To reorder fields here, use the "fields" command: ... | fields "City/Day" Monday Tuesday Wednesday Thursday Friday ... View more

Your best strategy here is to use an OR search, to load data from both prod_ohs_logs and prod_coldfusion_files at the same time and see, for each file, whether it is in one, the other or both of the indexes. For example: index="prod_ohs_logs" OR (index="prod_coldfusion_files" file="*\.cgi" OR file="*\.pl") | chart count by file index ... View more

You should store to your summary index: eventtype=request | sistats sum(http_bytes) as transfer by http_domain You should retrieve from your summary index: index=summary source=<saved_search_name> | stats sum(http_bytes) as transfer by http_domain | sort -transfer | eval transfer = tostring(transfer, "commas") | head 50 Specifically, you're not allowed to do any processing between sistats and the corresponding stats, except saving and retrieving the event set. ... View more

There are two ways that this can be done. Use eval. Any string in curly braces "{}" in the destination key will be resolved using the value of that named field. For example: ... | eval {name}=value | ... Use chart. If all you care about is the the columns implied by the value of "name", you can use the series creation feature of chart. For example: ... | chart first(value) by <rowid> name . ... View more

You can use the fact that a subsearch will render the "query" field literally. For example: ... | eval ResponseSize = eventcount * [search ... | rename size as query | fields query | head 1] ... View more

You can search: ... | stats sum(cs_bytes) as bytes by c_ip | sort - bytes | head 10 ... View more

You can use the tostring(X, "commas") function in eval (http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions): eventtype=request | stats sum(http_bytes) as bytes by http_domain | sort -bytes | eval bytes = tostring(bytes, "commas") | head 100 ... View more

The easiest way to get rid of this message is to define the lookup in transforms.conf. For example: [sidtodn] filename = sidtodn.csv Then you can refer to the lookup as lookup sidtodn ... . ... View more

AutoLB is keyed just on the done key, which is propagated from the initial to intermediate forwarders. However, in investigating this, we've observed a bug that will keep this from working as expected. Specifically we're keying the stream on just the value of the "source" key rather than an unambiguous representation of the stream. This doesn't affect a single tier of autoLB LWFs, but will cause a second tier of these to inappropriately terminate a connection when a done key is seen for a similarly named source from a different stream. This will be fixed in 4.2. ... View more

Queues become blocked when some (index-time) component in the system can't service data as fast as data is entering the system. For example, if date parsing can only operate at 30K E/s, and we could read data from files at >30K E/s, all upstream queues from date parsing will block. The standard index time queues and processors are: [inputs] -> parsingQueue -> [utf8 processor, line breaker, header parsing] -> aggQueue -> [date parsing and line merging] -> typingQueue -> [regex replacement, punct:: addition] -> indexQueue -> [tcp output, syslog output, http output, block signing, indexing, indexing metrics]. If a queue is blocked, that means that data can't be added into the queue and the upstream pipeline will wait until it's empty. No, in steady state changing a queue's size will not materially impact when it gets blocked or system throughput characteristics. Blockage is simply caused by a mismatch of input to output rate. ... View more

The "yesterday" time span is always with respect to the timezone on the search head. You can achieve your goal by setting up a separate search head per timezone, and search only the relevant data on each search head. ... View more