Hello, | rest /services/data/indexes-extended | eval bd_home_event_min_time=strftime('bucket_dirs.home.event_min_time',"%d/%m/%Y") | eval bd_home_event_max_time=strftime('bucket_dirs.home.event_max_time',"%d/%m/%Y") | eval bd_cold_event_min_time=strftime('bucket_dirs.cold.event_min_time',"%d/%m/%Y") | eval bd_cold_event_max_time=strftime('bucket_dirs.cold.event_max_time',"%d/%m/%Y") | table title,bd_home_event_min_time,bd_home_event_max_time,bd_cold_event_min_time,bd_cold_event_max_time,splunk_server | sort title | where not like(title,"_%") returns empty result. However the where clause works if I don't use underscore. My aim is to ignore internal indexes. Thanks for your help. ... View more

*09-06-2016 14:38:56.094 +0200 DEBUG AdminManagerExternal - Sending handler setup data:\n\n\n \n ITM6\n -\n \n 100\n 0\n 2\n \n true\n name\n \n \n \n \n \n\n 09-06-2016 14:38:56.244 +0200 DEBUG AdminManagerExternal - Got back data:\nITM61FalseFalseTrue10002FalseTrueFalseFalsetruename-\n 09-06-2016 14:38:56.244 +0200 DEBUG AdminManagerExternal - Sending handler execute data:\n\n\n \n ITM6\n -\n \n 100\n 0\n 2\n \n true\n name\n \n \n \n \n \n\n 09-06-2016 14:38:56.592 +0200 DEBUG AdminManagerExternal - Got back data:\nfalse<type 'exceptions.TypeError'>not enough arguments for format stringTraceback (most recent call last):\n File "/OPT/siem/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n hand.execute(info)\n File "/OPT/siem/splunk/lib/python2.7/site-packages/splunk/admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/OPT/siem/splunk/etc/apps/ITM6/bin/rest_handler_tems.py", line 56, in handleList\n raise Exception("Error %s returned from tems_creds endpoint: %s\n" % (e))\nTypeError: not enough arguments for format string\n\n 09-06-2016 14:38:56.592 +0200 DEBUG AdminManagerExternal - Found serialized error from external handler. 09-06-2016 14:38:56.592 +0200 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/OPT/siem/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n hand.execute(info)\n File "/OPT/siem/splunk/lib/python2.7/site-packages/splunk/admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/OPT/siem/splunk/etc/apps/ITM6/bin/rest_handler_tems.py", line 56, in handleList\n raise Exception("Error %s returned from tems_creds endpoint: %s\n" % (e))\nTypeError: not enough arguments for format string\n 09-06-2016 14:38:56.592 +0200 ERROR AdminManagerExternal - Unexpected error "" from python handler: "not enough arguments for format string". See splunkd.log for more details.* Thanks for your help. ... View more

Hello, I'd like to do the following (screenshot at http://hpics.li/49c6c08), do not sum percentages but just following a calculation rule. Thanks for your help. Screenshot ... View more

Hello dear Splunk experts 🙂 I have this in my search: addcoltotals labelfield=fieldtosum label=TOTAL However I would like to reuse the result of it like fieldtosum/TOTAL, how to do? Example attached. Thanks. ... View more

Example: are snmp devices sending data to heavy forwarder, or is the HF connecting to devices to get syslog data? Thanks. ... View more

Hello, I'm using dd/mm/yyyy date format and results are not correctly sorted if we are dealing with data across months. I've tried https://answers.splunk.com/answers/215005/sorting-date-1.html but it doesn't work. The only right way is to use %Y/%m/%d Otherwise, is it possible to limit the results to the current month? Snapshot attached. Thanks. ... View more