using the suggest of somesoni2 I found the solution: tag=GP2 | stats count by code day | eventstats sum(count) as rank by code | appendpipe [stats values(rank) AS rank sum(count) AS totals by code ] | sort -rank code -count | fields - rank Thank you. ... View more

it's really close to my target but it isn't the solution: I obtained that results are grouped by code, but they aren't sorted by rank. In addition, I semplified the search I described in my question, in my search I have more fields in stats clause: tag=GP2 | stats count by code1 code2 code3 day | appendpipe [stats sum(count) AS Totals by code ] | sort code -count The way (if possible) could be to assign the value of the total for the field code to the rank ? Thank you. Giuseppe ... View more

It's a very simple search: tag=SM | transaction sourcetype Application maxspan=300s ... View more

Yes I know it, but I tested many situations to understand why my configuration doesn't work, note that it's the same described in the first example in docs Thanks. Giuseppe ... View more

yes: I inserted in all input stanzas: "_INDEX_AND_FORWARD_ROUTING=local" for locally indexed datas "_TCP_ROUTING=:9997" or remotely indexed datas but the situation is that: my HF doesn't indexes any datas both local and remote datas if I put "_INDEX_AND_FORWARD_ROUTING=local" in the default input.conf stanza, my HF indexes all the datas (the locally indexed and the ones to send to the remote indexer) and sends the remote datas to the remote indexer. Thank you. Giuseppe ... View more

in addition: if I put "_INDEX_AND_FORWARD_ROUTING=local" in the default stanza of inputs.conf, my HF locally indexes all the logs also the ones I'd like to only send to the remore Indexer. ... View more

I followed the Docs instructions but I found a problem: logs aren't locally indexed. I created a new outputs.conf with the described contents, I inserted in my inputs.conf the described lines: _INDEX_AND_FORWARD_ROUTING=local in local indexed log stanzas _TCP_ROUTING=:9997 in remote indexed logs stanzas but the result is that I don't have local indexing, where cound I search the problem? Thanks, Giuseppe ... View more

maybe it could be possible to extract hostname executing the alert search in a subsearch. I'll try this.. ... View more

I don't need to pass the hostname to an eMail as a token, my problem is to have it in a search that shows all the alerts triggered in a period. I have the triggered alerts list with a search like this: index=_internal source="/opt/splunk/var/log/splunk/scheduler.log" result_count>0 | table _time thread_id app savedsearch_name result_count | join savedsearch_name [| rest /services/saved/searches | dedup search | table author eai:acl.app title alert.severity is_scheduled id qualifiedSearch dispatch.earliest_time | rename dispatch.earliest_time AS timerange title AS savedsearch_name eai:acl.app AS app| fields author app savedsearch_name alert.severity timerange] ... But the problem is that hostname isn't in this search result. It's in the alerts result but I don't know how to connect this result to my search. ... View more

I have only one Search Head, but I'd like to have the hostname of the Universal Forwarder that sent the log triggered in the alert. I have it in my alert results but I don't know how to take it and insert in my dashboard that takes triggered alerts from "_internal" index and REST savedsearches. ... View more

Ok I extracted weekday and hours from _time using eval. thank you. Giuseppe ... View more

I have a close problem: I have to extract fields at index time to accelerate my searches (I have millions of events with 72 fields in each one) and a people from Splunk suggested to me to extract fields at index time to have a quicker search. When you say " ...a negative impact on performance..." you are speaking about indexing performance or searching performance? thank you. Giuseppe ... View more

maybe a way to proceed is to associate a timestamp to the lookup items, like: | inputlookup lookuptable.csv | eval _time=strftime(strptime(Data1,"%Y/%m/%d"),"%Y-%m-%d 00.00.00") but it doesn't work! ... View more

it doesn't work, but the problem is that calculating max and min is everyway very slow. The problem is that Splunk read all the events from the latest event to the earliest, so the "head 1" command is very fast, but istead the "tail 1" command is very very slow because the search starts from the latest event. If I could start the search from the earliest event, it will be very fast. Thank you. Bye. Giuseppe ... View more

this is a part of my dashboard Search log <input type="time" searchWhenChanged="false" token="Time"> <label>Periodo</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="Utente" searchWhenChanged="false"> <default>*</default> <choice value="*">All</choice> <search> <query>tag=GP2 | dedup MATRICOLA | table MATRICOLA | sort MATRICOLA</query> </search> <fieldForLabel>MATRICOLA</fieldForLabel> <fieldForValue>MATRICOLA</fieldForValue> </input> <input type="dropdown" token="Cliente" searchWhenChanged="false"> <choice value="*">All</choice> <search> <query>tag=GP2 | dedup ID_CLIENTE | table ID_CLIENTE | sort ID_CLIENTE</query> <earliest>$Time.earliest$</earliest> <latest>$Time.latest$</latest> </search> <prefix>ID_CLIENTE="</prefix> <suffix>"</suffix> <fieldForLabel>ID_CLIENTE</fieldForLabel> <fieldForValue>ID_CLIENTE</fieldForValue> <default>*</default> </input> <input type="text" token="esclusione"> <label>Esclusione</label> <prefix>NOT (</prefix> <suffix>)</suffix> <seed>Termini da escludere</seed> </input> <table> <title>Log elaborati</title> <search> <query>tag=GP2 MATRICOLA="$Utente$" $Cliente$ $esclusione$ | table TimeStamp Data_Acq Esito SS Operatore Postazione IDCliente TipoCliente Operazione</query> <earliest>$Time.earliest$</earliest> <latest>$Time.latest$</latest> </search> <option name="wrap">false</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="count">20</option> </table> ... View more