did you check the docs http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Configuretimestamprecognition ? ... View more

This works on all those online regex testers .... try not to use any ^ or other special signs in the regex. ... View more

or a bit more compact regex like this: (\d{2,4}[\-\/\:\.])+\w+ ... View more

this works up til the timezone, if you need the TZ as well try this: \d{4}-\d{2}-\d{2}/\d{2}:\d{2}:\d{2}.\d{3}\/\w+ ... View more

as addition: If you're on Splunk 6.x you can open this URL and get the same: http[s]://YourSplunkServerName:YourSplunkWebPort/app/search/status_index ... View more

Hi malat_UoM, maybe not the answer you did expect, but take a look at this answer http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html to get some nice examples on how you could do this without using append . Hint: eventstats or streamstats are your friends .... cheers, MuS ... View more

Hi aweitzman, it is possible to use two different time ranges in one search, see this http://answers.splunk.com/answers/153336/is-it-possible-to-use-earliest-twice-in-one-search.html cheers, MuS ... View more

got it working, cleaning up the code now 😉 ... View more

please mark this as answered, thx ... View more

Hi czarny, Hold on a few more days. I'm in the process to write an App to address this. cheers, MuS ... View more

Did you try addtotals http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Addtotals ? ... View more

Use list instead of values in that case 😉 ... View more

Hi MatMeredith, Have you met http://dev.maxmind.com/geoip/legacy/codes/country_latlon/ yet? You can use this as lookup, either manual or automatic. hope this helps to get you started ... cheers, MuS ... View more

Hi jonathan.Iam, if you still need an answer on this topic, here is one 🙂 in older Splunk releases it used to be 24 hours before you get into trouble if your license master is gone. Now with Splunk 6.1.3, if the license master is down or unreachable for any reason, the license slave starts a 72 hour timer. If the license slave cannot reach the license master for 72 hours, search is blocked on the license slave (although indexing continues). Nevertheless here is the doc about How to swap the license master cheers, MuS ... View more

okay, hard to test without any real data ... try this: source="file.csv" date_month=august date_hour>08 AND date_hour<18 NOT ( date_wday=Saturday OR date_wday=Sunday ) | eval epoch_A=strptime('start_TIME',"%d/%m/%Y %I:%M:%S %p") | eval epoch_B=strptime('close_TIME',"%d/%m/%Y %I:%M:%S %p") | eval total_TIME=if((epoch_B-epochA)>57600, (epoch_B-epcoh_A-57600)/3600, (epoch_B-epcoh_A)/3600 ) | table start_TIME, close_TIME, total_TIME The if statement is based on the fact, that if the difference between start and end time is bigger as 57600 seconds (17 hours or 5pm to 9am) then this job was running over night and you simply minus those 17 hours from the total time. hope this helps ... and this is un-tested 😉 cheers, MuS ... View more

you're welcome. please mark this as answered if the provided answer was correct - thx ... View more

Sure this will not work, because this regex does not match and you did not specify a field name for the group. Why didn't you try the regex I provided? This will catch all 3 digit numbers, no matter what comes before or after. But if you really need to match only the Title #: numbers use something like this: your base search here | rex "Title\s\#\:[\s\w\-]+(?<eng>\d{3})" | ... and please don't use your base search here as your search, this is only a place holder 😉 ... View more

Sorry missed one question: I don't know if you can do this from a dashboard directly, maybe using some fancy js hack? Usually I just open the lookup editor and write stuff in there. ... View more

The easiest thing to do, is clone the lookup editor app into a new app and create your dashboards in this new app. Also, setup the auto lookup in this app. The lookup editor can edit any lookup file the user has permission, I'm not sure if you can limit it only to use lookups in the current app context ..... As I said, create a new app and play around it this app, this way you would only break stuff in this app 😉 ... View more