Hi Phil219, You can do this by passing the token for the zoom level to the dashboard; look at this XML which uses Twitter data - will maybe not work for you - but you will get the idea how it can be done: <form> <label>drop down map</label> <fieldset submitButton="true"> <input type="dropdown" token="zoom" searchWhenChanged="true"> <label>Zoom:</label> <choice value="1">1</choice> <choice value="3">3</choice> <choice value="6">6</choice> <default>1</default> </input> <input type="dropdown" token="location" searchWhenChanged="false"> <label>Country:</label> <search> <query>tag=twitter coordinates.type=Point | dedup user.location | table user.location | rename user.location AS location</query> <earliest>@d</earliest> <latest>now</latest> </search> <fieldForLabel>location</fieldForLabel> <fieldForValue>location</fieldForValue> <choice value="*">all</choice> <default>*</default> </input> </fieldset> <row> <panel> <map> <search> <query>tag=twitter coordinates.type=Point user.location=$location$ | rename coordinates.coordinates{} as lnglat | eval lat=mvindex(lnglat,1) | eval lng=mvindex(lnglat,0) | geostats latfield=lat longfield=lng count</query> <earliest>@d</earliest> <latest>now</latest> </search> <option name="mapping.choroplethLayer.colorBins">5</option> <option name="mapping.choroplethLayer.colorMode">auto</option> <option name="mapping.choroplethLayer.maximumColor">0xDB5800</option> <option name="mapping.choroplethLayer.minimumColor">0x2F25BA</option> <option name="mapping.choroplethLayer.neutralPoint">0</option> <option name="mapping.choroplethLayer.shapeOpacity">0.75</option> <option name="mapping.choroplethLayer.showBorder">1</option> <option name="mapping.data.maxClusters">100</option> <option name="mapping.drilldown">all</option> <option name="mapping.map.center">(0,0)</option> <option name="mapping.map.panning">true</option> <option name="mapping.map.scrollZoom">false</option> <option name="mapping.map.zoom">$zoom$</option> <option name="mapping.markerLayer.markerMaxSize">50</option> <option name="mapping.markerLayer.markerMinSize">10</option> <option name="mapping.markerLayer.markerOpacity">0.8</option> <option name="mapping.showTiles">1</option> <option name="mapping.tileLayer.maxZoom">7</option> <option name="mapping.tileLayer.minZoom">0</option> <option name="mapping.tileLayer.tileOpacity">1</option> <option name="mapping.type">marker</option> <option name="drilldown">all</option> </map> </panel> </row> </form> The key element is this XML option <option name="mapping.map.zoom">$zoom$</option> which gets the $zoom$ from the drop down <input type="dropdown" token="zoom" searchWhenChanged="true"> <label>Zoom:</label> <choice value="1">1</choice> <choice value="3">3</choice> <choice value="6">6</choice> <default>1</default> </input> Hope this helps to get you started ... cheers, MuS ... View more

Hi jwinderDDS, First get this messages into a field (let's say progress ) using field extractions, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/ExtractfieldsinteractivelywithIFX Next create a automatic lookup base on this new field using a lookup table like this: progress,state Process started,started Download started,running Download completed,running Import started,running Import completed,finished See the docs for more details on lookups and how they work http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Addfieldsfromexternaldatasources Once this is setup you can display the state field in your dashboard. Hope this helps to get you started ... cheers, MuS ... View more

Hi rturecek, This example discards the example line in your events by sending them to nullQueue : In props.conf , set the TRANSFORMS- attribute: [source::/var/log/*/CheckPointReconciler.log*] TRANSFORMS-001_CheckPointReconciler_NullQueue = CheckPointReconciler_NullQueue Create a corresponding stanza in transforms.conf . Set DEST_KEY to queue and FORMAT to nullQueue : [CheckPointReconciler_NullQueue] REGEX = [\d-\s:\.]+INFO\s+[^\s]+\snone\s+main\s+Reading\scheckpoint\sdirectory DEST_KEY = queue FORMAT = nullQueue You can also set the sourcetype instead of the source in props.conf . Do this either on a heavyweight forwarder or the indexer and remember to restart Splunk afterwards. Hope this helps ... cheers, MuS ... View more

Hi france24, no need to use appendcols to do this. Just use stats and some time tricks: host="192.168.1.1" earliest=-60d Action=block | bucket _time span=1d | stats last(_time) AS last_time count AS per_day_count by _time | eval 60days_ago = if(last_time > exact(relative_time(now(),"-60d@d")) AND last_time <= exact(relative_time(now(),"-0d@d")) , per_day_count ,"0") | eval 7days_ago = if(last_time > exact(relative_time(now(),"-7d@d")) AND last_time <= exact(relative_time(now(),"-0d@d")) , per_day_count ,"0") | eval 24h_ago = if(last_time > exact(relative_time(now(),"-1d@d")) AND last_time <= exact(relative_time(now(),"-0d@d")) , per_day_count ,"0") | stats max(last_time) AS _time, avg(24h_ago) AS 24h_ago, avg(7days_ago) AS 7days_ago, avg(60days_ago) AS 60days_ago This will perform much better and should bring the expected results; maybe some tweaking will be needed, but it should help you to get started. cheers, MuS ... View more

Hi chrislibby, like in the docs of the app written you have to change line 111 of nmap.sh to be like this: nmap $nargs $target #2>/dev/null to get nmap errors. Also check for errors related to the script in splunkd.log index=_internal nmap.sh cheers, MuS ... View more

Hi Bagaboo, based on the examples, try this regex as your field extraction: [Aa]ctivity[iIdD]+[\s:_]+(?<ActivityID>)[^$]+ you can verify it first in a search: your base search here | rex "[Aa]ctivity[iIdD]+[\s:_]+(?<ActivityID>)[^$]+" | do more stuff Hope this helps ... cheers, MuS ... View more

Hi agoktas, almost correct, your regex has a whitespace too much so this will work: your search here | rex ",(?<TrasactionTime>\d+)$" | top 10 TrasactionTime Hope this helps ... cheers, MuS ... View more

Hi proylea, if you want to pass a value to the head command you must return only a value form the subsearch, but you're currently returning count=somenumber . Do get back only a value from the subsearch run this run everywhere search index=_internal error | head [ search index=_internal error | stats count | rename count AS search ] This will rename the count field to a search field, which will just come back as a value. This way head can use it. Hope this helps ... cheers, MuS ... View more

Hi darlas, probably there is a better way to do this, but if you take your date string and strptime first and strftime after you get something like this 2014-04-02 22:05:34 . Here is the search to get there (the first line is only to create the date string): | gentimes start=-1 | eval myTime="20140402220534" | eval HumanTime=strptime(myTime, "%Y%m%d%H%M%S") | eval HumanTime2=strftime(HumanTime, "%Y-%m-%d %H:%M:%S") | table myTime HumanTime HumanTime2 BTW the .0Z means UTC. Hope this helps ... cheers, MuS ... View more

Hi Securitas, all based on assumption, because you did not provide sample data and the search you're using - so I'll use a basic run everywhere example to construct an event and a search. I indexed a file containing this data as sourcetype=ip_port : time=10:01 ip=1.1.1.1 port=22 time=10:02 ip=1.1.1.1 port=23 time=10:02 ip=2.2.2.2 port=23 time=10:02 ip=2.2.2.2 port=21 time=10:03 ip=1.1.1.1 port=80 Running this search will return connects to more than one port by time: sourcetype="ip_port" | stats count(port) AS Port_count by time, ip | where Port_count>1 If you want to check over 2 minutes use this search (Note: the first line is only needed to construct a useable _time value): sourcetype="ip_port" | addinfo | eval _time=_indextime | bin _time span=2min | stats count(port) AS Port_count by _time, ip | where Port_count>1 If you want to see which IP's got connection to the same port at the same time use this: sourcetype="ip_port" | chart values(port) AS ports over time by ip Hope this helps to get you started ... cheers, MuS ... View more