I have a dashboard/view that is built using simple XML. There are tables on this view that are built from saved searches. The searches have the following code in them: ... | chart max(bytes) limit=20 by server The table from the resulting search only shows 10 results. Changing the limit=0 does not change this, and using the search code (as opposed to a saved search) does not affect this either. If I run the search by itself, I can change the number of result per page, but that does not seem to be available using simple XML. Is there something I can do, other than possibly rewrite the view using advanced XML that will allow this table to show more than 10 results? ... View more

I'm attempting to write a splunk query which will report back the sum of events for each monday. For some reason when I use "date_wday=monday" I see events from both Sunday and Monday in my result sets (when looking back at the last 30 days). an example of the search I'm doing is something like: index="monitoring" "Database=Errors" Metric=ConnectionAttempt date_wday=Monday | timechart span=1d sum(ConnectionAttempt) How can I get data back for Mondays only, without specifically enumerating the dates? ... View more

I'm creating a simple table to show the success rate of an event. I've got the following statement in my splunk search <splunk search stuff defining Success and Attempt> | eval rate=round((Success*100)/Attempt,2) | streamstats avg(rate) as average by _time | sort -_time limit=15 | fields _time rate average The streamstats information is currently shown out to 6 decimal places, which is unnecessary. I can't seem to find the correct syntax to display the streamstats data with only two decimal points. Can anyone demonstrate how to do this properly? ... View more

I've been playing around with advanced xml to create a view with a time picker. I have figured out what I need to do to add charts of data, but how do I add a table of information from a search that uses a chart? ... View more

How do I add a relative time range to a search that will allow me to see data between 15 and 5 minutes ago (read: not quite "real time")? I can see in the splunk manager I can add a start time of -15m@m and an end time of -5m@m, but that only gives me one 10-minute window, and doesn't show continuous values over time. Am I not formatting my timechart clause properly? ... View more

I am attempting to report on server connection data which is polled at regular intervals (i.e. every 10 minutes). The data is presented to Splunk like this: 1300727510,Servers,server01,LockedCount=3 1300727510,Servers,server01,UnusedCountBelow100=8 1300727510,Servers,server01,UnusedCountAbove100=5 1300727510,Servers,server01,UnusedCountAbove500=0 1300727510,Servers,server01,UnusedCountAbove1000=99 1300727510,Servers,server01,TotalAmount=112 1300727510,Servers,server01,BlockedCount=0 1300727510,Servers,server02,LockedCount=5 1300727510,Servers,server02,UnusedCountBelow100=10 1300727510,Servers,server02,UnusedCountAbove100=2 1300727510,Servers,server02,UnusedCountAbove500=16 1300727510,Servers,server02,UnusedCountAbove1000=81 1300727510,Servers,server02,TotalAmount=109 1300727510,Servers,server02,BlockedCount=0 1300727510,Servers,server03,LockedCount=3 1300727510,Servers,server03,UnusedCountBelow100=9 1300727510,Servers,server03,UnusedCountAbove100=2 1300727510,Servers,server03,UnusedCountAbove500=1 1300727510,Servers,server03,UnusedCountAbove1000=99 1300727510,Servers,server03,TotalAmount=111 1300727510,Servers,server03,BlockedCount=0 Note that the events all have the same timestamp (the first column) for a given polling period. If I use a search like this: index="monitoring" Servers | timechart span=10m sum(UnusedCountBelow100) as DB<100sec sum(TAUnusedCountAbove100) as DB<500sec I get the data timecharted, but it appears It I'm only getting data for the first server, when I really want a sum of all of the servers for that given period of time. I can get a total sum of the values if I replace the timechart command with stats, like this: index="monitoring" Servers | stats sum(UnusedCountBelow100) as DB<100sec sum(TAUnusedCountAbove100) as DB<500sec But, I can't seem to figure out how to get the data summed like the stats command over a timechart. Can anyone help me out with either the syntax, or a better way to accomplish this search? ... View more