you 're welcome ... View more

This is a form where you have a search string like yours and an input text for the value of span. take a look .it may help you <form> <label>duration</label> <fieldset submitButton="false"> <input type="text" token="duration" searchWhenChanged="true"></input> </fieldset> <row> <panel> <chart> <search> <query>index=_internal|timechart span=$duration$ c</query> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> </form> ... View more

I have try that search too, i mean | timechart span=duration count you are right it seems as span do not consider variable as we did. If you really want to do that you can think of a form with 2 panels and one input for the value of span: 1-the first panel gives you the value of duration that you can read and enter as input for the second panel that will use it as span value via a token. 2-the input type should be text so that you can enter a string like 3600s This is and axample where i have a form and the possibility to enter the span. if you like it just add the other panel that will show you the exact duration to use. <form> <label>duration</label> <fieldset submitButton="false"> <input type="text" token="duration" searchWhenChanged="true"></input> </fieldset> <row> <panel> <chart> <search> <query>index=_internal|timechart span=$duration$ c</query> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> </form> ... View more

Hello Sloefke , I'm seeing that you misused the span command the syntax is span=duration not span (duration) like for example span= 10s or span= 1h try it. ... View more

Hi , OK if you are able to have the duration value which may be a float: 1- convert it into second using blablabla | eval duration=floor(duration) this gives you duration without .00000 2- Now let's concatenate "s" using: blablabla | eval duration=floor(duration)| eval duration= duration + "s" 3- Now the the value of duration is an integer folow by "s". you can now passed it to timechart span=duration ... View more

Hi , 1- The sum of the indexed volume may have been above the limit of your licenses. 2- assuming that the license manager result is correct, to find the soure or host that sent most data you : find the max(kb) by host or by source over that period of time. 3- for example: index="_internal" source="*metrics.log" group="per_sourcetype_thruput" | chart max(kb) by host ... View more

Hi, Your question is not explicit but i will try to give you something. use strftime(X, Y) : This function takes an epochtime value, X, as the first argument and renders it as a string using the format specified by Y for example : ... | eval n=strftime(_time, "%H:%M") here n content the values of the field _time but in term of hours and minutes only. Use ctime(X) This function Convert an epoch time to an ascii human readable time. Use timeformat option to specify exact format to convert to. Example ... | convert timeformat="%H:%M:%S" ctime(_time) as timestr So i think you can replace _time by your field that content your dates and for more types of time format you can take a look in http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference in the section Common date and time format variables ... View more

Hi , I can see that you have misuse your fillnull. try to use fillnull value=blank isntead of fillnull=blank ... View more

in the code below replace my search string with your own . ... View more

<form> <label>Bar Chart</label> <description>Example using a basic bar chart</description> <fieldset submitButton="false"> <input type="time" token="time_token" searchWhenChanged="true"> <label></label> <default> <earliestTime>-7d@h</earliestTime> <latestTime>now</latestTime> </default> </input> </fieldset> <row> <panel> <chart> <searchString>index="_internal" | stats max(bytes) as "whatever with a space" max(current_size) as whatever by sourcetype </searchString> <earliestTime>$time_token.earliest$</earliestTime> <latestTime>$time_token.latest$</latestTime> <option name="charting.chart">bar</option> <option name="charting.axisY.scale">log</option> <option name="charting.chart.stackMode">default</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> </form> ... View more

OK if i understand well you need to transform that line into a culumn in the same chart. Let's try to use simple xml. ... View more

Hi HattrickNZ , If having only whatever as a culumn is ok for you , just exchange the position of the fields whatever and whatever a space like you can see below: enter code here ...| stats max(limit2) as "whatever with a space" max(c117) as whatever by userLabel And you can set up whatever a space as line for the chart overlay if it is what you want. ... View more

Can you be more clear about what you want? ... View more

HI, This is an example of bar chart with values above enter code here // THIS IS AN EXAMPLE OF BAR CHART WITH VALUES ON TOP // XML CODE: <dashboard script="custom_chart.js, autodiscover.js" stylesheet="custom_chart.css"> <label>Custom Chart Overlay</label> <row grouping="2"> <html> <h2>Line + Bar Chart</h2> <div id="chart1" /> </html> <table id="table1"> <searchString>index=_internal | stats count by sourcetype</searchString> <earliestTime>0</earliestTime> <latestTime>now</latestTime> </table> </row> </dashboard> // Js CODE: /* * A custom chart example based on the d3chartview of the web framework. * The component is initialized in Javascript which provides more flexibility and formatting options. */ require([ 'underscore', 'jquery', 'splunkjs/mvc/utils', 'splunkjs/mvc', 'splunkjs/mvc/d3chart/d3chartview', 'util/moment', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, utils, mvc, D3ChartView, moment) { // Re-use the search manager of the results table var tableManagerid = mvc.Components.get('table1').settings.get('managerid'); // Create the D3 chart view var bar_chart = new D3ChartView({ "id": "chart1", "managerid": tableManagerid, "type": "discreteBarChart", "el": $('#chart1') }).render(); bar_chart.settings.set("setup", function(chart) { // Configure chart formatting chart.color(d3.scale.category10().range()); //chart.margin({right: 100, left: 80, top: 70, bottom: 70 }); chart.staggerLabels(true); chart.showValues(true); }); }); // CSS CODE: #chart1, #chart2 { height: 450px; } NOTE:To test it copie custom_chart.js and custom_chart.css in Splunk_etc_apps_AppName_appserver_static And create a dashboar in your App with the XML CODE. ... View more

Hi Jackson, To fill an empty field with null or other value you can use the commande fillnull ... | fillnull value=NULL you can also specified the fields to work on if you like ... | fillnull value=NULL fieldx fieldy ..... you can replace NULL by a string of your choise ... View more

With a search such as ……. ….|table *** If you desire for exemle to remove a Colum on the displayed result, you can transform your search to **...|table * |fields – fieldName where fieldName is the field you don’t want to display. You can do it for many fields at once like this ….|table * |fields – fieldName1, fieldName2,… This is an exemple that display all fields except the fields host an index index=* |table *|fields - host ,index ... View more

Hi TIA, The limitation of the number of events can be due to the time limitation of the subsearch. To change the maxtime or other subsearch attributes edit limits.conf in $SPLUNK_HOME/etc/system/local/ and this is how the stanza to modified looks like. [subsearch] maximum number of results to return from a subsearch maxout = 10000 maximum number of seconds to run a subsearch before finalizing maxtime = 60 time to cache a given subsearch's results ttl = 300 NOTE:If the file do not exist you can create it. ... View more

Hello Marco, I have indexed your file email-prp-xxxx-batch .txt and i have tried to write some regex to extract the fields. I still have some small lack of understanding about the data. But for the moment i this can help you. NOTE: to run this on your server , make sure you put an appropriate sourcetype. mar is the one a have created during data input and marco is the index in wich i have place the data. index=marco sourcetype="mar" | head 10000 | rex "(?im)^[^\\-\\n]*\\-(?P<CPU>[^#]+)" | rex "(?i)9CNHL (?P<SCHEDULE>[^ ]+)" | rex "(?i)(?P<SCHEDULE>[^ ]+)\\s+\\*\\w+\\s+\\d+\\*\\s+\\w+\\s+\\d+\\s+\\d+:\\d+\\s+\\d+:\\d+\\s+\\[\\w+\\]" |rex "(?im)^\\s+(?P<JOB>[^ ]+)"| rex "(?im)^\\s+\\w+\\s+(?P<STATE>[^ ]+)" | rex "(?i) SUCC (?P<PR>[^ ]+)" | rex "(?i)^\\s+[a-z_-]+\\w+\\s+\\w+\\s+\\d+\\s+(?P<START>[^ ]+)"| rex "(?i)^[^/]*/\\d+\\s+\\d+:\\d+\\s+(?P<DEPENDENCIES>[^ ]+)"| rex "(?i)^[^/]*/\\d+\\s+(?P<ELAPSE>[^ ]+)" |table SCHEDULE JOB STATE PR START ELAPSE DEPENDENCIES ... View more

Hi , i think i can help you just send me the file to work on at cyrilleko@gmail.com ... View more

for the search you did you can have a pie index="main" sourcetype="syslog" | stats count by src_ip,src_port,dest_ip,dest_port,protocol,action | sort -count|top 10 the general syntaxe of the top commande is: top top-option fiel-list [by-clause] see Splunk Enterprise 6x Search Reference for more on the command. ... View more

OK If you are already able to make a search as you did, Producing a pie chart will be easy. just make sur that you filter your search as you like and at the end to have the top 10 you add this: | top limit=10 action if you are in the splunk default search view , clic on visualization then choose pie in the dropdown menu beside format. ... View more