Hi atanasmitev, try something like this: your base search here | rex "Stuff\\\"\:\\\"(?<myField>\w+)" | ... This will get you a new field called myField and matches any word character (alphanumeric & underscore). If there are other characters then the provided example, simply adapt the regex. small update: and if this fits your needs, add it as automatic field extraction - to do this follow the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Knowledge/Addfieldsatsearchtime Hope this helps ... cheers, MuS ... View more

Hi mrabbani, take a look at the docs to learn more about Splunk Free vs. Splunk Enterprise http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree#What_is_included_with_Splunk_Free.3F cheers, Mus ... View more

I will show an example using this run everywhere command and explain it line by line: First is the base search: index=_internal sourcetype=splunkd splunk_server=local earliest=-1h@h latest=-0h@h Next we do some eval to get some fake isFailure field: | eval isFailure=if(searchmatch("source"),1,0) Now comes the trick, do a simple stats count AS .. and provide any further needed values as well: | stats count as myCount sum(isFailure) AS isFailure Next, check if there were no search results, if so set the value of isFailure to "0" .If there were search results, set isFailure to the sum of the isFailure field: | eval isFailure=if(myCount=="0",0,isFailure) Now set the failuresCategory to different levels: | eval failuresCategory = case(isFailure=0,"low",isFailure<1000,"elevated",isFailure>=1000,"severe") and finally display it using table | table myCount, failuresCategory, isFailure Now, let do the no results search and see if this works: index=_internal sourcetype=splunkd splunk_server=local earliest=-1h@h latest=-0h@h this will bring back no results from the base search | eval isFailure=if(searchmatch("source"),1,0) | stats count as myCount sum(isFailure) AS isFailure | eval isFailure=if(myCount=="0",0,isFailure) | eval failuresCategory = case(isFailure=0,"low",isFailure<1000,"elevated",isFailure>=1000,"severe") | table myCount, failuresCategory, isFailure and the result looks like this: Instead of table you can use any command like chart or rangemap as well. hope this helps ... cheers, MuS ... View more

Hi markthompson, based on @martin_mueller 's answer and my comment, I did some research and tests, how this could be done without use of a sub search. It took a while, but here is what you can try and it should handle the case when there are no events at all during the search time range: index=project_omega host=PersistUBS | transaction startswith="Targeting file BP_Comp_Summ_Pos*" endswith="Server returned an error: No such file or folder" OR "The file was downloaded successfully." | search "Error" OR "Attempt 3...unsuccessful." | eval isFailure=if(searchmatch("Error") OR searchmatch("Attempt 3...unsuccessful."),1,0) | stats count AS myCount sum(isFailure) as failures | eval failure=if(myCount=="0",0,failure) | rangemap field=failures low=0-0 elevated=1-2 severe=3-15 default=15 hope this helps ... cheers, MuS ... View more

Hi shariinPH; from the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Viz/Datastructurerequirementsforvisualizations#Pie_charts Pie charts are one dimensional and only support a single series. They work off of tables with just two columns, where the first column contains the labels for each slice of the pie, and the second column contains numerical values that correspond to each label, determining the relative size of each slice. If the table generated by the search contains additional columns, those extra columns have no meaning in the terms of the pie chart and are ignored. This means your search will not work this way. But there are some ways you can achieve the target; try this run everywhere command: index=_internal OR index=_audit | stats count(buckets) AS buckets sum(kb) AS sum | transpose or something like this index=_internal OR index=_audit | eval type=case(isnotnull(kb), "kb", isnotnull(buckets), "buckets") | stats count by type adapted to your provide search string, something like this should work: index=myindexname sourcetype=mysourcetype | stats latest(field1) as postedpayments latest(field2) as exceptions | transpose hope this helps to get you started ... cheers, MuS ... View more

Hi seema2502, from the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/Automatearchiving Caution: By default, the indexer deletes all frozen data. It removes the data from the index at the moment it becomes frozen. If you need to keep the data around, you must configure the indexer to archive the data before removing it. You do this by either setting the coldToFrozenDir attribute or specifying a valid coldToFrozenScript in indexes.conf. You can verify with this command (on *nix) $SPLUNK_HOME/bin/splunk cmd btool indexes list | grep coldToFrozenDir if any valid directory is set or not. If not your frozen events are gone. cheers, MuS ... View more