Hi I am using following query to get my results in tabular format: source="/splunkInput/MARTINI/EMLC/*" E2E_ID="sampleid" | transaction E2E_ID, tier | chart avg(duration) by E2E_ID,tier which gives me results in a tabular format with E2E_ID and also for different tiers. Now i want to create a form search for which takes E2E_ID as input and gives results in table with values E2E_ID and different tiers. COuld anyone help me on this..? ... View more

Hi I have been using splunk 4.2.4. It has all my indexes and configurations I wanted to upgrade it to 4.3 version. For installing i made a mistake and i gave the path as rpm -U --prefix /opt/Software/splunk splunk-4.3-115073-linux-2.6-x86_64.rpm instead of rpm -U --prefix /opt/Software/ splunk-4.3-115073-linux-2.6-x86_64.rpm where is /opt/Software/splunk is the SPLUNK_HOME And now after upgrading it created /opt/Software/splunk/splunk and it is not having my configurations and indexes data in that folder. The old configurations are present in old path only. So now i have upgraded version of splunk but it doesn't contain my indexes and configurations. Please help me to correct it Thanks ... View more

Hi, When i am trying to view a dashboard containing charts, in Internet Explorer 8. My IE is throwing error Message: Object expected Line: 9882 Char: 1 Code: 0 URI: http://splunk_server:8000/en-GB/static/@110225/js/common.min.js But same dashboard is visible in Firefox without any errors. Can anyone help me how to make it work in IE Thanks ... View more

I have a query which results in following data But i need to generate a table in this format ... View more

Hi Is there any way to write the search results (in table format) in to a lookup table i.e... | table field1,feild2 now i need to write those values into look up table in same query, please help me hw to do that Thanks Pavan ... View more

Hi I have a query where i am retrieving the logs which have timestamp>field. eg: ....| where _time>RequestActual RequestActual is a field extracted from logs, which has the exact time by which it should have been received so the above search ideally reports the requests which were received after the actual time specified in logs. Now my question is how to get requests which are more than 1 day late. i.e what query should i use to get logs ..| where _time>(RequestActual+1day) please help me with this. ... View more

I have time logged in as the below format .... 2011-11-18T00:00:00 .... I am able to extract that time using field extraction to get OrderDate as 2011-11-18T00:00:00 Is there any way to convert that value to format 2011/11/18 00:00:00 The reason for this is i need to find diffrence between times, and i cannot do it if time is in format of 2011-11-18T00:00:00 Please suggest me ideas to implement this. ... View more

Hi Is it possible to find the Average of only the best 50% transactions(i.e top 50% of less transaction times). I can hardcode the exact value in query , wher i can limit sort by duration to a exact number. like *|sort limit= duration| stats avg(duration) But the problem is i wouldn't know hw many transactions i would have that day. So i need a query which can produce the average of best 50% transactions irrespective of total transaction number ... View more

Hi, I have data of transactions in logs. using "duration" i can take the total duration of very transaction.And avg(duration) will give me the avg of all the transactions. Now i need to calculate the average of only the top 50% best transaction on time. i.e for example i have 100 transactions, I sort them according to duration(min to max), i need the average of the first 50 trasactions. How can i achieve this? ... View more

Hi I have a bar chart (productID's mapped onto number of events). productId's are the product codes(numbers) retrived from a field called ProID like ProID = 1234 count = 3 ProID = 1789 count = 4 and every ProID is mapped to a Productname but not present in logs I used (* | top ProID) by bar chart Using basic chart diagrams i am able to build a chart where they show proper results. My question is , Is ther any way to show ProductName instead of ProductId in the chart , i mean alias name for codes in chart Eventhough the chart shows ProID by count, i need to show it by proName to count ... View more

Hi I am new to Splunk, can anyone help me with extracting a particular XML Tag name. Like ns:OrderReference urn1:BuyersID1234/urn1:BuyersID urn1:SellersID1-1216/urn1:SellersID /ns:OrderReference I need to extract the tag with xpath OrderReference/BuyersID into a filed value.So how can i do that ... View more

Hi, I have 2 search queries. sourcetype="zzz" Accepted | stats count as SuccessCases sourcetype="zzz" Rejected | stats count as FailureCases Now i need to find the rqtion of both.How ca i do that.Can anyone help me here ... View more