This might help you http://docs.splunk.com/Documentation/WebFramework ... View more

Here you can use NOT operator along with where to exclude. ... View more

Why dont you Try with where command it will work ..|where uid=="*" ... View more

May be tokens are not replaced in the query. Check once. ... View more

For Example, I want to have a single saved search query which will get executed for every 1hr and it will be processing the particular batch of records. And for each batch query logic should be modifed dynamically. Can we accomplish this using custom command? Can we invoke another query inside custom command without using Splunk Python SDK? ... View more

Oh my bad 🙂 ... View more

It would be better you use eventstats instead of stats because it will retain the other fields. ... View more

Since you are returning values using $ip. Even if you construct multi valued field it will be returned like "Value1 Value2". You need to construct String like ip= "Value1 OR Value2" while using return. ... View more

I'm glad it worked. Can you accept the answer mate 🙂 ... View more

Can you try like ('SANS3.1'+ 'SANS3.2'+' SANS3.3'+' SANS3.4'+ 'SANS3.5'+' SANS3.6')/6 Problem might be with "." operator. ... View more

If you do |inputlookup then it will be stored in lookups folder of the Application. If you want to write and store it in different location you can write a custom command in Python. Which will write the file in specified location where you can pass the location which you want. |<custom command> arg1=<location> In command write normal file operation program which will write output records from previous command to a file. ... View more

If null is present in any then eval expression will not get executed. ... View more

Please check you are getting any null values in SANS3.1, SANS3.2, SANS3.3, SANS3.6, SANS3.7, SANS3.10. If null is present then do fill null with 0 value. Then try, |fillnull value=0 SANS3.1, SANS3.2, SANS3.3, SANS3.6, SANS3.7, SANS3.10| eval SANS3=(SANS3.1+SANS3.2+SANS3.3+SANS3.6+SANS3.7+SANS3.10)/6 ... View more

This app might help you to use customization in Simple XML. https://splunkbase.splunk.com/app/1772/#/documentation ... View more

Hi, Q1 - How will you import data from other servers? Data is already indexed? You cant store data in Splunk server without indexing. You can filter success logs while forwarding and indexing the data using props and transforms. ... View more

Just Comapare both times and get the difference. ..|eval diff=_indextime-_time|table _indextime,_time,diff ... View more

Please accept the Answer 🙂 ... View more

I dont think it can be done beacuse Splunk stores the data which is being indexed. ... View more

Please accept the answer ... View more

http://stackoverflow.com/questions/1377446/render-html-to-pdf-in-django-site ... View more

Ok why dont you rename srcip and source-address to other variable like sourcetype=source1 sourcetype=source2|eval srcIpAddress=if(isnotnull(srcip),srcip,if(isnotnull(source-address),source-address,NULL))|lookup Lookup.csv Address as srcIpAddress Or you can join it twice like below But make sure that you will take backup of Time,Attack fields before 2nd join (Because they will be replace in the second join) sourcetype=source1 sourcetype=source2|lookup Lookup.csv Address as srcip|rename Time as temp_Time,Attack as temp_Attack|lookup Lookup.csv Address as source-address|eval Attack=if(isnotnull(temp_Attack),temp_Attack,Attack)|eval Attack=if(isnotnull(temp_Time),temp_Time,Time) ... View more