I have added some searches to some Navigation dropdowns in an app I created. When you select the saved search in the dropdown menu it opens the saved search. Is there a way that I can make it so the saved search loads AND has the search bar available without making users click Edit->Open in Search ? Here is the current nav menu: </collection> ... View more

Hello I'm trying to use a field that has values that have spaces. For example: errorMsg=Requested tickets could not be reserved another example: errorMsg=System.ObjectDisposedException: The factory was disposed and can no longer be used. Object name: 'this'. The problem is that the messages contain spaces. All of the messages are different in this field, some longer with less spaces and some shorter. When I do a stats count command on the errorMsg field but all I get is the first word of the string. Any ideas on how I can correct this? I also tried using the Field Extractor but alas no good. Thank you! ... View more

Hello I'm trying to add an alert to a dashboard panel: here is the base search: index=name app_name=API brokerId=* operation=purchase earliest=-4h | xmlkv | timechart span=10min count by transactionType | eval NRTPCT=(NonRealTime/(RealTime+NonRealTime))*100 | eval RTPCT=(RealTime/(RealTime+NonRealTime))*100 What I would like to alert on is when the NRTPCT goes over 2% I haven't figured out the conditional search for the alert to use. Can anyone help? ... View more

Hello eventtype=tt-APIGatewayAthenticationFail earliest=-30d | bucket _time span=1h | stats count by _time | eval Average=if(_time>relative_time(_time,"-1h"),count,null()) | eventstats avg(count) as avgCount by _time | timechart perc90(avgCount) as Avg_90 avg(Average) as Average I'm probably making this harder than it really is but I'm trying to get the 90th percentile average for the count over 30 days by day. Along with this I am also trying to get the average of the count by hour. So 90th percentile average over 30 days compared to the hourly average of the count and be able to graph them. Essentially I want to take all the hourly averages going back 30 days and then get the 90th percentile of them. And the average duration from the last hour has to come along for the ride. The above is mostly correct it functions but its not quite right. This one works but doesn't allow me to use two separate time frames that I need "90th percentile average over 30 days compared to the hourly average of the count" eventtype=tt-APIGatewayAthenticationFail earliest=-30d| bucket _time span=1h | stats count by _time | timechart avg(count) as Average p90(count) as Average_90 Any suggestions or pointers? ... View more

Hello I am trying to pull a text string out of some raw results using a simple regex. Heres my question: I would like to be able to get a stats count on the number of occurrances of this string. i would assume that you would have to put it into another field as it is simple text at the moment and not in a field. How would I do this? I am new to the rex/regex portion of Splunk and could use a little guidance. Here is the raw data: log_source=TT.WebService.Internal.OrderIntegration.OrderIntegration - Unable to reserve shopping cart: Attempt to add tickets to the shopping cart resulted in a failure due to tickets no longer being on the exchange. TT.Logic.TicketsNotFoundException: Exception of type 'TT.Logic.TicketsNotFoundException' was thrown. I used \bUnable\b.* to get just the sentence "Unable to reserve shopping cart: Attempt to add tickets to the shopping cart resulted in a failure due to tickets no longer being on the exchange." I tried using "rex field=_raw...." and also creating a field named error like "rex field=error mode=sed" but am still not doing something correctly. Any advice would be appreciated, thank you! ... View more

Hello index=tt Reserve OrderIntegration | transaction dye maxspan=30s maxpause=10s startswith="Begin Reserve" endswith="End Reserve" | bucket time span=24h | timechart avg(duration) as Duration | eventstats p90(Duration) as AvgDuration_90 This is the base search that I have created and it works but I need to change the search so the "eventstats p90(Duration) as AvgDuration_90" can be transacted to the bucket so I can use earliest=-30d. Then I need to add earliest=-1h to the "timechart avg(duration) as Duration" portion of the search, so I thought I could use a subsearch but I have been unable to get it to work correctly. Essentially I need the 90th percentile to span back 30 days but the average duration to span the last hour. Any ideas how this can be completed easily? Thanks so very much ... View more

Hello I'm trying to get the search to find a transaction and within that transaction is information like brokerID, listing number, quantity and list price. What I would like to do is for each listingID find the total (Quantity*listPrice) by brokerID. I can't seem to get it to work. I've tried using stats sum() and several other methods all without the results I need. Any Ideas? This is where I stopped and I know its way off: index=tt host=*api* "ItemID" | xmlkv | dedup ItemID | stats sum(listingID(Quantity*ListPrice, ) | sort by brokerID | Thank you for any help you can give me ... View more