Hello, I would like the series names of my chart to be the exact names of the time period. To do that I added 'series=exact' to the end of my search. However, when I do that I get an error that says: "Error in 'timewrap' command: command="timewrap", 'timeunit' argument required, such as d, w, 2m, q, y" *searchforevents* | timechart count span=1w | timewrap m series=exact What should I do to fix the error? Thanks! ... View more

Hello, I have data that shows the number of items I'm counting by item number. Is there a way to count when I have a certain amount of items, then reset the count back to zero? I could do something like | eval number=sum(field)/value, but then I wouldn't get the timestamp of when that count rolled over. For example, I want to know when I have at least 5 items. So for this data I would want it to show a graph with values on day 2, day 3, and day 5, since that's when the count got high enough to be 5. day1 2 day2 3 day3 6 day4 1 day5 5 ... View more

Hello, I put about 500 files on a server (between 2 directories) and was looking through the data. It seemed that most of the files were broken up line by line, but some of the files were not broken up and were saved as single events with multiple lines. Also, the source for some of the events were changed from the original file name (example1.log) to filename.filepart (example1.log.filepart). Does anyone know what the .filepart means? Thanks! ... View more

Hello, I have a log file that creates 3 unique files for each node every 15 minutes. I would like to graph the PercentUsed by HDD and by NODE, so for this example I would have 6 different lines. Currently I'm using an eval statement to concatenate the NODE and the HDD as a new field and graphing 'by new_field'. Is there a more elegant way of doing this? Maybe somehow saying max(Percent_Used) by HDD by NODE? The files look like this: 2013-11-19 07:52:06 (NODE1) HDD=1 Percent_Used=49% 2013-11-19 07:52:05 (NODE1) HDD=2 Percent_Used=19% 2013-11-19 07:52:05 (NODE1) HDD=3 Percent_Used=37% 2013-11-19 07:52:06 (NODE2) HDD=1 Percent_Used=50% 2013-11-19 07:52:05 (NODE2) HDD=2 Percent_Used=66% 2013-11-19 07:52:05 (NODE2) HDD=3 Percent_Used=05% Thanks!! ... View more

hello, I'm looking to make a panel that has 9 timechart lines on it. I would like to graph the depth vs. time for each queue. Each log will create 1 data point for each queue. I'm thinking I need to use xmlkv or multikv or something similar to that, but can't seem to figure it out. Any ideas? An example of the log is shown below: > [2013.11.05-08:43:24.787]Output Response: > Queue:1 Depth=0; Oldest=0 > Queue:2 Depth=0; Oldest=0 > Queue:3 Depth=0; Oldest=0 > Queue:4 Depth=0; Oldest=0 > Queue:5 Depth=0; Oldest=0 > Queue:6 Depth=0; Oldest=0 > Queue:7 Depth=0; Oldest=0 > Queue:8 Depth=0; Oldest=0 > Queue:9 Depth=1; Oldest=1 ... View more

I have a log that outputs a table every day of issues that occur between two parties. I'm able to split the output table into individual events so that I can graph the NumberofIssues by Party1 or Party2, but what I'm really looking for is the root cause, the 'common denominator'. I would like to show which party is the real one causing issues. I would like to graph the total NumberofIssues that any party is involved with regardless if it is listed under 'Party1' or 'Party2'. An example of my data is: Party1,Party2,NumberofIssues A, D, 100 B, D, 200 C, D, 300 D, B, 400 E, A, 2 F, C, 3 Desired outcome: A=102 B=600 C=303 D=1000 E=2 F=3 So now I would be able to make a column chart and easily spot that D is causing all sorts of issues. Thank you! ... View more

I currently have a graph that shows the number of events over the last 24 hours by host. I've also included streamstats to create a running average over the last 24 hours. There are two things that I'm wondering: Is it possible to also put a Weekly_Running_Average line on the same graph as well? This way I can view the daily average and the weekly average simultaneously. Is this a true running average over the last 24 hours, or do I need to extend my graph to go back 48 hours so that I'm getting a full 24 hours worth of data? Right now my two average lines are identical so I'm assuming I'm only getting a full 24 hour average point for the most recent data point. My code looks like this: (search for number of events) | timechart span=30m count by host | addtotals | streamstats window=48 avg(Total) as "Total Daily Running Average" | streamstats window=336 avg(Total) as "Total Weekly Running Average" Thanks! ... View more

I'm trying to create a regex so that I can pull a string of numbers out of a log file. I can limit my search so that only the specific log files appear, but when I do the interactive field extraction other files show up for some reason... I have a log file that says "DataX Entry GB= 5123521 Data Entry GB=1265649" I would like a field in Splunk that just has "1265649" in it for each log entry. Sometimes the number will be more or less digits. I tried making a regex that simply returned a string of numbers after "Data Entry GB=", but that didn't work. Thanks! ... View more

I'm creating a dashboard panel that will say if something Available or Unavailable based on if the count of 'DOWN' is greater than 0 over the last 20 minutes. I'm using this command after my search, and after I count the number of times 'DOWN' appears in the logs: | eval is_available=if(DOWN > 0, "Unavailable", "Available") | table is_available I'm using a single value display to represent this on my dashboard. I would like to change the color so that it's green when it says 'Available' and red when it says 'Unavailable'. Does anyone know how to do this? I don't think rangemap will work because if I configure rangemap based on the 'DOWN' field it will affect the is_availible field, which is the field that I'm actually sending to the visualization. Thanks! ... View more