@lksridhar Please let me know if this solves your problem or not. ... View more

Can you add a screenshot of your Computer field. Seems like you have a multi-valued field where you can use all the even indexes for Computer and odd indexes for IP Addresses i.e. eval Computer1=mvindex(Computer,0) | eval IPAddress1=mvindex(Computer,1) | eval Computer1=mvindex(Computer,2) | eval IPAddress1=mvindex(Computer,3) | ... Please let me know whether you want to do something like above, then you can use foreach to iterate through your records. Also if the field is formed as multi-valued by your search query, you can also try to see if there is a feasibility to split them upfront rather than using mv commands. ... View more

Since you have variety of events and conditions, you should use separate dropdown/checkbox inputs between each field dropdown to explicitly select what you need. By default you can have all AND selected. ... View more

You should define a lookup table for mapping values of System and Host. For example system_to_host.csv System, host Pancakes, host1 Pancakes, host2 Pancakes, host3 Cookies, host4 Cookies, host5 Cookies, host6 Your first input dropdown System Name, should have the following code <input type="dropdown" token="System" searchWhenChanged="true"> <label>System Name</label> <choice value="*">All</choice> <choice value="Pancakes">Pancakes</choice> <choice value="Cookies">Cookies</choice> <default>*</default> </input> PS: I have added default value All to map to * and match all results for both inputs. Your second input Host Name should be built from Dynamic Search query based on value selected in System Name. Provided you have created Lookup Definition system_to_host from the above csv file, following is your second dropdown code : <input type="dropdown" token="host"> <label>Host Name</label> <choice value="*">All</choice> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <search> <query>| inputlookup system_to_host | search System=$System$ | table host</query> </search> </input> ... View more

By default the search filters have a logic AND between them, if you do not specify the same explicitly. All you need to do is add OR between all the filters you want to use. (index=AUTH OR index=EXTERNAL_APP) AND (UserID=$userid$ OR PID=$pid$ OR SPID=$spid$ OR IP=$ip$) | table _time AppID UsreID Session IP SystemID PID SPID Page Function FName MI LName Address Email Also in your table change _time to be the first column and result will be automatically sorted based on first field. This should save you one additional final sort query, ... View more

Yes since it affects all Line series, I usually try creating chart as Column. So, only overlaid field is line and remaining are column. I do use fieldColors and seriesColor for all the series to have differnt prominence. ... View more

Since host is a metadata index-time extracted field for any sourcetype, you will need to provide a separate field extraction name. Since Splunk is case sensitive for Field names, I am using Host as the extracted field name in following options: Option 1) Use Extract New Fields option from your Search results. Interactive Field Extractor will give you options to use Splunks regular expression or define your own. You can define your own extraction as host\=\"(?P<Host>[^,]+)\"\, Option 2) Use inline rex command to extract host. (PS: rex command should only be used for initial testing, ideally you should use Option 1 or 3 to create a Field Extraction Knowledge Object. rex field=_raw "host\=\"(?P<Host>[^,]+)\"\," Option 3) Modify props.conf to create your own extraction for sourcetype alerts EXTRACT-Host = host\=\"(?P<Host>[^,]+)\"\, PS: Other fields should be automatically extracted by Splunk. If not you can apply above options with respective regular expressions. In order to test your regular expressions you can try regex101 website. ... View more

Try the following: <option name="charting.lineDashStyle">dashDot </option> Following are various option for series style: (dashDot | dot | longDash | longDashDot | longDashDotDot | shortDash | shortDot | shortDashDot | solid) Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference ... View more

Can you give what field is the pie chart built on and what is the search you want to run when the Pie chart is clicked? ... View more

I think above should still solve your problem. The token allValues will be set when you click on Pie Chart. In your search you can use [YourFieldName]=$allValues$ ... View more

When you pick Calculate relative changes option in Horizon Chart (default behavior), then relative data points are displayed based on the first value in the series considered as baseline. If you un-check this option you will see actual value for each data point. ,When you choose Calculate relative changes, baseline is the first data point of the series. This option is enabled by default. ... View more

@lguinn SPL is case sensitive for Field Names and not field values. Which implies all of the following three are different Field1, FIELD1 and field1. I think it is up to the developer's Field Naming conventions and Splunk will not mind or complain about field casing. When we are naming fields ourselves, especially through cvs files, we should be cautious not to start field names with number also not to have spaces. Splunk handles both but not so "gracefully" I would say. Field values are case insensitive. Infact all SPL keywords (and even SPL commands can be in Uppercase as well) and Splunk will not complain. Following is the documentation on transitioning from SQL to SPLUNK: http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/SQLtoSplunk ... View more

Try the following search: index="main" sourcetype="any1" FIELD1="A" OR FIELD1="B" OR FIELD1="W" FIELD1="X" OR FIELD1="Z" | eval TYPE=case(FIELD1=="A" OR FIELD1=="B","Type1",FIELD1=="W" OR FIELD1=="X" OR FIELD1=="Z","Type2",1==1,"UNKNOWN") | lookup data.csv TYPE |stats count as COUNTOFEVENTS sum(PRICE) as TOTAL by TYPE | fillnull value=0 TOTAL Use Case statement to match FIELD1 values as A OR B to determine Type1, and W, X Z for Type2. I have created default case 1==1 to call all other values of FIELD1 as UNKNOWN, however that is just a fail safe which should not occur. Since I have already filtered required FIELD1 values in my base search as A, B, W, X, Z. This is recommended search approach to filter required events as early as possible. If you put FIELD1=* as the only base search filter for FIELD1 then you would be able to get UNKNOWN Type, provided your events have FIELD1 values other than A, B W, X, Z as well. PS: Your data.csv example has price with comma. I think it should be decimal. ... View more

Could you please confirm whether you want single query to do all three or separate queries will work? Identifying single child and all parents would be possible as two separate queries if that works for you. ... View more

I don't think issue is with Windows 7 as we also face similar issue. I expect that to be related to IE since this issue occurs when my co-worker (who prefers IE) edits the dashboard and spaces between fields - is removed. Try changing to Google Chrome browser and see if you still get the issue. Also maybe we both should open a ticket with Splunk on the issue, as so far I thought it was an issue only with my co-worker's machine. ... View more

I am not able to correlate the pattern of all your three examples. Do you want single search to do all three? or they are three different scenarios you want to capture? In any case here is the search string for first case of 783 example (I have used my own input lookup csv file similar to what you have provided and searchField is hard-coded as 783 which you can have a input Dashboard form) | inputlookup account_tree | eval searchField=783 |where account=searchField OR parent=searchField | eval parent=if(parent==searchField,parent,0) | fields - searchField Following is the output: account parent 126 783 125 783 124 783 123 783 783 0 ... View more

I had checked my previous regular expression on Regex101. Not sure what is not working. Maybe some special character in the actual data that you have is not showing up properly in Splunk Answers post here. So try a simpler extract. Basically, I am trying to get everything between CST and Total as String. index=ABC source="abcd/efgh/ijklm" SearchController OR Transaction | rex field=_raw "\sCST\s(?<String>\.*)\sTotal:\s(?.\d+)" | Table String, _time, Total Further if you are not experienced with Regular Expressions try erex and definitely do this through Interactive Field Extraction (Splunk will write the regular expression for you). ... View more

Following will extract Both String and Total using rex. However, do try out Interactive Field Extraction to ensure that your regular expression is matching all required events. rex field=_raw "^\w{3}\s\d{2}\,\s\d{4}\s\d{2}\:\d{2}\:\d{2}\s(A|P)M\sCST\s(?<String>.*) \- \<\=\= Total:\s(?<Total>\d+)" Further looking at your sample data and search query. Try to add sourcetype in base search instead or source. If you are using source, I hope you have wildcard included. Your base search also filter out only required contents like "CST DEBUG" and "- <== Total:" should be present in your base search. I am not sure what does the following do in your base search SearchController OR Transaction, since it is not a field I was expecting them to be a part of the logs. ... View more

Do you want the following to be string? DEBUG (BaseJdbcLogger.java:139) ... View more

Can you whether your base search is returning results or not? index=ABC source="abcd/efgh/ijklm" SearchController OR Transaction I had checked the your sample data on regex101 Nov 30, 2016 09:31:04 AM CST ABCD (BaseABCD.java:139) - <== Total: 351 and following regular expression was working fine Total:\s(?<Total>.\d+) Could you also please confirm whether there is actually a newline character before - <== Total: 351 or not? If possible add sample data as is from your logs. ... View more

Following is with eval for 4 sample fields A-txt1, B-txt1, A-txt2, B-txt2: <your base search> | eval AB-txt1='A-txt1' + ":" + 'B-txt1' | eval AB-txt2='A-txt2' + ":" + 'B-txt2' | table _time week AB-txt1 AB-txt2 Following is with foreach for above eval(you can have n number of fields below, However, final table comand needs to be adjusted: <your base search> | foreach *-txt* matchseg2="#matchseg2#" [eval AB-txt#matchseg2#='A-txt#matchseg2#' + ":" + 'B-txt#matchseg2#'] | table week AB-txt1 AB-txt2 ... View more

Do you have access to Splunk on Splunk (SoS App) or else built in Distributed Management Console (DMC) app? You should be able to perform health check if you are running latest Splunk Enterprise version 6.5. Even if you don't you should be able to check License usage/distribution and Indexing Buckets usages/performance related stats etc. ... View more

Option 1 Use Splunk on Splunk (SoS App) or Distributed Management Console (called Management Console in Splunk 6.5) to validate Indexing bucket performance and stats. DMC should have optimized searches which you can run to check out yourself. Option 2 Use Splunk generating command dbinspect. | dbinspect index=_internal | search tsidxState="full" | stats min(startEpoch) as MinStartTime max(startEpoch) as MaxStartTime min(endEpoch) as MinEndTime max(endEpoch) as MaxEndTime max(hostCount) as MaxHosts max(sourceTypeCount) as MaxSourceTypes sum(eventCount) as TotalEvents sum(rawSize) as TotalRawDataSizeMB sum(sizeOnDiskMB) as TotalDiskDataSizeMB by state | eval TotalRawDataSizeMB =round((TotalRawDataSizeMB/1024/1024),6) | eval MinStartTime=strftime(MinStartTime,"%Y/%m/%d %H:%M:%s") | eval MaxStartTime=strftime(MaxStartTime,"%Y/%m/%d %H:%M:%s") | eval MinEndTime=strftime(MinEndTime,"%Y/%m/%d %H:%M:%s") | eval MaxEndTime=strftime(MaxEndTime,"%Y/%m/%d %H:%M:%s") | eval PercentSizeReduction=round(((TotalRawDataSizeMB-TotalDiskDataSizeMB)/TotalRawDataSizeMB)*100,2) Refer to Splunk documentation on DBinspect to come up with query that you need. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dbinspect ... View more