Hi I have a scenario where i have to put a single value button showing a avg response time that would go red/amber/green on going on/off a threshold. This is easy and can be done using range if there is a constant threshold value. Now in my scenario, the threshold value is not constant and needs to be changed with time, and the single value button will go red/amber/green based on the threshhold value at that point of time. How do i specify threshold based on time? Can this be done in splunk dashboards.Please suggest ... View more

Hi In my splunk environment i have around 50-60 instances of splunktcpin queue blocked? what is the impact on my data if splunktcpin queue is blocked? Would i be losing some data forwarded from my universal forwarder? WHen you say a queue is blocked, how long will the queue be blocked? ... View more

Hi is there a foo value which returns the number of rows resulted after PostProcess? $results.resultCount$ returns the number of results returned in main query but not the number of rows after post process even though the variable is used in Post Process module. How can get the row count after PostProcess module is applied. ... View more

Hi Lets say the result of a query is a table like below: A        B 1        Name1 2        Name2 generally selecting results[0].A will give me "1" and results[0].B will give me "Name1" and so on. But is it possible to disply values of B using values of A. like trying results.A["1"] so that i can get Name1 ... View more

Hi, One way to show table results in HTML module..is by using row.cell0.name and row.cell1.name ..etc.., But that can be done only if i know how many results i will get.. How to show all rows in table in HTML module when i dont know how many rows will be returned in table from search query? ... View more

Hi All, Is there a possible solution to strip the actual timestamp of the event and add current system time as event timestamp. Scenario: My timestamp of events for Syslog feed coming to my heavyforwarder is as 2012-09-28T14:36:53.000 All events are having milliseconds as zero always because the syslog generating server doesn't have capability to add milliseconds. So i was thinking if it is possible to ignore that timestamp and add the current timestamp of the indexer when indexing the events. ... View more

I have a event similiar to one below: Server Status - ServerName - RUNNING JMS Queue - ServerName : Module1!JMSServer1@QueueName1 , 0, 0, 13, 45, 0, 1345, 800 JMS Queue - ServerName : Module2!JMSServer1@QueueName2 , 0, 0, 3, 14, 0, 15, 800 JMS Queue - ServerName : Module3!JMSServer2@QueueName3 , 0, 0, 23, 24, 0, 13, 800 JMS Queue - ServerName : Module4!JMSServer3@QueueName4 , 0, 0, 25, 35, 0, 1, 800 JMS Bridge - ServerName:BridgeName1,Forwarding messages. JMS Bridge - ServerName:BridgeName2,Forwarding messages. This complete snippet is a single event. This gets written onto a file at regular interval (JMS Queues and JMS Bridges status) which is monitored by splunk,and this complete thing is indexed as a single event with multiple lines, Now i would like to extract info from this event and show in following table format in panel in dashboard QueueName Field1 Field2 Field3 Field4 Field5 Field6 Field7 QueueName1 0 0 13 45 0 1345 800 QueueName2 0 0 3 14 0 15 800 QueueName3 0 0 23 24 0 13 800 QueueName4 0 0 25 35 0 1 800 ... View more

Hi I am receiving a syslog feed from a server.I am trying to index that data. In syslog feed no milliseconds are being sent in feed.So event datetiime is of format 8/31/12 11:44:18*.000* AM i.e milliseconds is always .000 for all events indexed. So while calculating duration after using transaction command if transaction happens in less than a second then the duration shows as O, which is claerly wrong. So is there a way i can append current date time with milliseconds when getting indexed, so that i get proper milliseconds feild also. ... View more

I recieve syslog feed to my heavy forwader . From there the data is forwarder to my Indexer. And in my indexer i want my received data to be indexed in index=syslog. Heavy Forwarder configuration inputs.conf: [udp://514] connection_host = X.X.X.X index = syslog_index sourcetype = syslog_st and Configuration in my indexer is : inputs.conf [splunktcp://9998] index = syslog sourcetype = syslog_feed But i am getting a warning in my indexer as received event for unconfigured/disabled index='syslog_index' with source='source::udp:514' host='host::X.X.X.X' sourcetype='sourcetype::syslog_st' (1 missing total) why is it still trying to put the forwarded data to index=syslog_index whereas i mentioned in my indexer to index data into index=syslog Could any one please help? ... View more

I have a setup where syslog feed is received by a heavy forwarder on udp port. Syslog feed on that particular udp port has sourcetype=syslog_feed and index=syslog_index . And from there i have to route the syslog feed to Actual Indexers. Now what configuration changes i have to make to forward the data with sourcetype=sl_feed and destination index=sl_index . ... View more