Description: first stats will give list of all available storeNo, then join that with second subsearch to get PurchaseCount for storeNo (whatever is available). join that result with second subsearch to get ErrorCount. and finally calculate percentage. you can also add "|eval PurchaseCount=coalesce(PurchaseCount,0)" or something like that to assign default value where PurchaseCount or ErrorCount is not available ... View more

Can you try following sourcetype=production | stats count by storeNo|fields -count|join storeNo [search sourcetype=production eventtype="completedPurchase" | stats count as PurchaseCount by storeNo] | join storeNo [search sourcetype=production eventtype="totalErrors" | transaction host maxspan=3m | stats count as ErrorCount by storeNo]|table storeNo,PurchaseCount,ErrorCount|eval Perc=PurchaseCount*100/ErrorCount ... View more

You can try this sourcetype="userlogs" UserName=* "IncomeData SCV link" | stats count as "IncomeData SCV link" | appendcols [search sourcetype="userlogs" UserName=* "IncomeData started in" | stats count as "IncomeData started in"] ... View more

Extending the solution by "d", replace join by append to get all the rows (where either of the count is null) sourcetype=production eventtype="completedPurchase" | stats count by storeNo | append [search sourcetype=production eventtype="totalErrors" | transaction host maxspan=3m | stats count by storeNo] ... View more

You can use following for the Index dropdown search | eventcount summarize=false index=* index=_* server=$host$ Remove "index=_*" if you dont want to list internal indexes. ... View more

I don't see any direct way to increase this limit. I will investigate and will let you know if I find anything. ... View more

You can have only 49 panel rows in a dashboard ... View more

As far as I understand the requirement, there are two scenario Where a new account is created, two events (with same timestamp) is written EventCode=624 Message="User Account Created" and EventIdentifier=642 "User Account Changed" "User Account Control" "Account Enabled" When an account is enabled (just enable, not create), one event is written EventIdentifier=642 "User Account Changed" "User Account Control" "Account Enabled" and what you wish is the create table for events created for scenario 2 (account enable only) If this is correct, you can use following. (EventCode=624 Message="User Account Created") OR (EventIdentifier=642 "User Account Changed" "User Account Control" "Account Enabled" ) | rename New_Account_Name as Account_Name | rename Target_Account_Name as Account_Name| stats count by Account_Name, Caller_User_Name,_time | where count=1 ... View more

Try below search index=yourindex sourcetype=yoursourcetype...| timechart span=1d max(resources_used.ncpus) as "resources_used.ncpus" If you are using a dashboard, select the chart type as scatter. ... View more

Do you provide information to client using just the dashboards or do they have access to Splunk's default search app as well? ... View more

You can try changing your search-eval as mentioned below:- sourcetype="" | rex "Duration:s+((? d+)ds)?(? d+)h:(? d+)m:(? d+)s," | eval total=round(((days1440)+(hour*60)+(min)+(sec)/60),2) * |eval total_min = coalesce(total,0)** | stats sum(total_min) as TimeOnVPN by Username Coalesce function will take first non null value from total or 0. ... View more

Another method (which is more accurate then bucket) is as below:- sourcetype=TranData | eval Date=strftime(_time,"%Y-%m-%d %H") | stats count as "Transaction Count" by Date Problem with bucket is that if the query is executed in first 30 min, the base time to calculate may become :30. ... View more

+1 . Have similar requirement. ... View more

Could you please try below rex. "(?i)^(?:[^,]*,){7}(?P [^,]+)" ... View more

Try the below alternative (produces similar results as timechart) index=myindex sourcetype=processdata |chart max(duration) as duration over _time by ProcessName ... View more

Instead of splitting Customer rows into multiple lines for range from_date to to_date, I am doing join from the Multiplier events. you should get one record for each day between range from_date to to_date.[limitation will be that the Muliplier events should have data for all the date ranges present in Customer] ... View more

As part of step , did you change the permission for "name_of_my_dashboard" as well to exclude dashboarduser?? we should exclude only for flashtimeline and dashboard_live. ALso for any view that you have created which provides search bar. Your normal dashboards (which contains links 'View Result') should be made accessible. ... View more

YOu should create a new role with all capabilities similar to user. The capability search is required otherwise the dashboards searches also will not work. ... View more

You can change the sum to count in timechart command. This way it will show 16:2 in tooltip but the graph will also be adjusted to show just the count on y-axis. ... View more

Rename is for field names and you want to update field values, so that is not applicable for your case. You can use eval-replace if you know what are the possible strings you want to remove. Your example (changing "EXEC [usp_GetClientListHierarchyNode]" to "EXEC GetClientListHierarchy") can be achieve by following:- sourcetype="ContributionWebApi" DbQuery=* | eval DbQuery=replace(DbQuery,"\[","") | eval DbQuery=replace(DbQuery,"\]","")| chart count by DbQuery forward slash is escape character for brackets. you can add more eval-replace part for all your customizations. ... View more