Hi mikelanghorst, according to the docs this message is from the JSChart Module and related to the object rendering limit in the chart library. running this test search on my development box index=_internal | timechart span=10sec count returns about 4700 events in the statistic table but brings the message These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached. on the report graph. So from my understanding this message is completely related to the chart and not effects the statistic table. hope this helps ... cheers, MuS ... View more

Hi rohit31dec91, one way to do it, would be based on the license usage. For example take this report on the license usage per index: index=_internal source=*metrics.log per_index_thruput | timechart sum(kb) by series this will report usage per index, which then can be used in some charge-back process. Another way would be to setup license pools, let's say you have 10Gb license and you split off one pool of 1Gb. In the end you don't care how much they need for real, the pool has a size of 1Gb so you 'charge' them a tenth of your license cost.... hope that helps to get you started ... cheers, MuS ... View more

Hi viksinha, I like using streamstats for this kind of use case. But first you will need to have some field containing the up or down message, so let us assume this field will be called status . So you could use something like this: your base search to get the event here | streamstats current=f last(status) as last_status last(_time) as last_time | where last_status="Down" AND status="UP" | eval downtime=_time-last_time | convert timeformat="%H:%M:%S.%3N" ctime(downtime) | table status downtime hope this helps to get you started ... cheers, MuS ... View more

did you try fillnull on those null fields? ... View more

Okay, this is way you should always provide some sample logs if asking something....it looks like your string1|2|3|4 is not a field. You really mean a string of words. So first thing to do is, to get those words in some field, because the evals I used are all based on fields called string1 or string2 and so on. Read more about field extraction here http://docs.splunk.com/Documentation/Splunk/6.1/Knowledge/Addfieldsatsearchtime and use the new cretaed field as shown in my example. ... View more

Hi pramit46, like @somesoni2 said the current search would help. Nevertheless, based on your provided examples PersonName | Age | MaritalStatus | Location A|10|M|New York B|20|-|London C|-|U|Mumbai D|30|-|Sydney E|-|M|Sydney I would run a search like this: your base search to get the events you need | stats list(Age) AS Age list(MaritalStatus) AS MaritalStatus list(Location) AS Location by PersonName You can have a look at this run everywhere search command and try & error with the grouping either by series or by group index=_internal earliest=-15m source=*metrics.log kbps | stats list(kbps) AS kbps list(group) AS group list(max_age) AS max_age by series hope this helps ... cheers, MuS ... View more

Hi BP9906, try this run everywhere command: index=_internal | head 1 | eval AKDT="-8h" | eval CEST="+2h" | eval foo=relative_time(now(), AKDT ) | eval boo=relative_time(now(), CEST ) | eval foo=strftime(foo, "%Y-%m-%d %H:%M:%S.%3N" ) | eval boo=strftime(boo, "%Y-%m-%d %H:%M:%S.%3N" ) | table foo boo the times for foo and boo are in AKDT (Alaska Daylight Time) and CEST (Central European Summer Time). As you can see I had to eval them first and then use them with relative_time . To take this one step further, you could setup some automatic lookup containing all TZ and use them to do your time calculations. hope this helps ... cheers, MuS ... View more

dammit.... 🙂 ... View more

Hi chengyu, try to build the search command in a manner, that it will search for events you will need instead of excluding what you don't need. Change your provided search example like this: index="xxx" srcip="123.123.123.123" dstip != "111..." dstip !="112.1.1." dstip != "163.1.1." dstip != "10.1.1." | eval bandwidth=rcvdbyte+sentbyte | eval bandwidth(MB) = round(bandwidth/1024/1024,2) | strcat " " time " " as Date | eval n = coalesce(hostname, host_name) | strcat " " n url " " as weburl | stats sum(bandwidth(MB)) as bandwidth(MB) values(srcip) as srcip values(service) as service values(attack) as app last(Date) as FirstDate first(Date) as LastDate values(policyid) as policyid values(weburl) as weburl by dstip | sort 10 |head 10 a note form the docs about search operators: Note: Inclusion is generally better than exclusion. Searching for "access denied" will yield faster results than NOT "access granted". You can go further and tune the dstip filters to reduce the != hope this helps ... cheers, MuS ... View more

Hi melonman, this is because the stats result for u01 looks like this: 2014/05/01 00:00:01 userid=u01 action=start 2014/05/01 00:00:03 userid=u01 action=stop 2014/05/01 00:00:06 userid=u01 action=start 2014/05/01 00:00:07 userid=u01 action=stop and using min and max on this will result in min=00:00:01 max=00:00:07, therefore you will get a duration of 6. based on the provided example data and using streamstats I can get what you want: the base search to get the events | streamstats current=f last(userid) AS last_userid last(action) AS last_action last(_time) as last_time by userid | eval duration=last_time - _time | where last_action="stop" AND action="start" | table _time userid duration the result will look like this: Hope this helps ... cheers, MuS ... View more

If your events only contain either String1 or String3 you can test my search command. it will take either String1 or String3 as startswith and depending on startswith sets either String2 or String4 as endswith ... View more

please mark this as answered by ticking the tick - thx 😉 ... View more

that's true, but as long as no log examples are provided this is all just if - when - maybe - you - could ... then again one can add another if to check eval myend=if(mystart=string1, string2, string4) ... ... View more

nice done ... ... View more

according to the docs http://docs.splunk.com/Documentation/Splunk/6.0.3/Troubleshooting/WhatSplunklogsaboutitself license_usage.log contains all information, not only top 10. limits.conf is the place for the change, like I told you. Did you restart Splunk afterwards? Also this will only be valid for new events. ... View more

Hi Jananee_iNautix, your transaction will not work because of the startswith="" endswith="" OR startswith="" endswith="" options which are supposed to be provided only once. if your events only have either string1 or string3 and string2 or string4 then you could try something like this: your base search to get all needed events | eval mystart=coalesce(string1, string3) | eval myend=if(mystart=string1, string2, string4) | transaction startswith=mystart endswith=myend | ... Some minor updates to the wording and the search command, based on the two comments below 😉 hope this helps ... cheers, MuS ... View more

sounds like some splunk session handling.....here is another unanswered question regarding the same problem http://answers.splunk.com/answers/131887/free-login-return-url-does-not-work ... View more

Hi albertohontoria, user authentication and role management is disabled with the free license, so how can this user login? For more details see the docs about What is included with Splunk Free cheers, MuS ... View more

Maybe you should have a look at my App http://apps.splunk.com/app/1249 😉 to your question, this could be done using a lookup ... View more

Hi dude, well this is based on your provided information 😉 try this \[(?<myadd>\w+)\]\{(?<myMAC>([\w\d]+[:-])+[\w\d]+)\} which works perfect in all of those different online regex testers ... View more