Hi smarra, first use some regex to get the Country name as field like this: | rex "Country\sName\:(?<Country>\w+)\"" then use some stats on this new field like this: | stats count by Country So, by using something like this search command, you will get a statistical count of all blocked Countries: sourcetype=syslog id=firewall msg="*blocked*" | rex "Country\sName\:(?<Country>\w+)\"" | stats count by Country if this matches your needs, you can create this as search time field extraction . In this case the field will be available without the use of the regex. hope this helps to get you started ... cheers, MuS ... View more

Hi arber, you can use this REST search: | rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc and create an alert out of it. hope this helps ... cheers, MuS ... View more

Hi belka and ahartge, like everything in Splunk, this is set in a file. The file you're looking for is $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py and on line 1666 you will see this: # per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here? pwnrList = en.getEntities("authentication/users", count=250, search="roles=*") There was a reason (SPL-24818) to cap this and obviously you can change it back here as well. But be aware that any future Splunk update could/will overwrite this file and change it back to the value count=250 . hope this helps ... cheers, MuS and remember if you break stuff, you have to fix it 😉 ... View more

Hi kris99, you can use last() in your stats http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonStatsFunctions something like this should do the job: index=xx InMaintenanceMode=False | dedup MachineName,RegistrationState | eval avail=if(SessionState=="","t","f") | eval unreg=if(RegistrationState=="Unregistered","t","f") | stats count, last(eval(avail="t")) AS Available, last(eval(unreg="t")) AS Unregistered by SiteName,DesktopGroupName hope this helps ... cheers, MuS ... View more

Hi markthompson, that's exactly what you need to do, create a monitor stanza in inputs.conf (or in the UI, data inputs) that looks likt this: [monitor://directory/.../Logs/*] see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Specifyinputpathswithwildcards hope that helps ... cheers, MuS ... View more

Hi harshal_chakranarayan, you could do something like this: your base search to get this date field | makemv Date | eval dateone=mvindex(Date, 0) | eval datetwo=mvindex(Date,1) | table Serial Parameter dateone datetwo This is based on your example. hope this helps ... cheers, MuS ... View more

Hi somesoni2, check out this app https://apps.splunk.com/app/1871/ it will provide a custom command called refresh which will do exactly the same as calling the URI /en-US/debug/refresh hope this helps ... cheers, MuS ... View more

Hi czarny, check out this app https://apps.splunk.com/app/1871/ it will provide a custom command called refresh which will do exactly the same as calling the URI /en-US/debug/refresh hope this helps ... cheers, MuS ... View more