If all events in your indexed csv file show the same time, it implies splunk was unable to parse timestamp available under the Event Date field and defaulted to file modified timestamp which is the last logic for Splunk to identify event timestamp. You should consider reindexing data properly with correct event time stamp. (Refer to attached screenshot). Option 1 Please re-index by adding a single file csv file and making sure Splunk is able to read Event Timestamp from Event Date field. Select the Timestamp format as %m/%d/%Y and Timestamp Fields as Event Date. (ideally splunk fields should not have spaces otherwise most of the SPL commands would required you to use single quote or double quote to identify field name with space. In your case see if you can modify csv column headers to Site_Section and Event_Date instead). Also you should try to create your own custom sourcetype like <YourCustomSourcetype>_csv instead of using existing csv sourcetype if you have done some custom properties definition. Option 2 You can modify the props.conf file in your existing splunk app's local folder for sourcetype [csv] and add the following for correct timestamp identification. TIME_FORMAT=%m/%d/%Y TIMESTAMP_FIELDS=Event_Date For details on setting the sourcetype from the following links (please do your due diligence around defining sourcetype as this is the most crucial task for Splunk which helps it identify Time Stamp and events properly): http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Configuretimestamprecognition http://docs.splunk.com/Documentation/Splunk/6.5.1/admin/Propsconf http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Whysourcetypesmatter If you choose either of the above two options, your time selection should work and allow you to pick as per the conditions you have defined like this week, previous week, previous month etc. Since you do not have time field in Event Date, you will still not have event time which is defaulted to 12:00 AM for everyday's events. (PS: If your CSV file has separate Event Time column as well, try to include that also as TIMESTAMP_FIELDS (comma separated) for required precision.) I would not recommend having events with incorrect timestamp and afterwards modifying your Splunk query to parse/modify Event Date field afterwards. Time based filter of your input data in your base search will perform better than filtering afterwards using a where clause. ... View more

@rberse the issue could be because of Real Time queries. Alternatively try to see if you can Run dasahboard queries without Realtime time span and refresh required panels of dashboard in near real-time kind of way like every one minute. (Refreshing individual Dashboard panel is a feature of Splunk 6.5.x). <earliest>-24h@h</earliest> <latest>now</latest> Instead of the following: <earliest>rt-24h@h</earliest> <latest>rtnow</latest> In case it is required to run Real Time dashboard (which would not be a recommended approach) you would need to upgrade your underlying Splunk Infrastructure hardware. PS: You would also need to include all the search optimization techniques for improving query performance and reducing number of events pulled/loaded in the dashboard. ... View more

Try the following stats command. You should filter/join results in your base search (i.e. if Path and OperationName have static values, then use the values in place of asterix *. Duration is calculated as the difference between earliest and latest events matched by the stats command containing both Request and Response. It is in seconds which you can change to other time format as per your need. Second search can be used to set conditions based on various scenarios like eventcount=1 implies only request no response. <Your Base Search> "[LOG ][WARN ]" (CaptureLocation="Request" OR CaptureLocation="Response") Path=* OperationName=* | stats count as eventcount earliest(_time) as earliesttime latest(_time) as latesttime values(TransactionStatus) as TransactionStatus values(RequestPayload) as RequestPayload values(CaptureLocation) as CaptureLocation by transid, Path, OperationName | search eventcount>1 AND TransactionStatus= "SUCCESS" AND CaptureLocation="Request" AND CaptureLocation="Response" | eval duration=latesttime-earliesttime | eval earliesttime=strftime(earliesttime,"%Y/%m/%d %H:%M:%S,%3N") | eval latesttime=strftime(latesttime,"%Y/%m/%d %H:%M:%S,%3N") PS: Depending on the use case if there is always Request first and Only one Response per transaction ID you can also set eventcount=2 in the inner search condition. ... View more

I also tried manually by adding however, the same does not refresh the panel. There are other "new" features of Splunk 6.5 which work only in XML and not HTML like the table cell color. So, see if you can use the other option to refresh the entire dashboard through above option or else, request a Splunk Enhancement case by calling in support. "refresh":"30s", ... View more

You can use replace in two ways and both of them should work as far as String with space should be placed within double quotes. <your base search> | replace "Android Phone" with AndroidPhone, "Android Tablet" with AndroidTablet in sitesection | top limit=5 useother=t sitesection You can also use replace recursively with eval: <your base search> | eval sitesection=replace(replace (sitesection,"Android Phone","AndroidPhone"),"Android Tablet","AndroidTablet")| top limit=5 useother=t sitesection Using Rex to remove spaces within field. <your base search> | rex mode=sed field=sitesection "s/ //g"| ... View more

How about when you convert from number to string? <your base search> | eval a=tostring(a) | eval b=trim(a) ... View more

Could you please clarify whether you want to see total of IOPS for all devices or average of all IOPS? If possible with dummy data examples as table. I would expect sum() and max() as the stats to be used in the following case instead of average unless if that is what you want to show for all IOPS by Devices. Following will show single TotalIOPS line on top of your existing series. index="os" source="iostat" host="splunk" | eventstats max(total_ops) as Total | timechart span=5m max(total_ops) as Max max(Total) as Total by Device |fields - "Total: sdb" "Total: sdc" | rename "Total: sda" as Total | <use fields - to remove other Total fields> | <rename one of the Total field as per your need> Finally, create Chart Overlay with Total series. If you want to perform overall average then you can use avg(total_ops) instead of sum(total_ops). ... View more

I am assuming you are trying Panel refresh in Splunk 6.5. I don't think the new feature of Splunk 6.5 to refresh XML panel by setting refresh option for panel search is available once you migrate it to HTML and might require you to request an enhancement. <refresh>30s</refresh> However, if you can refresh the entire dashboard then you can Option 1: Add the following in XML (to refresh dashboard every 5 min i.e. 5*60) <dashboard refresh="300"> PS: for Form similarly refresh command will be <form refresh="300"> Option 2: Or else add the following code in HTML (to refresh dashboard every 5 minutes): submitTokens(); setTimeout("location.reload();", 300 * 1000); // // DASHBOARD READY // ... View more

I am not sure of exact query that might work for you, however you should consider eventstats to add the COUNTOFEVENTS to each event and then compute TOTAL. index="main" sourcetype="any1" FIELD1="A" OR FIELD1="B" OR FIELD1="W" FIELD1="X" OR FIELD1="Z" | eval TYPE=case(FIELD1=="A" OR FIELD1=="B","Type1",FIELD1=="W" OR FIELD1=="X" OR FIELD1=="Z","Type2",1==1,"UNKNOWN") | lookup data.csv TYPE | eventstats count as COUNTOFEVENTS values(PRICE) as PRICE by TYPE | eval TOTAL=PRICE*COUNTOFEVENTS | stats values(COUNTOFEVENTS) as COUNTOFEVENTS sum(TOTAL) as TOTAL | fillnull value=0 TOTAL PS: I think the query might work without values(PRICE) as PRICE also. ... View more

You should consider using Multiselect Box which has Drop Down also. Refer Splunk Documentation : http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/FormEditor#Multiselect http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Define_tokens_for_multiselect_inputs ... View more

Option 1 You can you format or sep command as per your need to rename column header. Refer to xyseries documentation: http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Xyseries xyseries column headers will be in AGG:VALUE format. Option 2 You can also rename columns before piping with xyseries for desired output column name. Option 3 You can rename columns afterwards using rename command or eval command. But this will be tedious. ... View more

Try the following rex command: rex field=_raw "Time \(in seconds\) = (?<TimeInSec>\d+\.\d+)" PS: Once tested push to props.conf as Field Extraction Knowledge Object, through Interactive Field Extraction or editing props.conf directly. ... View more

Are you getting an Error or result count is zero? Please check date format in your table column END_DATE. Please also check if you are getting any error while running the query or by querying splunkd logs for DBX entries for checking query execution. PS: I was able to pull the same using Oracle dummy HR table and your WHERE clause. Please find screenshots from db connection validation query and dbxquery. | dbxquery connection=OracleConnection query="SELECT * FROM HR.EMPLOYEES E WHERE TO_DATE(E.HIRE_DATE,'DD/MM/YYYY') < TRUNC (SYSDATE)" maxrows=10 shortnames=t ... View more

Refer to "Dynamic Drilldown" example on Splunk 6.x Dashboard Examples app. There are various examples, however the one you are interested in is "Table panel with dynamic drilldown that passes the clicked row's 'count' column value to populate a form" <drilldown> <link>/app/<YourAppName>/<YourDetailDashboardName>?form.M_Number=$row.M_Number$</link> </drilldown> You even have an option to do a contextual dynamic drill-down within the same dashboard. Refer to "In-Page Drilldown with Perma-linking" example as well, if you don't want users to be redirected to a separate page. ... View more

Currently are you seeing all event codes from Security and not just 4663? When you disable the WinEventLog://Security does it stop sending the events? [WinEventLog://Security] disabled = 1 ... View more

Option 1 You will have to prefix your ApplicationGroup values with "1. 0-10", "2. 10-20", "3. 20-30" etc. your search | replace "0-10" with "1.0-10" in ApplicationGroup | replace "20-30" with "2. 20-30" in ApplicationGroup | ... Option 2 If this works you can actually define your own lookup and map "0-10" to "1. 0-10". For example, if you create a lookup date_hour_chrono like the following example, you can use the query give below: Date_Hour, Date_Hour_Chrono "0-10","1. 0-10" "10-20","2. 10-20" "20-30","3. 20-30" ... ... your search | lookup date_hour_chrono Date_Hour as Application_Group OUTPUT Date_Hour_Chrono | your remaining search Option 3 One more option that you might have provided your query uses actual date_hour field extracted by Splunk from your event timestamp then you can feed the same to Splunk Punchcard visualization which plots Heat map across time series in both x and y axis and arranges according to time field selected like date_hour, date_wday etc. ... View more

Try the following: whitelist=EventCode="^4663$" ... View more

@martin_mueller aren't there a search optimization thumb rule? 1) Use Search filters as early as possible in the search and 2) Use dedup in search as early as possible. Since actual performance is use case specific @g038123 should try both options and check Job Inspector to compare search response time. ... View more

After converting to HTML seems like options remains empty in HTML, so seems like a bug. "format": {"log_level": [{"type": "color", "options": {}}]} , The only example I found was for sparkline options for TableElement, and no information available for colorPalette {"INFO":#5378AD,"ERROR":#98BF3B,"WARN":#F0BE1B}. Since, the SplunkJS reference talks only about setting sparkline and not colorPalette through TableView/TableElement, I was unable to find what exact code to be put in options. Splunk should fix this and also update the Web Framework Documentation. In your situation, I would suggest use Table Cell Highlighting example from the Simple XML Examples App to color the priority field based on values. The example use Simple XML Extensions, to introduce a custom cell render for the Table View using CSS to apply colors for specific cell values. See if that solves the need. ... View more