Yes you can ouput all the values in a csv file a use the csv to populate teamname. .............|outputcsv fileName ... View more

Hi sethrice, just to tell you that to manifest you gratitude as you did by awarding me a point, you can vote. It cost nothing. Thanks to Runals. ... View more

Hi, Check SPLUNK DEPLOYMENT MONITOR APP https://splunkbase.splunk.com/app/1294/ https://www.splunk.com/en_us/solutions/solution-areas/it-operations-management/server-and-network-infrastructure-monitoring.html But you can simply create you personal dashboard or app What you have to do is: 1- you index the performance log of of the corresponding machines. 2- you can forward all the notable information on on machine in a dedicated index by doing summary indexing. 3- finaly you can create your dashboards with events from you notable index. NOTE: IF YOU ARE USING SPLUNK 6.2 , IN SETTINGS -- MANAGEMENT CONSOLE if you are in deployment MODE and if your deployment is well configured you have DASHBOARDS THERE THAT SHOWS YOU many things among which CPU USAGE and OTHER. ... View more

Hi, You can solve you problem by creating a dashboard as follow: 1- your dashboard should have two input(may be dropdown) - one for populated by a search that produce the values of REF-XXXX XXXXXX the other populated by a search that gives you all the appropriate value of CON-ID,CO an IDcon. 2- your dashboard should have a main query (or more than one ) filter by the tokens of the two inputs. 3- Note that if there is a dependency between REF-XXXXXXXXX and your CONIDs, you can use the token of one to filter the populating search of the other. BY DOING SO IT WILL BE OK IF you have you have goods populating searches and good query. As you are new you can provide a sample of you data to have more help with the queries. ... View more

Hi download this pdf it will surly help , http://docs.splunk.com/Documentation/ES/3.2.2/Install/Overview ... View more

Hi, If there is a way you can have your event in the statistic tab, and if you are using splunk 6.2, you can go in format option and select LINE NUMBER to yes ... View more

Hi npestana88, to be able to use the multivalue separated by comma, you have to first expand the field. to expand a field like vpp for exemple: .......|makemv delim="," vpp |mvexpand vpp |table vpp Now that your field is expand, you can plot them as you desire ... View more

Hi I think this can help you: index=????? sourcetype=???? | rex field=_raw "^(?P<TIME>[^ ]+)\\s+(?P<MMESSAGE>.+)"|table TIME MMESSAGE ... View more

Hi, schulz You have to understand that when you use CSS to animate or to give color to something in a dashboard, there is always that result when you export in pdf because the colors is not static. So for the moment I don,t know if the issue have a solution. ... View more

That is really good. for your information you can give bonus to someone by clicking on award points ... View more

Hi , I think this can help you: your_search | eval increment_success = 1 + [ search your_search|eval a_success_flag=if(status="SUCCESS", 1, 0) |return $a_success_flag] |eval increment_success =0 + [ search your_search|eval a_faillure_flag=if(status!="SUCCESS", 0, 0) |return $a_faillure_flag] |table increment_success _time Note that you getthe true result of increment _success by removing 1 ... View more

Hi sushmitha_mj , to get recent value of a field you can use first() with stats cammand : for exemple: index=os sourcetype=vmstat host=$host$ |stats first(memFreeMB) as Mem_Free, first(memUsedMB) as Mem_Used by host ... View more

Hi, eugenek Assuming that the field contening how value is q , with the following you can have what you are describing easily. 1- Count of value of field q that start with lowercase (apple): .... q=* | where like(q, "apple%")|stats count(q) AS Count_apple 2- Count of value of field q that start with uppercase (Apple): .... q=* | where like(q, "Apple%")|stats count(q) AS Count_Apple 3- count of the original mixed field( only for values of apple & Apple) : .... q=* | where like(q, "Apple%") OR where like(q, "apple%") |stats count(q) AS mixed_count ... View more

Hi Federica_92, I the following can solve your problem: .........|eval SingleName=mvzip(entityName, individualName)| makemv delim="," SingleName|mvexpand SingleName For Example if you want to have both host and soure in the same field call SingleName : index=*|table host source|eval SingleName=mvzip(host,source)| makemv delim="," SingleName|mvexpand SingleName I hope you will be satisfied. ... View more

Hi try this to merge your searches, sourcetype="algorithmjoblog" serialNumber="NTEST*" | transaction startswith=(segmentId=0 processingPhase=mapStart) endswith=(segmentId=165 processingPhase=mapEnd)|eval duration1=duration| table duration1 [search sourcetype="algorithmjoblog" serialNumber="NTEST*" | transaction startswith=(phase=integrationStart) endswith=(phase=integrationEnd)|eval duration2=duration| table duration2] |eval duration3= duration1 + duration2| eval Test_duration=if(duration3>10, "the time exceeds","No")|table Test_duration You can set up your alert base on the value of the field Test_duration ... View more

Jeffland, Interesting the answer is more better with what you just add. thanks ... View more

Hi HattrickNZ , There is no limit for the number of categories that can be in legend in splunk timechart . If you have 14 categories to show and it only shows 10, It is simply because splunk consider the value or the amount of the other categoties to be insignificant. So splunk do not see an interest to put then in the legend But splunk gather all that values in one categories call other Note that you can decide to display all your legend values( see what Chimell proposed). ... View more

Can I have more details about the prerequisite characteristic of the computer on which I want to deploy? ... View more

Thanks for you comment. ... View more

Thanks Lucas K, happy to know that you have already done that. I will like to have your email address so that I can get you for more questions. Here is mine: [email protected] ... View more

Hi, Alex To re-run a search that you typed in previously : 1-In splunk web, when start typing the first words of a search,splunk immediately propose all the previous searches that have been typed In.among that you can choose your search and re-run. 2- after running or while you are running a search,you can save It as REPORT .by doing so you can re-run it when you want and you can event use it in a dashboard. 3- Note that you can also scheduled a search to automatically run periodically. ... View more

Taking in account the previous answers, I think that summary indexing can be helpful to solve the problem of late arriving data when the the communication goes down. ... View more

Hi, while waiting for a better solution, let met tell you that you can do it after indexing: 1- after identifying the duplicated event or file. 2-build a query that fetch what you want to remove and pipe it with delete. 3- you can scheduled that search to run periodically. Now to export event you can use the command dump: 1- you build the query that map the event you want to export. 2- then you pipe like this .....l dump basefilename=MyExport Note: see all the options for the dump command in the splunk search reference manual. You can also do an outputcsv. After that scheduled the search to run each 15min. ... View more