I shortened the timeframe and got it to work, but when I'm looking for a longer period of time, it works for a few seconds and errors out. ... View more

http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/RemovedatafromSplunk ... View more

I accidentally put |search remove=1 instead of |search remove=0 in the search I provided above, the initial search looks for TICKET_OPEN events with TYPE=EQUIPMENT and any TICKET_CLOSED events. the stats command should grab the latest CREATE_DATE and the earliest CLOSE_DATE for each TICKET_NUMBER as well as which sourcetypes and how many sourcetypes reported for each TICKET_NUMBER. By running the remove eval and searching for 0, you should be removing any TICKET_NUMBERS that only have a TICKET_CLOSED TICKET_NUMBER and should be left with any TICKET_NUMBER that has TYPE=EQUIPMENT. If the above truly doesn't work and I'm not understanding clearly what the issue is, the only other option I can think of would be to reverse the joins, although you still might run into your limit issue. index=xyz sourcetype=TICKET_CLOSED | fields TICKET_NUMBER, CLOSE_DATE| join TICKET_NUMBER [ search index=xyz sourcetype=TICKET_OPENED TYPE=EQUIPMENT | dedup TICKET_NUMBER ] | table TICKET_NUMBER CREATE_DATE CLOSE_DATE ... View more

Authentication data model is for login and logout activities http://docs.splunk.com/Documentation/CIM/4.5.0/User/Authentication Web data model is for web/proxy server data http://docs.splunk.com/Documentation/CIM/4.5.0/User/Web ... View more

how about something like this? The remove eval will search for TICKET_NUMBERS that only have a TICKET_CLOSED index=xyz (sourcetype=TICKET_OPENED TYPE=EQUIPMENT) OR (sourcetype=TICKET_CLOSED) |stats latest(CREATE_DATE) as CREATE_DATE earliest(CLOSE_DATE) as CLOSE_DATE values(sourcetype) as sourcetypes dc(souretype) as numberSourcetypes by TICKET_NUMBER |eval remove=if(numberSourcetypes=1 AND sourcetypes="TICKET_CLOSED",1,0) |search remove=0 ... View more

We do the same. ... View more

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Definescheduledalerts#Using_cron_expressions The tricky thing is that I'd think it should be 0 11 * * 7-1 but that doesn't work either. It has to be in ascending order, it appears, like 0 11 * * 1-7 This might be a bug fix you submit? ... View more

oops, sorry about forgetting 'search'! glad it worked! ... View more

Is that main panel the only thing in your dashboard, or are there other panels? If it is the only panel, you could just shoot off a scheduled PDF. Another workaround would be to create a report and have the searches within your main panel appended into that search and schedule the report to run. Though, that is a bit more tricky and may run into more complications. ... View more

You should be able to go to the Dashboards View and click 'Edit>Edit Source' and edit the XML from there. ... View more

you could do a .... | streamstats current=f window=1 values(httpStatus) as previousHttpStatus by _time|where previousHttpStatus!=httpStatus or some variation that would work for your needs documentation on streamstats https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Streamstats ... View more

are you doing: index=_internal | eventstats count by my_fieldname| eval my_fieldname=sourcetype.", ".count | timechart count by my_fieldname ... View more

I don't use a dropdown, I use checkboxes, but you might be able to manage this with a dropdown. When unchecked, the panels will not appear. Keep adding panels and depends on the panel tokens. <row> <panel> <input type="checkbox" token="panel1" searchWhenChanged="true"> <label>panel1</label> <choice value="true">Show</choice> <change> <condition label="Show"> <set token="panel1">true</set> </condition> </change> <default>true</default> </input> <input type="checkbox" token="panel2" searchWhenChanged="true"> <label>panel2</label> <choice value="true">Show</choice> <change> <condition label="Show"> <set token="panel2">true</set> </condition> </change> <default>true</default> </input> <input type="checkbox" token="panel3" searchWhenChanged="true"> <label>panel3</label> <choice value="true">Show</choice> <change> <condition label="Show"> <set token="panel3">true</set> </condition> </change> <default>true</default> </input> </panel> </row> </row> <row> <panel depends="$panel1$"> <single> <search> <query>...</query> </search> </single> </row> ... View more

I run into this problem every so often. If I wait 10 minutes or so and run the search again, it generally goes away. A bit annoying, however. ... View more

Are you trying to hide certain panels? ... View more

Are there many values? An eval statement would probably work, but typing out a large one would be tedious. ... View more

Use convert. ... my base search ... | Convert mktime(_time) as raw_time timestamp="%Y-%m-%dT%H:%M:%S" | Convert mktime(UTC_EndTime) as utc_endtime "%Y-%m-%dT%H:%M:%S"| eval diff= raw_time-utc_endtime ... View more

in the Advanced tab on the Time Range Picker, you could put "@d" in earliest and "now" in latest, would that work? ... View more

It should still be a valid command. What version of Splunk are you using? http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Gentimes ... View more

so |table * gives you 798 and |fields * gives you 794? this is quite the tricky widget... ... View more

how about |eval userNumbers=match(userField,"\d") that should give you a true/false of users with digits in their username and you can search from there. ... View more

If you tried |table *|stats count Are your results different? Unless the only fields in your index are id, _time,host and source ... View more

Yeah I know that it tokens it. But then if they only brought the one row back, they could use done or another to token. ... View more