Hi isedrof, Just guessing here, but try this updated search: | inputlookup lookup_file.csv | search NOT [ search index=* source="index_file.csv" | dedup user_name| table user_name ] search NOT [|inputlookup lookup_file2.csv | fields user_name| dedup user_name] cheers, MuS ... View more

Hi zd00191, did you change the js script line 14 return _(['active_hist_searches', 'active_realtime_searches']).contains(cell.field); to match your fields? Also, remember to restart the Splunkweb using $SPLUNK_HOME/bin/splunk restart splunkweb and last but not least clear your browers cache. Hope this helps ... cheers, MuS ... View more

Ho ohlafl, No, this in not possible with Splunk native simple XML. But I assume you could use some JS to parse the user input, change the SPL according the user input and run the search then. cheers, MuS ... View more

Hi shrirangphadke, take this run everywhere dashboard as example: <form> <label>run search based on button</label> <fieldset submitButton="false"> <input type="text" token="field1"> <default>*</default> <prefix>sourcetype="</prefix> <suffix>"</suffix> </input> </fieldset> <row> <panel> <title>Search being run: index=_internal $$field1$$</title> <event> <search> <query>index=_internal $field1$</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <fields>["host","source","sourcetype"]</fields> </event> </panel> </row> </form> The trick is to use a default option which is here a * so it will search be default for sourcetype="*" or what ever is entered by the user. Hope this helps ... cheers, MuS ... View more

Hi rana_nour, the VALUE field in the timechart output is related to events with no City value in it, for what ever reason (This must be checked and fixed by yourself). But you can simply add another filter to exclude them from the timechart like this: index=gasf uri_path="*.aspx" (( eventtype="Hub" ) AND eventtype=*) | iplocation clientip | where City!="" | timechart span=1hr c by City limit=400 usenull=f Hope that helps ... cheers, MuS ... View more

Hi zd00191, you can set the colors using the charting.seriesColors to assign a series of colors or use the charting.fieldColors option like this: <dashboard> <row> <chart> <searchString>index=_internal source=*access* | chart count by status</searchString> <earliestTime>-60m@m</earliestTime> <latestTime>now</latestTime> <option name="charting.chart">pie</option> <option name="charting.fieldColors">{200:0x00ff00,201:0x33ff00,204:0x66ff00,303:0xffaa00,304:0xffff00,404:0xff0000}</option> </chart> </row> </dashboard> to set a different colour based on the value of the status field in this example. See the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Chartcustomization#Chart_colors cheers, MuS ... View more

Hi IRHM73, I suggest to learn regex and use online tools like https://regex101.com where you can easily find the following regex will match your requirements: your base search here | rex "Address\sLine\s1=(?<address>.*)," | do what ever you want with address or you use the Splunk build in field extractor http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/ExtractfieldsinteractivelywithIFX cheers, MuS ... View more

Hi ncarnevali, That's not correct, the REST api supports ignoreOlderThan but it is called ignore-older-than in REST. See the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/RESTREF/RESTinput#data.2Finputs.2Fmonitor in the POST section. Hope this helps ... cheers, MuS ... View more

Hi shrirangphadke, it does not have the Splunk environment variables set if you can source /opt/splunk/bin/setSplunkEnv in your django enviroment it will run the script as well /opt/splunk/bin/splunk is actually a wrapper which load the setSplunkEnv and starts the later command. Hope this helps ... cheers, MuS ... View more

Hi dphung, create an eventtype out of this search http://docs.splunk.com/Documentation/Splunk/6.2.4/knowledge/Defineeventtypes#Save_a_search_as_an_event_type and tag this eventype and your get what you want. cheers, MuS ... View more