this should provide the correct count: index=xyz event="NEAT-IN" OR event="pushApns" platform="APNS" | stats count(eval(event="NEAT-IN")) AS count_NEAT count(event="pushApns") AS count_push ... View more

No, can you provide some samples of your events? ... View more

read the docs about DB connect http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Installtheconnector and the dbquery command http://docs.splunk.com/Documentation/DBX/1.1.6/DeployDBX/Commands ... View more

or try this: index=xyz event="NEAT-IN" platform="APNS" OR event="push*" | stats count(eval(event="NEAT-IN")) AS count_NEAT count(eval(if(match(event, push) , 1, 0 ))) AS count_push by platform, batch ... View more

could be try it without the star/wildcard and use the value you need instaed ... View more

no need to join, try this: index=xyz event="NEAT-IN" platform="APNS" OR event="push*" | stats count(eval(event="NEAT-IN")) AS count_NEAT count(eval(event="push*")) AS count_push by platform, batch cheers, MuS ... View more

Never mind, I used your provided samples and created a simple search which you can use. It's the one in the answers 😉 ... View more

well use the time range picker to apply a time range to your search or use head after your search http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Head ... View more

Hi rsathish47, check your Splunk logs like this: index=_internal source="*scheduler.log" this will bring up all information about the scheduled searches. You can find more information on other Splunk internal messages if you leave the source from the search. You can find some pdf related messages in python.log for example and you can increase logging channels to get more detailed messages back http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Enabledebuglogging hope that helps ... cheers, MuS ... View more

Hi henry_ty_leung, sure, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Inputsconf where you can learn how to set a sourcetype for an input: sourcetype = <string> * Sets the sourcetype key/field for events from this input. cheers, MuS ... View more

please provide more details, like do you want to search for searches that literally failed (the search itself?) or do you want to run a search that searches for events that contain the value failed ? ... View more

Hi henry_ty_leung, No you cannot. You could create a custom script that is triggered after the search is done and the outputcsv has written the file and explicitly put it into a Splunk bin folder to move / copy file to the final directory http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/AddthecustomcommandtoSplunk The reason why this was done, is partly security related; to prevent search users from being able to have Splunk create files in arbitrary locations. hope this helps ... cheers, MuS ... View more

Ah, okay, an app or SA or TA are basically the same thing. It's like in the docs writen a collection of settings. All work the same way and this is explained in the docs as well http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Wheretofindtheconfigurationfiles ... View more

Hi user21041983, Check out the docs docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Whatsanapp Cheers, MuS ... View more

take a look at this: http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html to get an idea how to get this done a different way .... because join should be a last resort .... not the first option to use ... View more

I second that comment by @martin_mueller 😉 ... View more

Hi a212830, check out this wiki http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings and have a closer look at the props.conf in the parsing and the search section. Depending on your config it will either be the indexer or the search head. hope this helps ... cheers, MuS ... View more

As well check if the user exists and read this docs http://docs.splunk.com/Documentation/Splunk/6.2.0/installation/RunSplunkasadifferentornon-rootuser ... View more

Hi blee2, my approach would be to send this data / events directly to this separate Splunk 6.2 server. If this is not possible for what ever reason; any Splunk instance doing event parsing (Heavy forwarder or Indexer(if no heavy forwarder is in front of it) for example) can do filter and routing. Take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding this should give a lot of hints how this could be done. BTW an indexer can be a heavy forwarder at the same time 😉 cheers, MuS ... View more

You're running the script to get the cpu stats every 5min right? Your spiky graph caused by this if you decrease the interval and get more results the smoother the graph will be ... View more

you can link any picture web page like tiny url, no need to upload a picture 😉 ... View more

sure this is why chart does not aggregate like timechart does and as another pointer, did your try other formats for your chart? You can also change the behavior of the lines for example no results (connect, treat as zero ...) ... View more

Hi mark.chuman, timechart will do aggregation on the event values, if you don't need/want that to happen use stats or chart like this: index=perfstats host=servername | stats avg("%_Privileged_Time") AS avg_PrivTime max("%_Privileged_Time") AS max_PrivTime min("%_Privileged_Time") AS min_PrivTime by host, _time or index=perfstats host=servername | chart avg("%_Privileged_Time") AS avg_PrivTime max("%_Privileged_Time") AS max_PrivTime min("%_Privileged_Time") AS min_PrivTime over _time by host Both results are basically the same like using timechart, but without the aggregation. hope this helps ... cheers, MuS ... View more