I have many post processing searches based on 1 base search. My local host is terribly slow that i cannot perform any operation. Takes more than 5 minutes to load panels. I created saved search and loaded it in base query to utilize in other searches | loadjob savedsearch="admin:Accenture_Campaign:broadlog_search" I gave this with search base="global" is not working for post processing searches. How can i get this working? please help. ... View more

I'm able to populate dropdown based on previous dropdown value with passing that token. But when ALL is selected in previous dropdown , i want "ALL" to appear in dependent dropdown without any values. Only when some value is selected, other dropdown should refresh accordingly. How to achieve that.. ? ... View more

I have a table with 10 records. 2 rows for each host - say AUX0001 to AUX0005. For each host, 2 processes occur: the status and time range. AUX0001 disp.exe abcded green running , AUX0001 wxze.exe red running. In this way it is present for all the hosts.. My requirement - if both processes are green, host should display only once for disp.exe. if both are red, then both processes should be displayed. If one is green and one is red , it should be red with that process name be it disp.exe or wxze.exe. This looks simple. but unable to achieve this. I tried several ways - Should i have to loop for each host? I'm not getting the desired result. index="xxx" sourcetype="yy" |fields name description dispstatus textstatus starttime elapsedtime pid source|eval host_source = mvindex(split(source,"\\"),5)|eventstats count(eval(dispstatus="Green")) as green_count count(eval(dispstatus="Red")) as red_count by host_source|eval desc_test = case(green_count ==2 OR red_count ==2,"Dispatcher", red_count ==1 AND description="watchdog" ,"watch", red_count ==1 AND description=" Dispatcher " ," Dispatcher ")|table host_source description dispstatus desc_test|where description=desc_test Can someone please help me here? Thanks a lot ... View more

I have to monitor 2 files of different source type from same folder with different timestamps continuously for every 15 mins Both file names start with sm__nr_ur.csv sm__tickets.csv I did this for both files in input.conf [monitor:///home/gcaaxfer/data/*NR*.csv] disabled = false host_segment = 3 index = my_index sourcetype = my_request [monitor:///home/gcaaxfer/data/*ticket*.csv] disabled = false host_segment = 3 index = my_index sourcetype = my_request This is not working. Even if i whitelist with ticket/.csv for that monitor, it doesn't seem to work. Any idea how to get this to working? Please help with your inputs. Thanks! I have used <*> symbol.. but its not getting displayed ... View more

Hi, I have to monitor the folder which has 1 time historic data in place. Now from another system we get the csv files sftp'd to Splunk instance every 15 mins only for updates and new inserts. I have dedup in place for the queries. So for any updates, will the old duplicate be removed automatically based on index time? Or should i have to incorporate anything specific to remove old records? For inserts I guess it should work fine. Experts, Please guide me on this ... View more

How to enable export symbol in the report? I have created role based access. The users want to export the table to CSV. They don't need edit access. Is there a way to enable that for the report? I have admin access, but even then it's not enabled. What could be the reason? please help ... View more

I have to calculate average tickets over time for developer. Since time is not _time and different time column, I did not use time chart basesearch|eval Due_Time = strptime('Due By',"%d.%m.%Y") |bin Due_Time span=1mon |chart count over Due_Time by "Developer" usenull="f" useother="f"|eval Due_Time = strftime(Due_Time,"%b.%Y")|addtotals Till here it's fine. But i want to calculate average over time. How do i capture count so that i can do total/count and arrive at average? The count keeps changing every month, I should not consider if the count is 0. eventstats avg(total) is not working here either. can someone please help? ... View more

I have to calculate % of SLA missed over time. basesearch|dedup ID|EVAL sla_status = case(Status like "Closed MPT Warning%","Closed-MPT Warning",Status like "Closed MPT Exceeded%","Closed-MPT Exceeded",Status like "Closed IRT Exceeded%","Closed-IRT Exceeded",Status like "Closed IRT Warning%","Closed-IRT Warning",Status like "Closed%","Closed") |timechart count as sla_count by sla_status |addtotals| foreach * [eval sla_perc = count * 100 /Total] Not sure why this is not working. Please help ... View more