com/answers/121145/combine-db-connect-and-search-data.html More details @ http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands Thanks, Vishal ... View more

Hi, Does sorting on _indextime can help you? Thanks!! ... View more

Hi, Can this help? http://answers.splunk.com/answers/25008/as400-for-splunk-app-how-is-data-collected-on-the-as-400.html Thanks!! ... View more

HI, In above case, the group 3 has platform 1 only. So, do you want to retain only 1 in plats data? Thanks, Vishal ... View more

Can Iconify command help? More details @ http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Iconify Thanks!! ... View more

Hi, Can you please provide the First two rows from the lookup. First row will have header names and second will have sample data. Thanks!! ... View more

Can you please provide more details from the code point of view? Thanks!! ... View more

Hi, Is there any specific reason why you can't use just one search (if both the searches are working on same data set)? Also, you might want to check the subsearch limit as this might filter out events from the results. For reference @ http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Aboutsubsearches Thanks!! ... View more

You can try using lookup command. More details @ http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup Thanks!! ... View more

Hi, You can use custom search command for getting desired result. The custom search command is a python script which will get access to all the data result. Using small python code, this functinality can be achieved. More details @ http://docs.splunk.com/Documentation/Splunk/6.2.2/AdvancedDev/Searchscripts ... View more

Hi, You can try using custom search command. http://docs.splunk.com/Documentation/Splunk/6.2.2/AdvancedDev/Searchscripts You can copy over the field values in desired field by using string token. Thanks!! ... View more

Hi, If the field name is known upfront, then above solution work fine. But, if the field name is coming from dashboard user, then we dont have any direct way of fetching the field by using string token. e.g. following is the incidents occured in last 5 months. Jan | Feb | Mar | Apr | May 20 | 15 | 8 | 17 | 22 Now, the user can select any one of the month and it will be copied in a field "selectedMonth". What ever is the month selected, i.e. Mar, we want to pull the information from "Mar" field and display it to user. This is just an example. Using a custom search command, this can be achieved very easily, but wanted to check if this is already supported in SPL. Thanks!! ... View more

Hi, you can check the connectivity by writing a small program (in java) to check if the connection is permitted or not. Also, you can try going through the DBX Debug logs. Thanks!! ... View more

In some cases, we don't know what FieldName we want to search for. FieldName token is not available upfront. ... View more

Can you please provide the expected output? Thanks!! ... View more