why you didn't accept answer if it works? ... View more

Splunk has a map command where you can recursively execute SPL for selected field. (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map). I have used makeresults but you can use timechart instead. <fieldset> <input type="radio" token="radio" searchWhenChanged="true"> <label>Radio</label> <choice value="*">All</choice> <choice value="Dot11Radio0">2.4 GHz</choice> <choice value="Dot11Radio1">5.0 Ghz</choice> <default>*</default> </input> </fieldset> <row> <panel> <table> <search> <query>| makeresults | eval aggrQuery=case("$radio$"=="Dot11Radio0","avg(low) AS 2.4GHz","$radio$"=="Dot11Radio1","avg(high) AS 5.0Ghz",true(),"avg(high) AS 5.0Ghz avg(low) AS 2.4GHz") | map search="| makeresults | eval UseMappedresult=\"$aggrQuery$\""</query> <sampleRatio>1</sampleRatio> </search> ... View more

On later system its: splunk web portal -> setttings -> indexes But if you are on a search head with indexes stored on other server (index server) you will not see any data there. ... View more

You can use either sort or reverse to change the order and use head or tail to keep only the top/last row. ... View more

Now it worked perfectly. Thanks ... View more

That did do it. Data is coming from a drop down input on a dashboard. If you post it as an answer I can accept it 🙂 ... View more

If you want to know the value of $SPLUNK_DB that Splunk is using, you can use this command `ps -ex | grep --color SPLUNK_DB` then you can declare the same var in your enviroment export SPLUNK_DB=/opt/splunk/var/lib/splunk and finally copy the files . As you posted, in this doc you cand find the file were SPLUNK_DB is defined. ... View more

This was just what I needed. Thanks. ... View more

Here is a dynamic way to do it. This will count up mail servers and add them to the drop down box. If you 2 server it will show those two, if you have 100, it shows 100 servers. <input type="time" token="global_time" searchWhenChanged="true"> <label>Time frame</label> <default>Last 24 hours</default> </input> <input type="dropdown" token="Mailserver" searchWhenChanged="true"> <label>Mailserver</label> <search> <query>sourcetype=api "analyzed email count" | rex "xxx (?<server>\S+)" # Here you need to make a rex to extract name of your mail server | top limit=0 server <earliest>$global_time.earliest$</earliest> <latest>$global_time.latest$</latest> </search> <choice value="*">Any</choice> <fieldForLabel>server</fieldForLabel> <fieldForValue>server</fieldForValue> <default>*</default> </input> Then in you panel you add the following search: sourcetype=api "analyzed email count" $Mailserver$ | stats sum(mail_value) AS "Total" If you post some lines that show how mail server looks like, I can make the regex to extract it for you. ... View more

Creative solution to make your search a lot less cluttered. ... View more

(?P..csv) this does not extract anything. If it was more like (?<CSVFiles>\w+\.csv) it will work. ... View more

I think you do not need to escape the / inside [] , so this will work as well. ([^/]+)\/ ... View more

I am not sure you need to escape the ' within the square brackets, so this should work too: [^']+ ... View more

I downvoted this post because the other answer on this page is more correct ... View more

it's a bug and will be fixed in 6.5.1 after 6.5.1, splunk assistant under free license will use Compact mode by default and the mode can't be changed ... View more

This is 100% correct, If you have a port-security error. (to many mac on one port), it will have a recovery timer, eks 5 min. It will try to enable the port, then fail again. Same with fan failure, it will have a fixed time between all events. ... View more

About - -- Could anyone explain why wildcard search is much slower? Lovely discussion at Adavanced searches are too slow since they don't seem to make use of indexes @sideview said - ... View more

Thanks for response everyone.. None of these are working.. My field values are like "Change Request - HR & Payroll - Time Management (TM)" and "Change Request - Logistics - Materials Management (MM)".. I have to replace part of the string in each field value.. Im able to get this done with rex and sed.. rex field=categories mode=sed "s/Change Request/CR/" |rex field=categories mode=sed "s/Central Functions/CF/" But i want to add this as calculated field using eval.. Any ideas on this..? Thanks a lot.. ... View more

Thanks, I did give you +1 for this, since it work as well. Only pitfall that I needed to add 0 to the transpose or I lost rows. (default 5 rows) transpose 0 header_field=client column_name=value ... View more

You do not need it inner parentheses, and you do not need to escape the ; , so this should do: your base search | rex "(Android|iPhone OS) (?<os>[^\s;]+)" ... View more

Thank you this is also a very nice way of listing anomalities, it does lists all (non anomalities) off-duty lines aswell, but it can be fixed by adding this the end: |where action="view" OR action="write" This works very nicely to find anomalities, also if you want to count all anomalities instead of transactions and a way to find even a anomality line that happends when user has logout and has not yet login again. ... View more

The way that you did it is just fine, IMHO. ... View more

This I know, but I am surprised that a function like this has not been added to the GUI. It has been like this for a very long time. Lets hope 6.6 will resolve it. ... View more

Hi All, I'm very pleased to say that this all appears to be resolved in version 6.5.1 Thanks to the Splunk Team. ... View more