Hi Fares_alarabi, contact any sales team near you to get a quote http://www.splunk.com/view/contact-us/SP-CAAAAH7 cheers, MuS ... View more

Hi dolejh76, Try something like this: Your base search here AND error1234 | bucket _time span=1h | stats count by host | where count>2 Hope this helps... cheers, MuS ... View more

Hi edookati, you can use either list or values within the timechart but if you really have multiple results within one second the graph could look strange. Nevertheless try something like this: index=jms_logs sourcetype=perflogs operation_name="RSA*" | timechart span=1s list(response_time) or index=jms_logs sourcetype=perflogs operation_name="RSA*" | timechart span=1s values(response_time) list will bring back all values and values only the distinct values for all events, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/CommonStatsFunctions cheers, MuS ... View more

Hi dolejh76, try something like this: your base search here | timechart span=1d count by host hope it helps ... cheers, MuS ... View more

Hi Laya123, try something like this: index=ibm sourcetype=act host=KO*MRI65* OR host=KO*MRI75* | rex field=_raw ".*.*ACT,(?[0-9]+ - [0-9|a-z|A-Z]+),.*" | rex field=_raw ".*ERROR: (?.*)" | eval Tier=if(match(host,"KO...MRI65."), "Launch", "Publish") | transaction activationID maxevents=10000 startswith="RemoteActivateServer START" | eval ProjectStatus=case(match(_raw,"Connecting to DPM") , "Queued" , match(_raw,"Project .* activated"), "Activated" , match(_raw, "Activate failed"), "Failed") | table activationID ProjectStatus This was not tested - now it is. Still, maybe you need to adapt it to your needs; but it should get you started ... cheers, MuS ... View more

Hi HeinzWaescher, The search command has two functions: used at the beginning of a search pipeline, it retrieves events from an index(es); used elsewhere in the pipeline, it filters the results of a previous search command. The where command also filters the results of a previous search, but it uses the same expression syntax as the eval command and keeps only the results for which the evaluation was successful. In other words, use where to filter/search/compare two fields and use search if you want to filter/search a specific value of some field. hope this helps ... cheers, MuS ... View more