this is how my search looks like so maybe you can advise how to modify it ... View more

Hey alessionazio, You can reset your password. Refer this accepted answer: https://answers.splunk.com/answers/834/how-to-reset-the-admin-password.html Let me know if this helps!! ... View more

<form> <label>Sample</label> <fieldset submitButton="false"> <input type="dropdown" token="selected" searchWhenChanged="true"> <label>Your Token</label> <choice value="field.name1">Yellow</choice> <choice value="field.name2, field.name4">red</choice> <choice value="field.name3, field.name5, field.name6">green</choice> <default>Yellow</default> </input> </fieldset> <row> <panel> <title>|stats count by $selected$</title> <single> <search> <query>|makeresults |eval tokenvalue="$selected$"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </single> </panel> </row> </form> ... View more

Thanks a lot! 🙂 This works too! ... View more

thanks for your answer!! ... View more

add this <input type="dropdown" token="sourcetype_tok"> <showClearButton>false</showClearButton> ... View more

below example explain how it is works . | makeresults | eval A=45 | eval DateHour="2018-06-06 18:47:22.820" | append [| makeresults | eval A=30 | eval DateHour="2018-06-06 18:45:22.820" ] | append [| makeresults | eval A=50 | eval DateHour="2018-06-06 18:57:22.000" ] | fields - _time | head 1 ... View more

| makeresults | eval DateHour="2018-04-10" | eval event_count=14 | eval zone = "A" | fields - _time | append [| makeresults | eval DateHour="2018-04-10" | eval event_count=14 | eval zone = "B" | fields - _time ] | append [| makeresults | eval DateHour="2018-04-11" | eval event_count=18 | eval zone = "A" | fields - _time ] | append [| makeresults | eval DateHour="2018-04-11" | eval event_count=18 | eval zone = "B" | fields - _time ] | chart values(event_count) over DateHour by zone ... View more

props.conf [yourSourceType] SHOULD_LINEMERGE = 0 LINE_BREAKER = ([\n|\r]+) TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3 TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD=32 EXTRACT-fields=(?<colA>[\w|\d]+)\s(?<colb>[\w|\d]+)\s(?<colc>[\w|\d]+) Save the props on the first heavy forwarder, or indexer that will receive the data. Also put the props on your search head. In a stand-alone environment, put the props on the single splunk instance. Now restart splunk and reload your data. Finally load the data and try this search | reverse | filldown _time | table _time cola colb colc Adding | search NOT columna should remove the column names from the results ... View more

Upvoting this especially to reinforce that the best solution is to fix while indexing! ... View more

@dadepu @RalfSeewaldCT you can check out Sendresults Splunk App from Splunkbase by Discovered Intelligence to format Tabular results as HTML for email. ... View more

/servicesNS/{user}/{app_name}/? /servicesNS/alice/myapp/??? ... View more

If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open. ... View more

HI @harishalipaka , Thank you very much. 🙂 You can find me on splunk slack community. Use this link: splk.it/slack Thanks ... View more

require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc) { // Access the "default" token model var defaultTokenModel = mvc.Components.get('default'); var submittedTokens = mvc.Components.get('submitted'); var tokens = mvc.Components.get("default"); var tokenValue = tokens.get("token1"); tokens.set("selection1", "zone"); tokens.set("selection2", "zone"); tokens.set("selection3", "zone"); submittedTokens.set(defaultTokenModel.toJSON()); var sourcetype_zone_id = mvc.Components.get('sourcetype_zone_id'); sourcetype_zone_id.on('change', function(value) { var location= document.getElementById("sourcetype_location_id").children[1].children[1].value; if(value.length!=0) { if(value=="%" && location =="%") { var tokens = mvc.Components.get("default"); var tokenValue = tokens.get("token1"); tokens.set("selection1", "zone"); tokens.set("selection2", "zone"); tokens.set("selection3", "zone"); } else if(value !=="%" && location =="%") { var tokens = mvc.Components.get("default"); var tokenValue = tokens.get("token1"); tokens.set("selection1", "port"); tokens.set("selection2", "port"); tokens.set("selection3", "port"); } } else { var tokens = mvc.Components.get("default"); var tokenValue = tokens.get("token1"); tokens.set("selection1", "vesselid vesselname"); tokens.set("selection2", "vesselid"); tokens.set("selection3", "vesselid&vesselname"); } submittedTokens.set(defaultTokenModel.toJSON()); }); ... View more

Did you see this answer? https://answers.splunk.com/answers/217368/how-i-can-change-date-format-in-time-picker.html ... View more

How do you actually get the max column other than typing all that out after the below? This is what the user has. How do we add a max field to it? | makeresults | eval Date="12/08", shiftA=102, shiftB=10, shiftC=200 | append [| makeresults | eval Date="25/08", shiftA=240, shiftB=102, shiftC=52] | append [| makeresults | eval Date="15/08", shiftA=158, shiftB=15, shiftC=178] | table Date shift* | transpose header_field=Date Or in other words is there a way to dynamically get the max without having to specify the field names? Or what do I have to add here, dynamically, to get the max? ... View more

|makeresults |eval Failure=52 | sendemail to="abc@gmail.com" format="html" server=smtp.gmail.com:143 use_tls=1 subject="Using splunk 7.1.1 version" message="Splunk Alert \n Test Link: http:\\localhost:8000 .\n My Test Alert from URL: www.google.com ." ... View more

Hi harishalipaka, are you speaking about Single Sign On? have you seen: http://docs.splunk.com/Documentation/Splunk/6.6.2/Security/HowSAMLSSOworks http://docs.splunk.com/Documentation/Splunk/6.6.2/Security/ConfigureSplunkSSO http://docs.splunk.com/Documentation/Splunk/6.6.2/Security/AboutProxySSO http://docs.splunk.com/Documentation/Splunk/6.6.2/Security/ConfigureSplunkToUsePAMOrRADIUSAuthentication Bye. Giuseppe ... View more

@ajayabburi508 - Did you get this solved? The code that we gave you on July 12 would do all that for you. It will get the start and end times of zero values for each 10-minute period by Tag, and group any sets of 3 into 30-minute periods. Here it is in order and formatted for easy reading. index=indexname earliest=1499819400 latest=1499848200 Tag="Tagname" | table _time Tag Value | bin _time as StartTime span=10m | rename COMMENT as "Add an extra zero record for each time period, then take the highest Value for each time period." | appendpipe [| stats min(StartTime) as FirstTime max(StartTime) as LastTime by Tag | eval StartTime=mvrange(FirstTime,LastTime,600) | table StartTime Tag | mvexpand StartTime | eval Value = 0 ] | stats max(Value) as Value by StartTime Tag | rename COMMENT as "Above gets us the highest Value in each ten-minute period, and the StartTime" | rename COMMENT as "Now we kill non-zero periods, and calculate the EndTime" | where Value=0 | eval EndTime=Time+600 | rename COMMENT as "This combines each half-hour period if it is three ten-minute periods of zero activity" | bin Time as Time30 span=30m | eventstats count as Count30 max(EndTime) as End30 by Time30 | eval StartTime=if(Count30=3,Time30,StartTime) | eval EndTime=if(Count30=3,End30,EndTime) | dedup StartTime | rename COMMENT as "And now we format our output Start and EndTime" | eval StartTime=strftime(StartTime,"%Y-%m-%d %H:%M:%S") | eval EndTime=strftime(EndTime,"%Y-%m-%d %H:%M:%S") ... View more

Hi, not exactly sure what you want But, I could do that if you could give me a "small" loan of a million dollars in return. Otherwise install this app for an overview of splunks many features when it comes to visualizations Splunk 6.x Dashboard Examples ... View more

Hi, be aware of this statement from web.conf. NOTE: This option is made available only to OEM customers participating in Splunk’s OEM Partner Program and subject to the relevant terms of the Master OEM Agreement. All other customers or partners are prohibited from removing or altering any copyright, trademark, and/or other intellectual property or proprietary rights notices of Splunk placed on or embedded in any Splunk materials. ... View more

it looks like you can create this visualization for the second one here. https://tympanus.net/codrops/2011/04/22/animated-skills-diagram/ here's a doc on how to go about it: http://docs.splunk.com/Documentation/Splunk/6.6.0/AdvancedDev/CustomVizTutorial ... View more