I have a search query index=abc sourcetype=xyz | stats count by created_date I get results like CREATED_DATE COUNT 2018-08-08 12 2018-08-07 10 2018-08-04 05 2018-08-02 06 2018-08-01 03 But as you can see, some dates are not present in logs so do not appear in results. Like 2018-08-06, 2018-08-05, 2018-08-03 I want these dates to come but with ZERO count. The final result should look like CREATED_DATE COUNT 2018-08-08 12 2018-08-07 10 **2018-08-06 0 2018-08-05 0** 2018-08-04 05 **2018-08-03 0** 2018-08-02 06 2018-08-01 03 Please suggest a solution. ... View more

I have created a search to populate a lookup periodically. index x sourcetype=y | outputlookup abc.csv append=true Lookup is like EventId, Start, End 000,1,2 111,3,5 I do not want duplicate rows for EventId. My current logic is not taking care of that. What can I add to the search so that every time a new row gets added, Splunk should only update the existing and not add a new one if event id already exists ... View more

I have a search index=abc sourcetype=xyz | bucket created_time span=1w | stats count by date_epoch | eval date_readable = strptime(date_epoch, "%m-%d-%Y %H:%M:%S") This results in a BAR GRAPH Y-AXIS -> Count X-AXIS -> date_readable BUT, when the user clicks on any BAR, the drill down takes him to the search page with ALL THE EVENTS and not just the clicked events. That is happening because of last condition in search query, where I am converting the EPOCH to READBLE. I need to show READABLE format of date on graph and at the same time want my drill down to work. Drill down seems to work only on EPOCHS. How can I achieve this? ... View more

I have a splunk query index=abc sourcetype=xyz | timechart by field1 This gives me data like _time column1 cloumn2 column3 ..... coulumnN Now , I want to do a common eval operation on all of these columns. But I do not want to HARD CODE the column names (as I do not know before hand the values of field1) Right now I am doing like this index=abc sourcetype=xyz | timechart by field1 | eval column1= column1 + 100 | eval column2= column2 + 100 | eval coulmn3 = column3 +100 ........ and so on. That way I am having multiple eval statements, even though I am performing the same operation eval column= column + 100 Can someone guide me a better approach of doing this? ... View more

I have a lookup of epoch times: epoch_time_lookup.csv Start Time End Time 1529737700 1529737800 1529737600 1529737750 1529737800 1529737900 1529737720 1529737722 I have a search which gives me results with 2 columns. EPOCH TIME and AVAILABILITY EPOCH AVAIL 1529737700 100 1529737600 100 1529737800 0 1529737720 100 Now I want to build a search, whenever AVAIL == 0 , check if the EPOCH is between any START and END times in epoch_time_lookup.csv lookup. If yes, make availability 100. Eg: index= abc sourcetype=xyz | eval EPOCH = _time | eval AVAILABILITY = availability_field | **eval availability = (if EPOCH in START and END of lookup) ,100, 0)** Need help in building the logic. ... View more

When ever I click on a BAR of a bar graph , it drills down to search page with an error "invalid earliest_time" How do i correct this invalid earliest_time error ? THE TIME PICKER ON MY DASHBOARD <input type="time" token="field3"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> THE BAR GRAPH PANEL ON MY DASHBOARD <chart> <search> <query>index=abc sourcetype=xyz |dedup number| bucket _time span=$field2$| stats count by _time|tail 7|eval Target=$IncidentTitle$|fieldformat _time=strftime(_time, "$BarChartFormat$")|reverse</query> <earliest>$field3.earliest$</earliest> <latest>$field3.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">linear</option> <option name="charting.chart">column</option> <option name="charting.chart.overlayFields">Target</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="trellis.enabled">0</option> <option name="trellis.size">large</option> <option name="trellis.splitBy">_aggregation</option> </chart> ... View more