@danje57... Glad it worked... You might have to consider summary indexing as well... So that older versions of same file are summarized as single row. That way search will perform better for longer duration! ... View more

@mstark31, here is one way to do it... 1) Whatever is the timerange in the first search, you can define a Time input for the same. I have used tok_time as time in my example. <fieldset submitButton="false"> <input type="time" token="tok_time" searchWhenChanged="true"> <label>Select Time</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> </fieldset> 2) Run a dumy search to compare selected Earliest and Latest Time and set the index/environment name as summary or realtime (ideally to be passed to a macro to set criteria of the base search etc.) <!-- Dummy Search to set index name for main query based on time range selected --> <search> <query>| makeresults | eval now=_time</query> <earliest>$tok_time.earliest$</earliest> <latest>$tok_time.latest$</latest> <sampleRatio>1</sampleRatio> <preview> <!-- Compare Todays Date with Earliest Time in the Time Range and if greater than 2 week (2*7*24*60*60=1209600 seconds) set Summary else set Realtime index--> <condition match="$result.now$-$job.searchEarliestTime$>1209600"> <set token="selectedIndex">summary</set> </condition> <condition> <set token="selectedIndex">realtime</set> </condition> </preview> </search> Finally use the $selectedIndex$ token to set index to summary. Ideally through a macro which takes string values for environment as a paramter, this we you can set other criteria for base search if you want like summary index will have sourcetype as stash. <!-- Use $selectedIndex$ token to set index in main search--> <search> <query> base search | join sample_name [ `setindex($selectedIndex$)` |<remaining Search> ] | table sample_name sample_value </query> </search> PS: One more condition you can try out is to see if Earliest and Latest time spans for more than two weeks then go for Summary Index <condition match="$job.searchLatestTime$-$job.searchEarliestTime$>1209600"> ... View more

As far as you have the other Splunk app name and dashboard URL you can either use <link> tag or HTML anchor tag <a> Assuming you are in Splunk app named app1 and dashboard dash1 and want to navigate to Splunk app2 with dashboard dash2 you can try anchor HTML. Through link tag in Simple XML <link>app/app2/dash2</link> Or with Anchor tag if you are using HTML panel within Simple XML <a>app/app2/dash2</a> You can use _target="blank" within link or anchor to open the dashboard in a new window. Refer to Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_tokens_for_conditional_operations_with_the_.3Cdrilldown.3E_element ... View more

@chintan_shah... You can print this in Title also. I just used html as an example. <panel> <title>Data from - $tok_Prev_Week_Date$ </title> ... View more

This is your Overall Splunk Enterprise Home Page, this is where you can setup a Dashboard By Default through "Choose a home dashboard" option as shown in your screenshot. However, this place is ideally for you to switch to one of your various App. The answer that I have given you is for setting up a default view for specific app. ... View more

Just add the following to your existing query <Your exiting Search with chart as base search> | accum LAW as Cumu_LAW | accum BUSINESS as Cumu_BUSINESS | accum EDUCATION as Cumu_EDUCATION Then you need to enable Chart Overlay for all Cumu_* fields and View as Axis should be turned on. You can do the same by editing the Visualization in Splunk Web UI or else through Splunk CHart reference <charting.chart.overlayfields>Cumu_LAW ,Cumu_BUSINESS,Cumu_EDUCATION</charting.chart.overlayfields> <charting.Y2.enabled>1</charting.Y2.enabled> <charting.Y2.scale>linear</charting.Y2.scale> ... View more

Try changing from Transaction to Stats. Investigate your missing/incorrect correlated events by adjusting the search filter | search CorrelatedEventCount>1 AND EventCode=4688 AND EventCode=4624 before stats. index=wineventlog sourcetype=WinEventLog:Security (EventCode=4688 OR EventCode=4624) NOT (New_Process_Name="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" OR New_Process_Name="C:\\Windows\\system32\\conhost.exe") |stats count as CorrelatedEventCount min(_time) as MinTime max(_time) as MaxTime values(EventCode) as EventCode values(Source_Network_Address) as Source_Network_Address values(dest_nt_host) as dest_nt_host values(New_Process_Name) as New_Process_Name values(Process_Command_Line) as Process_Command_Line by Account_Name | search CorrelatedEventCount>1 AND EventCode=4688 AND EventCode=4624 | eval duration = MaxTime-MinTime | eval _time=MinTime | fields - MinTime | table _time Account_Name CorrelatedEventCount duration Source_Network_Address dest_nt_host New_Process_Name Process_Command_Line ... View more

Have you checked out dbinspect command? It gives info for various buckets in an index https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dbinspect ... View more

@splunkn... Have you seen Splunk's Timeline Custom Visualization? ... View more

[Updated] While the previous answers was to switch the default dashboard within app, the request here is for resetting the user specific default dashboard for Splunk login. This can be done via user-prefs.conf file which should be located under the following path for specific user... $SPLUNK_HOME/etc/users/<YourUserName>/user-prefs/local Please try removing following settings and see if Splunk home dashboard resets once you restart and clear browser's cache. default_namespace = launcher display.page.home.dashboardId= /servicesNS/nobody/<YourSplunkApp>/data/ui/views/<YourDefaultDashboard> Please try this out and let us know if you still face issue. PS: The user-prefs.conf file is also present under $SPLUNK_HOME/etc/apps/user-prefs/default. I hope you have not made changes to this file and if not please leave this file untouched. One of the crude way of doing this would be to recreate a new user with same roles/settings as the current user(without the default dashboard set.) Navigate to Home App and click on Settings > User interface > Views > Navigation Menu set default='true' against the one dashboard which you want to be default. <view name="contents" default='true' /> For details on Navigation Menu refer to one of the following: http://docs.splunk.com/Documentation/Splunk/6.4.6/AdvancedDev/BuildNavigation http://dev.splunk.com/view/webframework-developapps/SP-CAAAEP9 ... View more

You need to summarize data per hour (which implies you will reduce daily events from 30K*24 to 24). Then you will be able to run subsearches like appendcol without dropping data. Refer to sitimechart and collect commands on Splunk documentation for your reference. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sitimechart https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect ... View more

@DalJeanis yes... I was not sure of col field being available since it was not present in the query in question and also question did not mention about stats by col? Lets hope that @dcheng123 issue is resolved 🙂 ... View more

Is col your extracted field? Are you looking for group by time every second and not looking for group by col? <Your Base Search>| stats count as Count by col Based on what you have asked you can use bin with stats or timechart, either one with span=1s (provided you have multiple rows per second and data flowing in every second. If data flow is not every second you should have a longer span. | bin _time span=1s | stats count by _time Or | timechart span=1s count by _time ... View more

I am not sure of the purpose of this calculation, however, Earliest and Latest Time selected in a Search through Input Control are available as $job.searchLatestTime$ and $job.searchEarliestTime$ in preview and finalized search event handler. You can use eval attribute to calculate time span in seconds applied to search via time input. <search> <query>|makeresults </query> <earliest>$field3.earliest$</earliest> <latest>$field3.latest$</latest> <sampleRatio>1</sampleRatio> <preview> <eval token="SearchSpan">$job.searchLatestTime$-$job.searchEarliestTime$</eval> </preview> </search> You can then use the token in your form like in the following HTML panel <html> Selected Time Span=$SearchSpan$ </html> </panel> ... View more

You can use foreach command for template search (Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Foreach) <Your Base Search>| foreach "types.events."* [eval totalDomainResults=totalDomainResults + '<<FIELD>>'] Both the fieldname as well as field string <<FIELD>> need to be escaped with double quotes and single quotes respectively, since your field name contains special character dot (.) which is used for concatenation in eval statements. ... View more

what is the query/transforming command to calculate duration? ... View more

If you are just trying to find all the sourcetypes you can also try metadata command | metadata type=sourcetypes index=* | table sourcetype ... View more

@jababin...Glad that it worked 🙂 ... View more

@SNaikwade... Glad that it worked!!! Please accept the answers if it has helped. ... View more

@danje57 I have updated my answer based on the details you have provided... I have not printed all the required values but given you hints which you can use to do in case you need the same. ... View more

Run the following direcly in Splunk Search. Make use of rest generating command which outputs results in table. | rest /services/search/jobs/1488985371.7077_D6AE46D6-FC4C-48A5-9F24-7912363C18D1/results/ Refer to Splunk documentation for details: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rest ... View more

@bharpur183... Were you able to try as above? ... View more