My logs are coming from different time zone, that is ahead 4.5 hrs. I know I can't specify the time zone in Universal Forwarder so I added in my propes.conf [host::maa1devbld32] TZ = Asia/Kolkata now when I search log last 12 hrs, I can't see any log but in All Time I can see everything. So How to convert log view to my current time zone. ... View more

I am using free version of Splunk and its working fine. Is it possible to use same time as a forwarder also? so same log file data set I can use in main instance and forwarded instance. ... View more

I am using Universal forwarder to send data to main Splunk instance to monitor files/directories. What is default interval to send data? How do I change this interval for x seconds to y seconds? ... View more

How to get rid of "No matching fields exist" message id there is no result? ... View more

When I issue following command I'll get some result savedsearch=list_ini but If I issue below command I didn't get any result savedsearch list_ini Here is my savedsearch.conf in default directory [list_ini] is_visible = false search = sourcetype=ini Similarly If I use savedsearch command in Advanced XML I'am getting following error. The saved search transaction_success_telnet cannot run as part of a search as it contains non search commands. Please use the savedsearch command. Here is the saved search for transaction_success_telnet [transaction_success_telnet] is_visible = false search = sourcetype="LOG" COUNTERS | streamstats first(OFS_SourceType) as OFS_SourceType, last(AUTHORISER) as AUTHORISER, last(DATE_TIME) as DATE_TIME, last(INPUTTER) as INPUTTER, last(CURR_NO) as CURR_NO | table MessageID, OFS_SourceType, AUTHORISER, DATE_TIME, INPUTTER, CURR_NO | where OFS_SourceType="TELNET" Advanced XML ..... ..... <param name="staticFieldsToDisplay"> <list> <param name="value">savedsearch=transaction_success_session</param> <param name="label">SESSION</param> </list> <list> <param name="value">savedsearch=transaction_success_batch</param> <param name="label">BATCH</param> </list> <list> <param name="value">savedsearch=transaction_success_globus</param> <param name="label">GLOBUS</param> </list> <list> <param name="value">savedsearch=transaction_success_telnet</param> <param name="label">TELNET</param> </list> </param> ........ ........ can anyone tell me what is right way to use savedsearch in advanced xml? ... View more

I want to change the search string based on my dropdown, How do I? e.g. Dropdown contains following Items-> TELNET, SESSION, USER, GLOBAL if type=TELNET sourcetype=src_telnet | stats ... | table * | rename ..... | where .... else if type=SESSION sourcetype=src_session | stats ... | table * | rename ..... | where .... so on... I cant do replacestring because my search is completely different from each other. How can I do this in advanced XML? Thanks ... View more

How splunk will decide for date/time in _time field? I am getting strange date/time. In first event I don't have any date/time information splunk will use event generate date time. In second event I have several date/time field splunk pickup date from one of the field and for time it is using event generate time. Is it right behavior? If I want educate to splunk on specific date/time based on the eventtype, What should I do? ... View more

Whats wrong in my xml? <fieldset autoRun="true"> <input type="time" searchWhenChanged="true"> <default>Last 12 Hours</default> </input> <input type="dropdown" token="JT_JOB_ID"> <label>Select Job ID</label> <populatingsavedsearch fieldForValue="JT_JOB" fieldForLabel="JT_JOB">cob_job_list</populatingsavedsearch> </input> </fieldset> myapp/local/savedsearches.conf [cob_job_list] is_visible = false search = eventtype=counters_jt | table JT_JOB | dedup JT_JOB | sort JT_JOB ... View more

in my form based dashboard panel I am filling a drop down <fieldset autoRun="true"> <input type="time" searchWhenChanged="true"> <default>Last 12 Hours</default> </input> <input type="dropdown" token="JT_JOB"> <label>Select Job</label> <populatingSearch fieldForValue="JT_JOB" fieldForLabel="JT_JOB"> <![CDATA[eventtype=counters_jt | table JT_JOB | dedup JT_JOB | sort JT_JOB ]]> </populatingSearch> </input> </fieldset> above search will take too much time based on my time criteria. e.g. for last 12 hrs it'll take 15 to 20 seconds the problem is I have more then 10 panels like this and this is big a pitfall for performance. Is there any way to store this result and load this when my panel activate or any other alternate? Thanks ... View more

I have a dashboard and in this dashboard I can provide search criteria in two way. mysearch savedsearch Which one is best approach? I can achieve my goal with both of them but just want to know is there any performance improvement? Thanks ... View more

How Do I display default search app in my app? http://mjserver:8000/en-US/app/search/dashboard_live Within my app I want to show dashboard_live and display all data(SourceType, source, host, etc..) related to my apps only Thanks ... View more

How to display a chart with raw data e.g. mysearch | table MyCount | timechart MyCount or mysearch | table MyCount | chart MyCount by _time I don't want to calculate avg/count etc... just want to create a chart with whatever data I have Thanks ... View more

My XML for form based dashboard panel is <form> <label>Job Statistics</label> <fieldset autoRun="true"> <input type="time" searchWhenChanged="true"> <default>Last 7 Days</default> </input> <input type="dropdown" token="JT_JOB_NAME"> <label>Select Job Name</label> <populatingSearch fieldForValue="JT_JOB_NAME" fieldForLabel="JT_JOB_NAME"> <![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB_NAME | dedup JT_JOB_NAME | sort JT_JOB_NAME ]]> </populatingSearch> </input> <input type="dropdown" token="JT_JOB_NAME"> <label>Select Job ID</label> <populatingSearch fieldForValue="JT_JOB" fieldForLabel="JT_JOB"> <![CDATA[eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table JT_JOB, JT_JOB_NAME | where JT_JOB_NAME="$JT_JOB_NAME$" | dedup JT_JOB | fields - JT_JOB_NAME | sort JT_JOB ]]> </populatingSearch> </input> </fieldset> <row> <chart> <searchTemplate> <![CDATA[ eventtype=counters_jt | rex "(?i)^[^\[]*\[\w+\]\s+\[(?P<JT_JOB_NAME>[^\]]+)" | table _time JT_JOB, THROUGHPUT | where JT_JOB="$JT_JOB$" AND JT_JOB="$JT_JOB_NAME$" | timechart count(THROUGHPUT)]]> </searchTemplate> <label>Throughtput for $JT_JOB$ </label> <option name="charting.chart">line</option> <option name="charting.primaryAxisTitle.text">Time</option> <option name="charting.secondaryAxisTitle.text">Throughput</option> </chart> </row> </form> How Do I fill 2nd drop down based on first one? ... View more