here is my token inputs.conf [mi_cds://default] cds_token = 9c71d2dc594b239717725a8 disabled = 0 i restarted my splunk instance.when i check index,still i see below error not sure whether it is valid or not index=_internal source=*mint.log 4/16 6:45:41.395 PM 2016-12-14 18:45:41,395 CRITICAL [mi_base.py] Modular input [mi_cds://default] failed: [Data Collector authentication exception '('Connection aborted.', gaierror(11004, 'getaddrinfo failed'))'] host = USTX10300L01103 source = C:\Program Files\Splunk\var\log\splunk\mint.log sourcetype = mint-3 12/14/16 6:45:41.395 PM 2016-12-14 18:45:41,395 ERROR [cds_tokens_handler.py] Data Collector authentication exception: ('Connection aborted.', gaierror(11004, 'getaddrinfo failed')) host = USTX10300L01103 source = C:\Program Files\Splunk\var\log\splunk\mint.log sourcetype = mint-3 12/14/16 6:45:41.309 PM 2016-12-14 18:45:41,309 INFO [connectionpool.py] Starting new HTTPS connection (1): au ... View more

I followed this link http://docs.splunk.com/Documentation/MintAddon/2.2.0/UserGuide/Install#Set_the_MINT_Data_Collector_token_in_the_MINT_Add-on and here is the full token i have generated [[Mint sharedInstance] initAndStartSessionWithAPIKey:@"1ec71f8b"]; In MINT Data Collector Token, paste the token string you copied above what is the exact token string here? ... View more

This Question of asked by my senior collegue. we have some dashboards and they want to execute or run dashboards from CLI. is it possible to run dashboards from commandline? ... View more

Thank you,when i select fields explicitly using fields command beside table,its working. ... View more

i think this is working,i just tested index=myindex java.lang.stringindexoutofboundsexception OR (out of memory) ... View more

Hi, will i get both error info and events i search like below index=myindex java.lang.stringindexoutofboundsexception OR out of memory ... View more

did i miss any here.same kind of concept is working another dashboard with different visualizations. ... View more

YES i just tried,without renaming and tried to put rename before |table but still getting the same results. ... View more

Yes its returning everything when i 'open in search' base search is coming with all tokens which i passed. i try ti display only 2 columns which are not showing before |table Time "Log Details" when i open this in dashbaord,it shows blank but if i open it in 'open in search' it displaying Columns properly ... View more

yes it is there but not some how it was deleted while posting the question. when i run the same query in search head separately its working but when i use the post porocess it showing all columns except Time and "Log Details" in tables ... View more

Yes,i see it now. and i just implemented Token in SPL and its working now. may i know what is the issue with Accept button ... View more

Thank you,i am going through the document. some how i am not seeing Accept button.any idea on this. or is there any issue from my side ... View more

Hi Sundaresh, some how i am not able to see Accept button in current page. is it because,this question was asked by someone else? ... View more

i just tried updated query.it is working and now i am able to compare success and failures.Thank you ... View more

Hi Sundaresh, i just changed time window to 2 hours.i think values are displaying properly.Thank you ... View more

Yes,i feel different. when i try this part got wrong results index=myindex "|METRICS|" |extract kvdelim=":" pairdelim="," |search co_name="" co_env="" co_org="" host="*"|eval StatusCode=if(ResponseCode>200,"Success","Decline")|timechart span=1h count(eval(StatusCode="Decline")) as Declined, count as Total i don't think there will be 184 requests other than status 200 _time Declined Total 2016-12-01 18:00 184 211 2016-12-01 19:00 1080 1241 2016-12-01 20:00 2549 2810 2016-12-01 21:00 4088 4318 2016-12-01 22:00 3061 3234 ... View more

Hi Sundaresh, i am also trying to display min,max and avg values of failures and success.here is the search when i try below search,i am getting some values but not sure whether those are correct or not. index=myindex "|METRICS|" |extract kvdelim=":" pairdelim="," ResponseCode!=200 |search co_name="" co_env="" co_org="" host="" |eval StatusCode=if(ResponseCode>200,"Success","Decline")|timechart span=1h count(eval(StatusCode="Decline")) as Declined, count as Total | eval Percent_Declined=round(Declined / Total * 100, 1)| timechart span=1d sum(Total) as Total sum(Declined) as Declined min(Percent_Declined) as Percent_Declined_Min max(Percent_Declined) as Percent_Declined_Max avg(Percent_Declined) as Percent_Declined_Avg|eval Percent_Declined_Avg=round(Percent_Declined_Avg,2)| eval Percent_Declined_Min=round(Percent_Declined_Min,2)|eval Percent_Declined_Max=round(Percent_Declined_Max,2)| table _time Total Declined DeclinePercentage Percent_Declined* |eval DeclinePercentage=round(Declined / Total * 100, 1)|eval DeclinePercentage=DeclinePercentage+"%" |fieldformat Total=tostring(Total,"commas")| fieldformat Declined=tostring(Declined, "Commas") | eval _time=strftime(_time,"%c") ... View more

Thank you,i updated the search string based on your suggestion and its working perfectly ... View more

HI, i would like to display and want to change this so it shows the continuous last 60 minutes. So if the search is run at 17:00 the single value would show 15:00 to 16:00 and the trend arrow and value with compare is 14:00 to 15:00 ... View more