Hi athorat, take a look at this answer https://answers.splunk.com/answers/305328/how-to-search-the-names-of-triggered-alerts-their.html which is kind of similar - just misses the to whom it was sent....but you should be able to get it as well from the first search. Hope this helps ... cheers, MuS ... View more

Hi bpitts2, without knowing too much about your events; try this negative sub search: your base search here | search NOT [ search index=sbc_pci "sipmsg.log" sipmessage="REGISTER" | stats values(call_id) as badcallid | mvexpand badcallid ] But be aware of the sub search limits http://docs.splunk.com/Documentation/Splunk/6.3.0/Search/Aboutsubsearches#Subsearch_performance Hope this helps ... cheers, MuS ... View more

Login to each of your SHC members and run the search from the cli to see if you get more information. ... View more

Sadly this work around does no longer work https://answers.splunk.com/answers/241650/using-eval-to-change-text-color-in-single-value-mo.html well at least I got it not working so far..... ... View more

Single value visualisation works on strings as well 😉 check out this answer here https://answers.splunk.com/answers/329368/color-string-fields-in-stats-dashboard.html ... View more

update ping to give you an updated XML with working string and number colouring without any additional css or js scripts..... Hope this helps ... ... View more

Hi dstark75, Take a look at this answer https://answers.splunk.com/answers/241650/using-eval-to-change-text-color-in-single-value-mo.html to learn how this can be done. You need to evaluate a new field based on status and use this field in the classField option. Hope this helps ... cheers, MuS Update: Okay, Splunk 6.3 did change on that so here is an updated XML that shows working examples for numbers and strings to be coloured : <form> <label>rangemap Clone</label> <fieldset submitButton="true"> <input type="text" token="field1" searchWhenChanged="true"></input> <input type="time" token="field2"> <label></label> <default> <earliest>0</earliest> <latest></latest> </default> </input> </fieldset> <row> <panel> <single> <title>Temp (S1 Rack)</title> <search> <query>| stats count | eval reading="$field1$" | eval ok_level=if(reading="3", "3",null()) | eval sev_level=if(reading="0","0",null()) | eval warn_level=if(reading="2","2",null()) | eval level=coalesce(ok_level,sev_level,warn_level) | rangemap field=level green=3-3 blue=2-2 red=0-0 default=gray</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="charting.chart.rangeValues">[0,30,40,60,70,100]</option> <option name="charting.gaugeColors">[0xd13b3b,0xFFE800,0x7e9f44,0xebe42d,0xd13b3b]</option> <option name="drilldown">none</option> <option name="classField">level</option> <option name="field">reading</option> <option name="useColors">0</option> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="useThousandSeparators">1</option> <option name="linkView">search</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="trendInterval">auto</option> </single> </panel> <panel> <single> <search> <query>| stats count | eval reading="$field1$" | eval ok_level=if(reading="HEALTHY", "3",null()) | eval sev_level=if(reading="BAD","0",null()) | eval warn_level=if(reading="WARN","2",null()) | eval level=coalesce(ok_level,sev_level,warn_level) | table reading level | rangemap field=level low=3-3 elevated=2-2 severe=0-0 default=severe</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">none</option> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> <option name="linkView">search</option> </single> </panel> </row> <row> <panel> <single> <search> <query>index=_internal source="*splunkd.log" log_level="error" | timechart count as errors | rangemap field=errors low=11-25 guarded=26-50 elevated=51-99 high=100-150 severe=150-199 default=severe</query> <earliest>$field2.earliest$</earliest> <latest>$field2.latest$</latest> </search> <option name="drilldown">none</option> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="trendInterval">auto</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> <option name="linkView">search</option> </single> </panel> <panel> <single> <search> <query>index=_internal source="*splunkd.log" log_level="error" | timechart count as errors | rangemap field=errors low=11-25 guarded=26-50 elevated=51-99 high=100-150 severe=150-199 default=severe</query> <earliest>$field2.earliest$</earliest> <latest>$field2.latest$</latest> </search> <option name="drilldown">none</option> </single> </panel> </row> </form> ... View more

The later one is only for Splunk 6.3 available, the former started at Splunk 6.0 ... View more

Hi lmaclean, download the dashboard example app https://splunkbase.splunk.com/app/1603/ and check out the dashboard /en-US/app/simple_xml_examples/simple_single or /en-US/app/simple_xml_examples/simple_single_color to see how this is done. Hope this helps ... cheers, MuS ... View more

Hi ramehlpatel, have a look at this app https://splunkbase.splunk.com/app/2776/ which provides a way to get the information you asked for. cheers, MuS ... View more

HeHe, how dare you not taking the $user_id$ ! Sorry for that - never thought of that use case! I'll have a look what can be done. Planing an update anyway. Cannot give you a time frame when it will happen, but it will...... ... View more

Hi alexantao, I wrote this app and will try to help you. Have you tried to run your search using a $user_id$ user_id="myuserID" | ldap ldap_filter="uid=$user_id$" attrs="givenname,sn" cheers, MuS ... View more

Hi Glenn, this the kind of question I like 🙂 Okay let me explain: the command datamodelinfo is not documented, because it is a custom search command provided by the App Splunk_SA_CIM so it is not a default Splunk command. But, if you look at the script of this command $SPLUNK_HOME/etc/apps/Splunk_SA_CIM/bin/datamodelinfo.py you can see what it does. First it gets all accelerated data models form the app context or the ones globally exported and then uses the name to get further details from another REST end point. Adapted to a Splunk search you will get this nice use case for a map search (actually this is my first real useful use case for map !): | rest /services/data/models | search acceleration="1" | table title eai:appName | rename eai:appName AS name | eval myDatamodel="DM_" . name . "_" . title | map search="| rest /services/admin/summarization/tstats:$myDatamodel$ | table eai:acl.app title summary.complete" What happens here is the following: | rest /services/data/models | search acceleration="1" get all accelerated data models | table title eai:appName | rename eai:appName AS name a rename is needed because of the : in the title | eval myDatamodel="DM_" . name . "_" . title eval the new data model string to be used in the map search and finally | map search="| rest /services/admin/summarization/tstats:$myDatamodel$ | table eai:acl.app title summary.complete" run the second search to get the details. If you need more details, simply adapt or remove the last table in the map search. This can be run from Splunk UI, Splunk CLI or run a adapted copy of $SPLUNK_HOME/etc/apps/Splunk_SA_CIM/bin/datamodelinfo.py as cron job. Hope this helps ... cheers, MuS ... View more

Arte you on Splunk 6.3.x ? If so, it will not be listed because it is not officially a Splunk 6.3 App. Try searching for keyword in your Splunk and it will list 2 Apps, where as on apps.splunk.com it will list 13 Apps. So your Splunk instance will only list apps which are listed for your version on apps.splunk.com 🙂 ... View more

Added more :confetti: to the party !!!!! 🙂 ... View more

Yes, this is Splunk version related, because on Splunk 6.3.0 this search | tstats count where index=_internal earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" will use latestTime 2015-11-13T09:41:22.000+13:00 and shows 2,624,870 events (11/11/15 12:00:00.000 AM to 11/13/15 9:41:22.000 AM) all the other searches from my answer also fail to use latest correct - bug alert.... ... View more

no quiet sure, because this works as well: | tstats count where index=_internal earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" returns 256,955 events (before 12/11/2015 17:12:00.000) and uses latestTime 2015-11-12T17:12:00.000+13:00 in the search..... maybe Splunk version related? ... View more

Hi the_wolverine, Yes, this is possible: | tstats count where earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" index=_internal groupby _time span=1m | tstats count where index=_internal earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" groupby _time span=1m | tstats count AS myCount where earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" index=_internal all searches use latestTime 2015-11-12T17:12:00.000+13:00 which can be verified in the search.log This is tested on Splunk 6.3.1 on Linux. cheers, MuS ... View more

Yes, that's the way to log events from your script into splunkd.log . Here is another example http://docs.splunk.com/Documentation/Splunk/6.3.0/AdvancedDev/ModInputsExample ... View more

do slow today 🙂 ... View more