Try this index=main event=sso status=success ip!=10.0.0.0/8 | regex subject=^\D\d+$ | iplocation ip | stats dc(Country) as Country_count values(Country) as Countries by subject | sort 5 - Country_count ... View more

Sure it is possible, you can change license to "Free license" under Licensing menu in Settings tab and stored data will not be lost (such easy way only for all in one installations!). But you will face limitations of free license like access control, usage of distributed environment, daily data volume and etc. You can read here more about Splunk licenses and limitations of free license http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/TypesofSplunklicenses ... View more

Maybe transaction command can help you you can use startswith=EventCode=13 and endswith=EventCode=1100 arguments also transaction command generates duration field(difference between first and last event) and you can search transactions where duration>=15 Full description of transaction command http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Transaction ... View more

Hello, deepak02 You should use tokens set token in table from which you pass token like this <drilldown> <set token="open_table">$row.field1$</set> </drilldown> add depends option to panel which you would like to show <panel depends="$open_table$"> Please mark answer if it was useful! ... View more

Hello, leomedina It looks that you should correct stats statement because now you count the same in first search and after append 1. index=datapower ApplicationName="mpgw(OAuth-subscription)" "HTTP response code" ... | stats count as Success by ApplicationName 2. [search index=datapower ApplicationName="mpgw(OAuth-subscription)" "HTTP response code" | stats count as Errors by ApplicationName] but rename in different ways Success and Errors May be you should try something like this to specify some way in first case only success and in second only errors index=datapower ApplicationName="mpgw(OAuth-subscription)" "HTTP response code" | lookup http_response_codes.csv response_code OUTPUT description | search description="*success*" | stats count as Success by ApplicationName | append [search index=datapower ApplicationName="mpgw(OAuth-subscription)" "HTTP response code" | lookup http_response_codes.csv response_code OUTPUT description | search description="*error*" | stats count as Errors by ApplicationName] ... View more

Can you add sourcetype value using field picker to your search? ... View more

Hello, TiagoTLD1 By default splunk searches index=main (default index) so it may be the reason of such behavior ... View more

Hello, pprakash2 If I understood your question you woul like to show or hide panels depending on selected values to accomplish it you can use tokens in drop-down list <set token="slector1">$selector1$</set> (and unset as well) and depends option for panels <panel depends="$selector1$"> ... View more

You can use Deployment server to manage agents(fowrwarders) which usually phoning home to deployemnet server to know agent status you can use following search and configure alert for specific host index=_internal (phonehome component=DC*) OR (component=DC:HandshakeReplyHandler) host=hostname | sort _time | table _time host log_level message it is from https://answers.splunk.com/answers/208607/how-to-determine-if-forwarder-is-phoning-home-to-d.html ... View more

Hello, dhawal_sanghvi According my experience, you should create summary indexes on both layers on search heads and on indexers. If you create summary searches only using deployer it is not necessary to have indexes on search heads but in case of creating summary searches using web-interface it is necessary to have summary indexes on search head layer otherwise splunk can not find summary index to write summary data and will not allow save the search. To manage indexers(search peers) you should use Cluster Master use Deployer only for Search Head management. You can copy stanzas with your summary indexes from indexes.conf of search head layer (usually they are on deployer) and create custom app with these stanzas( or extend existing) on Cluster Master. So it is not necessary to do something special on Captain. ... View more

search | top port by priority | chart values(port ) over port by priority ... View more

Hello, deepthi5 You can specify fields to write in summary index using | table command. About retention period It could be specified in indexes.conf using parameter "frozenTimePeriodInSecs" frozenTimePeriodInSecs = . ... View more

Hello, niketnilay I change in my css following code /it changes both scale and current number fonts/ element.style { } text { font-size: 20px !important; } to svg text:last-child{ font-size: 30px !important; } but no changes, gauge is with original font. Using Developer mode in Chrome I picked object and found following for scale font but not "svg text" element.style { color: #555555; font-size: 11px; fill: #555555; } text[Attributes Style] { text-anchor: end; } user agent stylesheet text { white-space: nowrap; } user agent stylesheet text, foreignObject { display: block; } user agent stylesheet * { transform-origin: 0px 0px 0px; } Inherited from svg Style Attribute { font-family: "Lucida Grande", "Lucida Sans Unicode", Arial, Helvetica, sans-serif; font-size: 12px; } ... View more

Is it possible to increase font size in tables when generating pdf similar way? ... View more

Try to use this add-on https://splunkbase.splunk.com/app/1794/#/details You can send email based on search results using lookup as list of email receivers. ... View more

May be this help using stats with eval | stats latest(eval(if(like(_raw,"%end_event_specifier%"), _time, NULL))) as endtime by emailID ... View more

May be the best way for you is to use search macro. https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesearchmacros ... View more

May be this answer will help https://answers.splunk.com/answers/331535/how-to-create-a-user-role-with-capabilities-to-man.html ... View more

I created new role by adding "edit users" and "edit roles" capabilities to user role and created user with this role after that I followed link to edit users and edit roles peges. It really works this way but only for "Edit users" tab and [Processing error] "Default app inherited from" column at admin user little confuse me. Tab "Edit users" opens with error message "There was an error retrieving the configuration, can not process this page." ... View more

Hi, richgalloway if I add some capabilities to user roles I do not see Access Control section in Settings menu at all ... View more