Hi crahimi, did you check this answer http://answers.splunk.com/answers/137114/adblock-and-splunkweb.html ? cheers, MuS ... View more

And why could this be bad? ... View more

look, @martin_mueller did provide a way to go by using a subsearch and I did show you a way without using one. If you don't want to use any of them I suggest you to start here http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial ... View more

chrismok, do you have any results on this by now? I wonder which approach will be the fastest for you. Thanks for sharing the results. ... View more

update ping ... View more

sure, I'll have a look at it tomorrow.... ... View more

So this Eventype is a field in your events/data and not the eventtype search command from Splunk, right? The Splunk eventtype search command is like a symonym for a search string; for example eventtype=error translates to the search error OR fatal like in the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/eventtypesconf ... View more

more like relative_time(now(), "@min") ... View more

Hi sjanwity, you can not only use -1min with relative_time() , you can use also things like -1min@min or -2d@d which will snap to the minute or hour. See the docs for more information on this topic http://docs.splunk.com/Documentation/Splunk/6.1.2/Search/Specifytimemodifiersinyoursearch cheers, MuS ... View more

is the path correct? which inputs.conf did you modify? what did you see if you run $SPLUNK_HOME\bin\splunk cmd btool inputs list monitor on the forwarder? ... View more

you're welcome 😉 ... View more

Hi shellnight, if you look at this run everywhere command: index=_internal earliest=-24h source="*metrics.log" | bucket _time span=10min | stats count(eval(max(kb) >= 200)) AS myCount by _time, series, host, kb | where myCount > 6 AND NOT series="summary" does this provide a result you expect? The search runs over the last 24 hours, builds _time buckets of 10 minutes, counts how many times a series had more then 200 kb throughput per 10 minutes, filters out series="summary" and also results which have less than a count of 6 (6 times a 10min bucket makes up one hour). Update: Try this, maybe you have to adapt the field names..but, this will point you towards the solution. I don't know if this is a copy/paste answer. index=server | bucket _time span=1h | stats count(eval(event-type="high mem-ultilzation")) AS hi-men-count count(eval(event-type!="high mem-ultilzation")) AS other-count by _time, event-type, host | search (event-type="high mem-ultilzation" AND hi-mem-count>="3") OR (NOT event-type="high mem-ultilzation" AND other-count>="0") | eval count=if(other-count=="0", hi-mem-count, other-count) | table event-type, host, count cheers, MuS ... View more

Make sure you tick the Use eval-based definition? in the macro settings! Then it will work and should be pretty fast as well 😉 hmm, cannot add a screenshot here??? ... View more

Well there must be something wrong, because this works for sure. If I run a search like this: index=main source=*`yesterday`* it becomes this litsearch litsearch index=main source=*04-Nov-2014* and returns events .... ... View more

Take a closer look at the S.o.S. Add-on https://apps.splunk.com/app/870/ within that Add-on you find a scripted input that almost does what you want. Other examples can be found in the Unix App Add-on https://apps.splunk.com/app/833/ cheers, MuS ... View more

because this is not the answer to your question I will post it as comment: Maybe you will have a look at this answer http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html to get an idea how to do it without the use of join or any subsearch ... View more

another approach just came up my mind: if you always need today's or yesterday's date in the source name, than you could use an eval based macro containing something like this: strftime(relative_time(time(), "-d"), "%e%b%Y") If your macro is named yesterday you can use it like this in your searches: index=foo source=*`yesterday`* | ... ... View more

another approach just came up my mind: if you always need today's or yesterday's date in the source name, than you could use an eval based macro containing something like this: strftime(relative_time(time(), "-d"), "%Y%m%d") If your macro is named yesterday you can use it like this in your searches: sourcetype=depmon_sys_rel_log source=*`yesterday`* | ... ... View more

looking at this picture, it's absolutely clear why your first search is the fastest: using any fields like index or source in the base search will speed up the search. Using a sub search will basically double search times but also speeds up the base search because you can use source in it and mine example simply does not provide any source field in the base search. ... View more

upps my bad...try this updated command: ... | eval file_date=strftime(now(), "%Y%m%d") | eval mySource="." + file_date + "." | where match(source, mySource) | ... ... View more

Hi chrismok, you're absolutly right regarding the performance. Try this instead: ... | eval file_date=strftime(now(), "%Y%m%d") | eval mySource="*" + file_date + "*" | where source=mySource | ... hope this helps ... cheers, MuS ... View more

please clarify/specify what details you mean? ... View more

Hi hermanath_ofc, try something like this after the transaction: ... | rex "\s(?<myStart>(\d+[:\.]){3}\d+)\sGetAckNak\sSent" | rex "\s(?<myStop>(\d+[:\.]){3}\d+)\sGetAckNak\sRecv" | ... to get the times for the needed events. hope this helps ... cheers, MuS ... View more