Hi Splunkers I have two searches I want to compare, but unfortunately can't find my way around it. First is: CPU load by host index=os sourcetype=cpu host="$selectedHost$"| multikv fields pctIdle | eval Percent_CPU_Load = 100 - pctIdle | timechart avg(Percent_CPU_Load) by host and second: System load by host index=os sourcetype=vmstat host="$selectedHost$" | multikv fields loadAvg1mi | timechart avg(loadAvg1mi) by host | sort _time Can anyone help me here or point me at the right direction? Thanks in advance best regards Mike ... View more

Hi splunkers, I have a pulldown with a selection oft host, which will be passed down to three different tabs. Is it possible to create panels and Charts oft each tab individually? Amy reference would be greatly appreciated. Cheers Mike ... View more

Hi, currently I am having problems passing a value in sideviews from a pulldown and switcher to a tab in order to execute a search. I created a html module to check if it will be displayed there and so far that worked out. But I want to get that value depending on the selection within the pulldown and switcher module get passed to the tab. Is that possible? Please find below a screenshot. Thanks in advance for your help. regards Mike ... View more

Hi, I keep having problems in sideviews when editing a view. Especially after I add a module like a search. Normally I would add a table to it, but the search module isn't showing which I need in order to add the table. Same goes with editing values of module, after saving the changes were applied but the values displayed haven't. I already tried different browsers like IE, Chrome, Firefox and Safari but none are 100% working and therefore keep switching. Did anybody experience that as well and may be able to provide a solution to this? Thanks in advance Cheers Mike ... View more

Hi, I created an app and want to output the csv to the directory of the app. From what I read in the docs http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/AppIntro it should be possible, but somehow it still outputs the file to /var/run/splunk But according to this post http://splunk-base.splunk.com/answers/1207/outputcsv-can-i-tell-it-where-to-create-the-csv there is no way, but for that reason I created an app. Any help would be greatly appreciated. Regards Mike ... View more

Hi, right now I am having trouble exluding characters like "/, :, 0-9" from my search. I want those excluded I think best would be to look at the end of the name and if there is a "_" or a "/" then cut that and everything behind it so I can count the services for each host. -bash [aio/0] [aio/1] [aio/2] [aio/3] [async/mgr] [ata/0] [ata/1] [ata/2] [ata/3] [ata_aux] [bdi-default] [bond0] [cpuset] [crypto/0] [crypto/1] [crypto/2] [crypto/3] What I want to see for example is "[aio]" and this search worked but I can't figure out how to add more characters to it. sourcetype=ps OR sourcetype=top COMMAND | multikv | makemv delim="/" COMMAND Can anyone help me here? Thanks in advance and best regards Mike :::::::::::::::UPDATE::::::::::::::: I made something that worked to a certain point (I'll get to that later) but is probably inefficient and not 100% the solution. sourcetype=top COMMAND | multikv | rex field=COMMAND "^(? .+?)\/" | makemv delim="[" COMMAND | eval new_command = replace(COMMAND,"]","") | stats count by new_command This seach lacks the ability to cut off two characters, "_" a number ... View more

Hi there, I am looking for a way to truncate the characters of my results. I am doing a simple search like sourcetype=ps OR sourcetype=top COMMAND | multikv | stats count by COMMAND In the results I have many similar names like watchdog01, watchdog02, watchdog03 and so on. Those I want to truncate to -2 characters in order to display only "watchdog" Any help would be much appreciated. Best regards Mike ... View more

Hi Splunkers, I have a table with values, obviously ^^ and I am trying to get certain data out of a certain column and row combaination. For example (just an example): First of all, I want to extract the data out of column "RXbytes" and row "eth0". Secondly, I want that value placed within a phrase i.e. "The value you are looking for is" + 12288679. Name MAC inetAddr RXbytes TXbytes Speed Duplex bond0 00:67:56:89:43:f9 195.173.161.79 268927778 202019587 null null eth0 00:67:56:89:43:f9 null 12288679 0 10000Mb/s null eth1 00:67:56:89:43:f9 null 256639339 202021063 1000Mb/s Full sourcetype=interfaces | multikv| table Name MAC inetAddr RXbytes TXbytes Speed Duplex I heard about a results[i]field command/statement or function, but unfortunately I cannot find any references. I am probably approaching the research the wrong way and therefore I hope someone here can point me at the right direction. Many thanks in advance. Best regards Mike ... View more