In Splunk, you can show information which are present in logs (can't add extra information). If your logs have other fields like error message, error code, those can be extracted and displayed. If your logs just have stack trace, you may extract the function name/service/application name where it occurred and may show some statistics based on that. But, as I said earlier, it all depends on the information that you are logging. ... View more

This code (and myself) uses Sideview Util app, which provide much more simplified advanced xml for the dashboards. This app is available free in Splunk-base. The code should work after you install the same. ... View more

You got here what you're looking for. ... View more

There are many ways you can do this. index=charlesriver sourcetype=CrdApp_Events EVENT=LOGIN | bucket span=1d _time | stats count first(_time) as Date values(sourcetype) as st_vals values(Message_Type) as msg_type by USER |search NOT [search index=charlesriver sourcetype=CrdApp_Users | bucket span=1d _time | stats count first(_time) as Date by USER_NAME| table USER_NAME|rename USER_NAME as USER] index=charlesriver sourcetype=CrdApp_Events EVENT=LOGIN [search index=charlesriver sourcetype=CrdApp_Users | bucket span=1d _time | stats count first(_time) as Date by USER_NAME| table USER_NAME|rename USER_NAME as USER] | bucket span=1d _time | stats count first(_time) as Date values(sourcetype) as st_vals values(Message_Type) as msg_type by USER index=charlesriver sourcetype=CrdApp_Events EVENT=LOGIN | bucket span=1d _time | stats count first(_time) as Date values(sourcetype) as st_vals values(Message_Type) as msg_type by USER |join type=outer USER [search index=charlesriver sourcetype=CrdApp_Users | bucket span=1d _time | stats count first(_time) as Date by USER_NAME| table USER_NAME|rename USER_NAME as USER |eval exclude="Y"] |WHERE NOT exclude="Y" ... View more

One workaround to do this is to include a checkbox in the panel which says "Hide Results". When that checkbox is checked, not results are shown (query modified to return nothing). Its not same as hiding panel, but effect is same. Here is the example implementation. <view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html"> <label>Hide Panel Resutls</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="SideviewUtils" layoutPanel="appHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="Message" layoutPanel="messaging"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">1</param> </module> <module name="Search" layoutPanel="panel_row1_col1" > <param name="search"> YOUR MAIN SEARCH QUERY </param> <module name="Checkbox" layoutPanel="panel_row1_col1" > <param name="name">hideResult</param> <param name="checked">False</param> <param name="float">left</param> <param name="label">Hide Result</param> <param name="labelPosition">right</param> <param name="offValue"> |fields foo,bar #some random name so that no field is selected# </param> <module name="PostProcess"> <param name="search"> <![CDATA[ $hideResult$ ]]> </param> <module name="JobProgressIndicator" layoutPanel="panel_row1_col1"></module> <module name="Pager"> <param name="count">50</param> <module name="SimpleResultsTable"> ... </module> </module> </module> </module> </module> </view> ... View more

You can try this :- index=_internal | bucket span=1m _time | stats count by _time|fields - count |eval joinfield=1 | join type=outer max=0 joinfield [search sourcetype="someScr" download>0 |stats count by userName |fields - count |eval joinfield=1]|fields - joinfield |join type=outer max=0 _time,userName [search sourcetype="someScr" download>0 |bucket _time span=1m | stats count by _time,userName ] | eval count=COALESCE(count,0) |where count=0 |stats count by userName SEARCH UPDATED This should work now. In the first section I am taking all the _time value with 1 min interval (assuming you have access to _internal index which generally have data every minute). I am then joining that with unique list of userName which gives me _time and userName for every minute and every userName. Rest is same. Explaination: first portion of search (before join) will give a table with all the minutes (for selected timerange) and userName combination. So for 60m period and 3 users, this should give 180 events. the join inner query gives list of user and minute combination for which download > 0 (we don't worry about the count). This is joined left outer with first portion to give list of all minute and userName with corresponding count of events with download >0. For minutes where there was no download >0 (minutes for which there are not corresponding events in join subquery), the count will be NULL which will be converted to 0. Finally filter all rows with count =0 and get a stats of that. The format of final table will be different from what you are expecting. ... View more

For your step1. Formatting of id (assuming the format of the URL parameter is same as your example, means it contains "(" symbol. * |head 1| eval body="somestring(reverse)" | table body | eval body1=mvindex(split(body,"("),0) |rex field=body "(?<body2>[^(]+)" you can use any one of body1 or body2 for your formatting. ... View more

Following queries can be used for what you are looking for Total indexed volume by index |eventcount summarize=false report_size=true index=* | fields index count server size_bytes Indexed volume for any period index=_internal source=*metrics.log | eval MB=kb/1024 | timechart span=1h sum(MB) as TotalMB by series ... View more

Your search workes fine and provides false value as well for last_gt_now if lastTime is actually less than now. ... View more

It does suppport horizontal scrolling of the all columns don't fit into screen. Both Table and SimpleResult table support it by default. Would you mind sharing the xml you are using. ... View more

You can definitely do that. http://docs.splunk.com/Documentation/Splunk/6.0/Data/MonitorWindowsdata ... View more

You could add a Search module and a ResultValueSetter module to have a variable. The only thing to ensure here is the panel which will be using this should be defined within scope of this search and resultvaluesetter. This search will be hidden. <module name="Search"> <param name="search"> *|head 1| eval hostIp="$YourIPTextBoxName$" | table hostIp | lookup dnslookup clientip as hostIp |rename clienthost as HostName|table HostName </param> <module name="ResultsValueSetter"> <param name="fields">HostName</param> ... ... <module name="Search" layoutPanel="panel_row2_col1"> ...Your Search Code Here </module> ... ... </module> </module> ... View more

you might want to explore ShowHideHeader module. It provides options to show or hide the panel on click on the panel ... View more

Here is what you need to do: index=XXX sourcetype=XXXX externalAddress | eval joinfield=1 | join max=0 joinfield [|inputlookup country_to_ip |eval joinfield=1| fields startRange,endRange,country3,joinfield] | where externalAddress>=startRange AND externalAddress<=endRange | table _time,externalAddress,country3 ... View more

This seems to solve the issue. Thanks Kristian... ... View more

As per the splunk documentation, "OUTPUTNEW behavior has changed since 4.1.x (where none of the output fields were written to if any of the output fields previously existed)" ... View more

Ensure that field name is same in both the stanza. ... View more

This may perform faster |inputlookup host-list | table host | join type=outer host [search index=my_index earliest=-d@d latest=@d | stats count by hosts | rename hosts as host | fields - count| eval status="Responsive"]|eval status=COALESCE(status,"Unresponsive") | where status="Unresponsive" The inner search will fetch distinct host from which data is coming and they add a field status="Responsive". You join this with your lookup data by host and with outer join, un-matched hosts will have status=NULL that we are transforming as "Unresponsive". ... View more

Did you tried extracting LOGIN SUCCESS or LOGIN FAILURE using field extraction? ... View more

My splunk (Eastern Time zone) was able to parse as file kept on a machine in Eastern Timezone with MST. ... View more

For your ms removal requirement, your can use following eval command: |eval _time=strftime(_time,"%m/%d/%Y %H:%M:%S") ... View more