Let us try: sourcetype=blah "Execute Method" OR "WriteToDB procedure" OR "Out of memory"|stats count as "Total_Error1"|table Total_Error1]|append [|search sourcetype=blah "Execute Method" OR "WriteToDB procedure" OR "Out of memory"|stats count as Error1 by host|table host,Error1]|append[|search sourcetype=blah "The operation has timed out."|stats count as "Total_Errors2"|table Total_Error2]|append [|search sourcetype=blah "The operation has timed out."|stats count as Error2 by host|table host,Error2] Ugly, but we can have better one if we can have some logs. ... View more

Provided you are having the fields correctly extracted, you can have |Timechart avg(TotalSeconds) OR Chart avg(TotalSeconds) by GmtDateTime. Just a table GmtDateTime,TotalSeconds. where your primary axis should be GmtDateTime and TotalSeconds can be secondary axis in module for dashboard |Timechart span=30m avg(TotalSeconds) I have updated the answer, hope it works. ... View more

Yeah It's fine. So i suppose you are setting the alert for the stopped things.You can set the alert per result and make the throttling condition. It will send you individual results or vise versa. The no of results should be set accordingly to satisfy the alert condition. I had the same reason to comment out the definition in py file. It is awkward for a end user to see such message and panic. ... View more

So did the search gave you the result? |Timechart Operation,Administrative ... View more

Yes working very well. NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false TIME_FORMAT=%Y%m%d|%H%M%S TIME_PREFIX=\|(?=\d{8}) ... View more

Are you taking about splunk web port/splunkd port? You can specify all of them according to your wish. Then you can it for your access on those ports. ... View more

count(eval(match(Grupo,"admin,helpdesk"))) in the part "Grupo" is a field or a typo error in the search? And i suppose Operation/Administrative are fields!!! You should put |Timrchart Operation,Administrative ... View more

Chhaya, if you are having problem with the search you can actually use the props.conf/transforms.conf as Ayn has suggested. I don't have the log with me so cant create the perfect matching. You can also do |rex .. .. |rex .. . |eval Newfield=field1." ".field2 OR directly get the fields and concatenate extracted from props.conf. Hope it clarifies.. ... View more

If you are not having field names, you can use _raw for calculation. You can make a |mvexpand _raw|rex field=_raw "? \d+.\d+" ... View more

If the regex statements are matching the required field values, you can write it in a single statement. host="sharepoint" | rex field=message "(?i)\b exception\b:\s(?P<Field1>[^\)]+Exception)\:"(?<=[Errorlfailed]\: )(?P<Field2>[^\)]+Exception:)" | table Field1,Field2 You can also do it in the splunk UI field extraction window ... View more

Does the log starts with the time field? Could you paste a little more of the log? ... View more

Now i got you. Please use the Alert condition "if number of events" > 0 in the Splunk UI savedsearch section. You can also add the below condition to the savedsearch.conf as well: quantity = 0 relation = greater than ... View more

May be for the time being or may be not if it's a realtime job till it expires. You don't need to modify anything else. If your alert condition is met the result will come in the mail or you won't get the alert. I had suggested the option to comment out as it looks awkward in a mail,that's it. ... View more

I have added another query, this the best i can think as of now. ... View more

Hello, Both of them are possible. Please follow the Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/savedsearchesconf Using savedsearch.conf you can schedule your report, and send the reports in several format. You can also write your own scripts to customize the report views. ... View more

DO you want automatic report/alert or want to send manually just to test from search app? ... View more

sendmail.py is the default python program that sends mail. You don't have to terminate the process. Instead you can write your own script for sending alert. The message level WARN is just a default statement in the script file which included the message to the mail body. You need to check for the indexer i.e. your search peer status why it didn't initiate the search. Other than that everything works fine as long as you get the result. This gives errors to me when any real-time alerts are set and they keep the error result with it till it's fired. Thanks ... View more

Updated the answer, but it's not the same as you gave in the question ... View more

Hello, Please try this. There may be other answers but i do like this. Sourcetype=blah|rex field=_raw "(?<evt>(?=\s).+)"|eval t=split(evt,",")|mvexpand t|rex field=t "(?<Root>(?!/)\w+(?=/))"|stats count by Root,t|rename t as URL 2nd option: sourcetype=blah|rex field=_raw "(?<evt>(?=\s).+)"|eval URL=split(evt,",")|mvexpand URL|rex field=URL "(?<Root>(?!/)\w+(?=/))"|eval Timestamp=strftime(_time,"%d/%m/%Y %I:%M:%S %p")|Table Timestamp,Root,URL|eventstats count(URL) as count by Timestamp,Root|dedup Timestamp,Root Thanks ... View more

is the log contains the time/ its just /root1/url,/root2/url,/root2/url ? ... View more

GIF file in Internet explorer/ PNG file in Chrome what i had tested ... View more

Yes that's the purpose of the alerts. Please mark it as answer if it solved the problem. ... View more

Did you check the service under which account it's running? The folders are they having all the required access under the account where splunk is running? Always take a backup of "etc" folder before doing any changes to the instance. ... View more

You can use | bucket _time span=5m / bin to group events time wise. ... View more