the base search used earliest=@d and later you used in the eval -7d@d so you will never get any data for the last_week 🙂 Try this for yesterday and today comparison: status=404 earliest=-1d@d latest=now | eval last_day=relative_time(now(), "-0d@d") | stats count(eval(if(last_day > _time, status, null()))) AS yesterday count(eval(if(last_day < _time, status, null()))) AS today by date_hour ... View more

Hi omgwut56k, based on the provided data, try this as regex: \/([\w\d]+)\. hope this helps ... cheers, MuS ... View more

The Add-on will not provide any view, it 'only' provides the inputs and CIM-compatible knowledge to use Nessus data with other Splunk apps, such as Splunk App for Enterprise Security and Splunk App for PCI Compliance ... View more

Hi junior87, looking at the inputs.conf of this app it says: ## EXAMPLE Nessus scripted input using user-defined directories, full paths # # Purpose: # # Converts .nessus format files (v1 or v2) to a Splunk-indexable format, # using the following directories as source and target: # # srcdir = /opt/nessus/incoming # tgtdir = /opt/nessus/parsed # # WARNING: This is only an example. # # To utilize this input as shown, a Splunk "monitor" stanza would also need # to be configured to index parsed output files from the custom directory # The configuration of the "monitor" stanza would need to be similar to # the configuration used for the default Splunk spool directory. # For instance: # # [batch://<path_to_custom_spool_directory>] # move_policy = sinkhole # crcSalt = <SOURCE> This means neither use srcdir nor tgtdir but setup a Splunk input monitor like in the [batch: ...] example or use the scripted input like this: [script://./bin/nessus2splunk.py -s /opt/nessus/incoming -t /opt/nessus/parsed] disabled = false interval = 120 index = _internal source = nessus2splunk sourcetype = nessus2splunk where -s is the source path and -t is the target path for the script. The target path will be monitored in Splunk. Hope this helps to get you started ... cheers, MuS ... View more

Okay, unless I completely misunderstood the question, try something like this : <dashboard> <label>click test</label> <row> <panel> <table> <title>search</title> <search> <query>index=_internal | chart count by sourcetype</query> <earliest>0</earliest> <latest></latest> </search> <option name="wrap">undefined</option> <option name="rowNumbers">undefined</option> <drilldown target="_blank"> <link> <![CDATA[ /app/search/search?q=search%20$click.value2$ ]]> </link> </drilldown> </table> </panel> </row> </dashboard> ... View more

You need to test it; but I assume it does ... View more

By default they are exact matches, but you could use a wildcard lookup like in @Ayn 's answer here http://answers.splunk.com/answers/52580/can-we-use-wild-characters-in-lookup-table.html So using a csv file like this dest_port | application 500* | application1 should work for port ranging from 5000-5009 ... View more

Hi the_wolverine, the docs provide some examples here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/Understandbasictableandchartdrilldownactions#Drilldown_event_tokens and here http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/PanelreferenceforSimplifiedXML#Drilldown_elements and one more here http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/Dynamicdrilldownindashboardsandforms hope this helps ... cheers, MuS ... View more

It's all in the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/RESTREF/RESTaccessExamples#authentication.2Fusers.2F.7Bname.7D_POST read it, try it with a test user - succeed 😉 ... View more

in addition to @lguinn 's answer, if you want to learn more on this topic, check out this answer http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html cheers, MuS ... View more

Hi kknopp, I don't see any problem, maybe you need do use some capturing group in your regex like this: sourcetype=syslog | head 1 | eval foo="ManageAccount.do?ACTION=VIEW&id=27271905&acctViewType=transactions" | rex field=foo "\w+\.\w+\?\w+=(?<ACTION>\w+)&id=(?<id>\d+)&acctViewType=(?<ViewType>\w+)" | table ACTION, id, ViewType I used this on splunkstorm and it works perfectly - producing a result like this: The sourcetype=syslog | head 1 | eval foo="ManageAccount.do?ACTION=VIEW&id=27271905&acctViewType=transactions" part is only to generate your event data, so you will not need to do it....simply do something like this: your base search here | rex "\w+\.\w+\?\w+=(?<ACTION>\w+)&id=(?<id>\d+)&acctViewType=(?<ViewType>\w+)" | table ACTION, id, ViewType cheers, MuS ... View more

HeHe, true forgot about that option 🙂 ... View more

Hi calbree, check out the docs about indexes.conf and set coldToFrozenScript http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Indexesconf if you don't set that option, data is deleted when rolled to frozen. coldToFrozenScript Specifies a script to run when data will leave the splunk index system. Essentially, this implements any archival tasks before the data is deleted out of its default location. hope this helps ... cheers, MuS ... View more

How about the $SPLUNK_HOME/bin/splunk status command which will provide a list of all processes and pid's like this: splunkd is running (PID: 1291). splunk helpers are running (PIDs: 1292 1299 1537 1598). ... View more

This will: | tstats count where host="srv*dc*" by host, _time span=1h ... View more

Hi dominiquevocat, do you use the dashboard.js from the simple_xml_example app? This will load the SourceViewer from this app. Also consider setting in web.conf of your testing/develpoment search head: js_no_cache = True you can always refresh the content of the static directory by accessing this URI: http://<yourSplunkServer>/en-US/_bump Another helpful feature is to restart only the web service, which will btw not end any user session: splunk restart splunkweb don't forget your browser is also caching, so do a reload form time to time CRTL + ALT + R hope this helps ... cheer, MuS ... View more