Splunk makes a local copy of any csv you use in a lookup, so you'll have to update the local copy on the Splunk server if you are going to do it that way. If the updated csv is the result of a search, may I suggest you look into the outputlookup command, and simply overwrite or append to your existing lookup. ... View more

Look into the "join" command. Note that subsearches have a default limit of 10k results though. Also - have you considered doing the combination while you are running the SQL instead of in Splunk? If you are familiar with SQL why not do all the necessary joins before storing the data in Splunk? Is the data coming from different databases? ... View more

As a starter, you are using the "as" incorrectly in your first stats ...|stats count by _time as t_err |... , you need to use rename in this case if you are renaming _time ... | stats count by _time as t_err | rename _time as t_err | ... Also, rather than trying to use rename I suggest you use "AS" inside of the timechart command itself. Like so: "Error" | bucket span=1m _time | stats count by _time as t_err | rename _time as t_err | eval avail=86400-t_err | eval AvailPct = round((avail/86400)*100,2)| timechart span=1m sum(AvailPct) as "Avail.Pct" ... View more

I'd suggest either maintaining a lookup table with the full list of servers and doing a join to it, or you can extend your search by a few hours / days and instead of stats count ... do stats latest(_time) as last_event_time ... so you get to see when the latest event for that server came in. You can then sort by the time and see which are the oldest servers (and whether they are from before your patch). ... View more

You could also try this: 00\..{3}([^\s]+) To save it as a field extraction just use this: 00\..{3}(?P<my_field>[^\s]+) I'm using the 00. as my starting point, ignore 3 characters after that, then begin the capture until the next whitespace. ... View more

Are those two separate events or one event that you are extracting the ABC and XYZ from? If it's two separate events, you can easily use an "or" in your regex to look for two different patterns. Try this: <base search> | rex "(Response Received from|has been received from) (?P<my_field>[^\s]+)( service)? for Submit$" This basically looks for either "Response Received from" or "has been received from" before capturing your field, and looks for "for Submit" after the capture. Note that the "$" anchors the "for Submit" to the end of the event, you may want to skip that if the above were shortened examples of your events. Technically because your two events are so similar it would be simpler to do a simpler rex: <base search> | rex "(?P<my_field>[^\s]+)( service)? for Submit$" Because in both your cases, the value is followed by "for Submit" or "service for Submit" it really doesn't matter what comes before it. Hope this helps ... View more

Here's the answer to your first question: index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d pool=* | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | eval mb = round(b/1024/1024,2) | join type=left slave [| rest count=0 /services/licenser/slaves | rename label as slave_name | rename title as slave | table slave_name slave] | search mb!=0 | timechart span=1d sum(mb) AS "volume" fixedrange=false by slave_name You should be able to manipulate the above to get the second question as well. Hope this helps ... View more

Got it. The reason for that is because you have created a multi-value field (mvfield) by using list(), and the fieldformatter doesn't know how to handle those. You are either going to have to figure out how to manipulate mvfields to iterate through all the values in the mvfield, or you are going to have to calculate the daily average in a step before you use the stats list, so that you can convert it to a formatted string and then put it in the stats list(). ... View more

What you want to do is apply the formatting after you do the the stats command. You should get your average calculated based on the numbers and then convert it to a string. ... View more

Are you doing the formatting before or after the stats? If you do it before, then it's like converting all your numbers to strings, and trying to calculate the average of a string. ... View more

To edit the scheduling of the alert do the following: Save the search as a report (or alert) Go to settings > searches, reports and alerts Click on the name of the report/alert Check the box "Schedule this search" The first option should be how frequently you run the report/alert. Schedule type is either basic or cron. If you select basic it will give you options such as "every minute" or "every hour". If you select cron, you will be allowed to enter the exact cron format of how you want the job to run. Hope this helps ... View more

The below link should walk you through how to set up an alert. It even uses host as a throttling example. About alerts Here's another example: Alert examples Hope this helps ... View more

If you are using the field name then I don't know why it's not working. Try putting the "P" back in after the "?" in the capture group ?P ... View more

you still need to provide the name of the field after the ? using these brackets "<" and ">" ... View more

It's not necessary, but it's a habit from an older Splunk version. If I remember correctly it used to be needed to specify using "python" regex expressions, indicating that what was coming next (inside the <> brackets) was the name of the field. You can simply use ? instead of ?P it'll work the same. ... View more

You can use the convert command. Select from these options the proper format you wish the date to show up in. Here's an example: your search here... | convert timeformat="%A %d %B" ctime(_time) This should result in changing the _time field to strings of the format: ["Full weekday name" "numerical Day of the month" "Full month name"], example: "Monday 08 December". Hope this helps ... View more

Have you looked at the "delta" command? ... View more

sideview's solution will only work for Monday. Because you can't set the earliest and latest dynamically, I suggest the following approach: earliest=-1y@w1 latest=-1y@w6 Then you need a where clause to compare Today's wday to that weeks wday: earliest=-1y@w1 latest=-1y@w6 | where date_wday=lower(strftime(now(),"%A")) ... View more

A few of things: is "index_time" a field in your results? or are you referring to the Splunk index time, which is referred to as "_indextime"? If you ARE referring to _indextime, then it is unnecessary to try to convert it to Epoch time as it already comes in Epoch time. When using strptime you must conform to using this specific set of time/date formats to define the format of the conversion. Hope this helps ... View more

Can you provide sample data and sample results? Not sure what exactly you are looking for. In terms of your dc(group1) / dc(group2), it doesn't work that way, because group1 and group2 are values of the field "action". Distinct count of action [dc(action)], would return only 1 for group1, 1 for group2, and 1 for any other action value you have in the action field. Are you trying to count the number of results that are action=group1 and the results that are action=group2? For this you can just pipe into "stats count by action", or simply add count after your "dc(id)" to also get the count by action. Hope this helps ... View more

No, in the css. I think you can embed css in html, but I'm not sure how. Just FYI - the first time you ever make a css you'll have to restart your search head to pick it up, but henceforth you'll just need to refresh the dashboard. If you embed the css you won't need to restart the server. ... View more

Have you tried css like this? h1 { font-size: 38px !important; } ... View more