Why am I getting difference result from two search type This is the correct result as expected This is incorrect result, but I would like to use this search format Any suggestion! ... View more

Hi, Is there a way to show or display all legend label in bar chart? Per my screenshot It's only display up to 9 items on the legend label. I would like to display them all on the legend label. ... View more

Hi, when I set no_priority_stripping = true the host change from IP Address to Host name when performing a search in splunk. Example Host="10.10.10.170" to Host="ABC-DEVICE" Before set no_priority_stripping = true in inputs.conf Below is syslog event send to splunk 2:31:50.000 PM <134> 1 2019-11-15T14:31:50-08:00 ABC-DEVICE server - - [meta sequenceId="13" enterpriseId="2634.1.17.16" vendorId="WTI"] CPM: ABC-DEVICE, (AUDIT LOG) DATE-TIME: 11/15/19 14:31:50 host = ABC-DEVICE source = udp:514 sourcetype = syslog After remove set no_priority_stripping = true from inputs.conf Nov 15 14:07:57 192.168.100.170 1 2019-11-15T14:07:57-08:00 ABC-DEVICE server - - [meta sequenceId="8" enterpriseId="2634.1.17.16" vendorId="WTI"] CPM: ANTHONY-TEST, (AUDIT LOG) DATE-TIME: 11/15/19 14:07:57, host = 10.10.10.170 source = udp:514 sourcetype = syslog Anyone have any idea why Splunk Stripping the IP Address and replace it with the Host name instead. ... View more

Hi, How do I display the correct syslog event timestamp in Splunk. this is Syslog Event timestamp when display in Splunk with no_priority_stripping=true. 2019-11-14T14:34:02-08:00 I want to display like 11/14/2019 14:34:02 Below is the syslog event message. <134>1 2019-11-14T14:34:02-08:00 CPM-1600-1-ECM-ITLAB server - - [meta sequenceId="39" enterpriseId="2634.1.17.16" vendorId="WTI"] CPM: CPM-1600-1-ECM-ITLAB, (AUDIT LOG) DATE-TIME: 11/14/19 14:34:02, USERNAME: super LOGOUT By /X SSH Port 22 host = CPM-1600-1-ECM-ITLAB source = udp:514 sourcetype = syslog Looking forward to someone that can help out to resolve this issue. ... View more

Hi, When I set no_priority_stripping = true in input.conf in Splunk server, my syslog data send to Splunk work but a very long delay of time. When I remove no_priority_stripping = true from input.conf. My unit sends syslog to Splunk in real-time. I do need to set no_priority_stripping = true, in order for me to use syslog_priority.csv lookup table. I need help to resolve this issue. Can you please point me in the right direction? Thanks, Matoula Senethavong ... View more

Hi, I've configured WTI device syslog to send to Splunk. I can see all the syslog activity is there in Splunk Event. My question is how do I filter syslog event level in Splunk- like syslog severity from WTI Event? Example: 0 - Emergency, 1 - Alert, 2 - Critical, 3 - Error, 4 - Warning, 5 - notification, 6 - information and 7 - debugging. Looking forward to your help. ... View more

Hi, We've our JSON code that send to Splunk. Everything is working great as expected, but I would like to know how do I change label name on legend for a graph and would like to keep a lookup name as plug1 , plug2 , plug3 and so on when user click on each legend for drill down detail for each plug? see image chart below. What I would like to do I want to rename label from plug1 , plug2 , plug3 ... to plugname of each plugs. For Example plug1 has a plugname value of Outlet_A1 , plug2 has a plugname value of Outlet_A2 , and plug3 has a plugname value of Outlet_A3 and so on. my search string for the graph: | search sourcetype=powerdata siteid=$siteid$ assettag=$assettag$ | timechart avg("powerdata{}.plug1{}.current") as plug1, avg("powerdata{}.plug2{}.current") as plug2, avg("powerdata{}.plug3{}.current") as plug3, avg("powerdata{}.plug4{}.current") as plug4, avg("powerdata{}.plug5{}.current") as plug5, avg("powerdata{}.plug6{}.current") as plug6, avg("powerdata{}.plug7{}.current") as plug7, avg("powerdata{}.plug8{}.current") as plug8, avg("powerdata{}.plug9{}.current") as plug9, avg("powerdata{}.plug10{}.current") as plug10, avg("powerdata{}.plug11{}.current") as plug11, avg("powerdata{}.plug12{}.current") as plug12, avg("powerdata{}.plug13{}.current") as plug13, avg("powerdata{}.plug14{}.current") as plug14, avg("powerdata{}.plug15{}.current") as plug15, avg("powerdata{}.plug16{}.current") as plug16 | eval plug1=round(plug1,2) | eval plug2=round(plug2,2) | eval plug3=round(plug3,2) | eval plug4=round(plug4,2) | eval plug5=round(plug5,2) | eval plug6=round(plug6,2) | eval plug7=round(plug7,2) | eval plug9=round(plug9,2) | eval plug10=round(plug10,2) | eval plug11=round(plug11,2) | eval plug12=round(plug12,2) | eval plug13=round(plug13,2) | eval plug14=round(plug14,2) | eval plug15=round(plug15,2) | eval plug16=round(plug16,2) Can you please point me to the right direction? Looking forward to your help. Below is our custom JSON code that send to Splunk. { "timestamp": "2019-06-21T21:50:13+00:00", "siteid": "LABRACK1", "assettag": "CPM-1600-1-ECAM-LAB", "powerunit": "1", "outletmetering": "1", "ats": "1", "branchcount": "2", "plugcount": "16", "powerfactor": "100", "powereff": "100", "powerdatacount": "1", "powerdata": [{ "timestamp": "2019-06-21T21:50:13+00:00", "plug1": [{ "voltage": "114.00", "current": "2.00", "branch": "1", "plugname": "Outlet_A1" }], "plug2": [{ "voltage": "114.00", "current": "5.00", "branch": "1", "plugname": "Outlet_A2" }], "plug3": [{ "voltage": "114.00", "current": "3.00", "branch": "1", "plugname": "Outlet_A3" }], "plug4": [{ "voltage": "114.00", "current": "1.00", "branch": "1", "plugname": "Cisco-SW3560" }], "plug5": [{ "voltage": "114.00", "current": "2.00", "branch": "1", "plugname": "Cisco-SW3760" }], "plug6": [{ "voltage": "114.00", "current": "5.00", "branch": "1", "plugname": "UPS" }], "plug7": [{ "voltage": "114.00", "current": "3.00", "branch": "1", "plugname": "Outlet_A7" }], "plug8": [{ "voltage": "114.00", "current": "1.00", "branch": "1", "plugname": "Outlet_A8" }], "plug9": [{ "voltage": "119.00", "current": "2.00", "branch": "2", "plugname": "F5" }], "plug10": [{ "voltage": "119.00", "current": "7.00", "branch": "2", "plugname": "Camera" }], "plug11": [{ "voltage": "119.00", "current": "5.00", "branch": "2", "plugname": "TV" }], "plug12": [{ "voltage": "119.00", "current": "1.00", "branch": "2", "plugname": "Meraki" }], "plug13": [{ "voltage": "119.00", "current": "4.00", "branch": "2", "plugname": "Outlet_13" }], "plug14": [{ "voltage": "119.00", "current": "5.00", "branch": "2", "plugname": "Outlet_A14" }], "plug15": [{ "voltage": "119.00", "current": "3.00", "branch": "2", "plugname": "PC" }], "plug16": [{ "voltage": "119.00", "current": "1.00", "branch": "2", "plugname": "Outlet_A16" }] }] } ... View more