Hello, I would assume all the events are different, so we can have the tid's first then you can have your calculations sourcetype="*Leg .log" tid |rex field=_raw "\stid\((?<TID>\d+)"|dedup TID|eval status = if(error == 200, "OK", "Error") Give it a try. Thanks ... View more

Hello, You could create two separate indexes. Use COLLECT command to pass that info into your required indices. But it will not be possible to divide the index further once it is created and data is in them. Before passing the events to the new indexes please read the documentation. _http://docs.splunk.com/Documentation/Splunk/6.0.1/searchreference/collect ... View more

What Mus is suggesting, the way you have extracted the fields from the events like the user,ip,port, the same you can include the router and the other field's info. ... View more

Hello, There are many ways. timechart ... |convert ctime(_time) will do it as well. But in Splunk 6 you will get it automatically. ... View more

Hello, If you mean to say the first letter after the extension starts then below will do it, source=..| rex field=filename "\\.(?<Flag>\S+)"|eval Flag=upper(Flag)|eval Flag=case(Flag="ZIP", "C", Flag="TAR", "T", Flag="CSV" OR Flag="TXT" OR Flag="PDF" , "U")|table filename,Flag Thanks ... View more

if you want the ceiling value then use eval ceil() function or the floor function. You can use an if statement you decide which whole number will be appropriate. or you can also do transfertime=toNumber(t%1000)... ... View more

what is the sourcetype provided? Try searching with that. And how do you get excel file when searching the csv file! ... View more

I have found something.. While doing | dboutput type=sql database=test table=minimom "update .." Irrespective of the update success/failure it always says no modification done!!! Is that a miss in the return statement from database query or something? ... View more

just updated the | "evan" handling_crew to | eval handling_crew ... View more

i had reported similar concerns.. ... View more

rate_movie_id and movie_id are related you will get the result or we are doing nothing with this query. ... View more

if you want it to be a dashboard variable why do you want it in the search? you can have some pulldown modules or textbox then with submit button form your query to run. i dont find any difficulty in this. |dbquery database=xxx "select $var1,$var2 from table" $var1,$var2 can be selected from pulldown or textbox.. ... View more

Yep, pretty sure. Even if they make it right, index=_internal makes no sense at all. ... View more

That i have already made, as the enduser may try different things. i came across this thing while testing it myself. ... View more

Important Update: When you use |dboutput on a read-only option in DB connect it does work and show that it is readonly database. But in the dbqyery view if you write it in the query window it doesn't and updates the table. ... View more

It doesn't come automatically Search with server:8000/en-US/app/search/flashtimeline_excel ... View more

|dbquery should be the first command, there shouldn't be any index=_internal or any other statement at all ... View more

Thank you for the suggestion, i have changed it 🙂 ... View more

how do you search the file? it is indexed or you are using any direct input method? ... View more

Why would you need that? you can use MAP command to search through the first result or manipulate it to get the final outputcsv result. Let us know the requirement. ... View more

the apps will give you the ready made dashboards, search, alerts. But if your search head is also containing the indexes that is fine. If you go to the distributed search option you could see the search peer. Each App also need not have the indexes.conf file to define their index, it may have been defined at some other place which will be used for the entire cluster. ... View more

Hello, There are some questions. Do you actually need to track/monitor the results of the job? How about the other searches? So when you create the scheduled searches there is a default parameter set dispatch.ttl =24h etc.. this value you can consider to be lower if you don't need the history any more. It will clear out the dispatch directory faster. The information still exist in splunk so you can search them out later. You may also consider cleaning them up manually if you can't control the job requirements. When you run real time searches scheduled by the admin itself it keeps running for ever and expires after a long time. Control the jobs according to your requirements: _http://docs.splunk.com/Documentation/Splunk/5.0.5/Admin/savedsearchesconf Take a look at this answer: _http://answers.splunk.com/answers/105478/too-many-search-jobs-found-in-the-dispatch-directory-found3079-warning-level2000-this-could-negatively-impact-splunks-performance-consider-removing-some-of-the-old-search-jobs ... View more

index will be resided in indexer if they are not the standalone indexer/search head on same machine. Generally the search peer i.e. the indexers will have indices, whose access you actually control from the search head. if you add it later your authorize.conf come to picture. Try keeping it in local directory. ... View more

yes, at last we want the value in search ... View more