The Advanced XML is not supported with the Splunk upgraded version of 8.X - So how can I identify that which XML is used by my dashboard. - In case if its using Advanced XML and it will be creating problem if my Splunk is upgraded to recent version, then how can I fix it? Could anyone please help me on this. ... View more

I have displayed percentile of certain metric values by grouping with month & host in a table representation. Whatever host category, we select from the dropdown, the value of the metrics will be displayed for each of its hosts. No. of servers in each host category will differs. As like addtotals I want to take percentile of my entire row values. Below are sample data from my table panel. Month host1 host2 host3 Jan 90 40 78 Feb 36 27 56 : Dec 12 49 22 The command addtotals will sum all the values of a row and provide one more column with the cumulative value. But in my case instead of sum I want to do percentile of all those values. Below is the way I wanted Month host1 host2 host3 P95(host) Jan 90 40 78 Feb 36 27 56 : Dec 12 49 22 Could anyone help me on this asap? ... View more

In my dashboard, a table panel which have the percentage of a metric for each month is displayed. Below is the query details: <Base search> | stats avg(metric_perc) as Metric over Period by Host Below are the results of my search query: Sl.No, Period, host1, host2, host3 1 Jan 36 52 64 2 Feb 43 69 66 : : 12 Dec 26 45 58 I want to highlight only the maximum the values of each host for each period. [Note: Here host1, host2 and host3 are not column names they are values of the column called Host. As I used the keyword over , I got the above table representation with the combination of 3 fields such as Metric, Period and Host] Could someone help me in finding how can I highlight or color code only the maximum value of Metric for each host and period. ... View more

I was going through the Release note which was updated into Splunk Docs recently. https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020?elqTrackId=29cfe97d93df4472a4746e2296a937f9&elq=7cd999a2e77845b6ad79ff165291d6e3&elqaid=25340&elqat=1&elqCampaignId= It is mentioned that Beginning on January 1, 2020, un-patched Splunk platform instances will be unable to recognize timestamps from events where the date contains a two-digit year. This means data that meets this criteria will be indexed with incorrect timestamps. My Splunk version of Splunk Enterprise is 7.0.2 , I have checked the format of timestamp from some of the sample events which are indexing into my Splunk instances. The timestamp format of the events which are forwarded to Splunk is correct with four-digit of year. But only my Splunk is showing the timestamp of logged events in two-digit of year. Please refer the highlighted part in the screenshot Splunk_events_timestamp Is the existing timestamp format with the events are right or should I need to modify anything to accommodate with the changes effective on January 1st 2020? ... View more

host=* sourcetype=* |replace *.zip WITH * IN Object | replace *.csv WITH * IN Object | replace *.null WITH * IN Object | replace *.xls WITH * IN Object | replace *.pdf WITH * IN Object |fillnull value=0, Bytes_W |stats sum(Bytes_W) In the above code, I am using replace command to replace the field values of Object with * wherever it has values with some extension like .csv, .null, etc., Also I am using the fillnull command to fill the value as ‘0’ wherever the field Bytes_W is not available. The query with replace command as first and followed by fillnull is providing the Bytes_W result as 0 (though there are data for the field Bytes_W). Whereas the same query, if I change the position of the commands as fillnull first and followed by replace command, providing the correct results. Note:- This issue is happening only during a particular time period. Not sure what is causing the problem over here. Could anyone please help me in this case. ... View more

I have an issue with adding the HTML code in my Splunk dashboard. The code is to set the color to a specific field/column in a panel with table representation. I have added the below code, which is working fine for the number field (COUNT) <format type="color" field="COUNT"> <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"> </colorPalette> <scale type="minMidMax"></scale> </format> I would like to add the same code for a field which represents the time duration in the format of "HH:MM:SS". The above code is not supporting the time format. Could anyone please help me in getting the right code to support the time format fields also. ... View more

I have tried going through Terms and Conditions but nowhere I could find. Just want to know what happens to all of my posted questions on Splunk Answers, if I delete my Splunk Answers account. Will the questions turn as posted by "Unknown User" or Orphaned questions something? Please someone help me to know on this. ... View more

I would like to know how to display the exact date of the time modifiers which are specified in the earliest and latest time range. Eg: earliest=-1q@q latest=@q We know that this is nothing but the last quarter details, which is earliest =01-01-2019 and latest=31-03-2019. I am using the time modifier in my query and I want to display the above format date along with my other panels in my dashboard. This may change according to each quarter/year we select from input. I am using this in a case condition, <condition> <eval token="growth_title2">case($result.time_period$=="earliest=-1q@q latest=@q","xxxx", $result.time_period$=="earliest=-1y@y latest=@y", "yyyy")</eval> </condition> The place xxxx and yyyy needed the logic to display the earliest & latest time in date format Could anyone please help me to display time which is mentioned in time modifier as date format. ... View more

I have a requirement, where I need to display name of an queue, for which the size of the queue is keep on increasing. Basically I am searching for every 15 minutes, to check in each 5 minutes of time span, what is the size of my queue. If the size of the queue in each 5 minutes shows some gradual increase, I want that queue to be displayed. There may be the case first 10 minutes, it increase and again the 3rd time it may decrease. I dont want that kind of information. For example Queue Name: XY Size of the Queue in last 15 minutes: 1st 5 minute size - 10 2nd 5 minute size - 20 3rd 5 minute size - 30 4th 5 minute size - 35, etc., So in this kind of situation I want to check only the 15 minutes with 5 minutes time span and see whether there is any increment in the value of the field. If there is a positive growth in continuous 3 times, then I need to display that particular queue. I have checked that streamstats will be helpful in this case. Can anyone please suggest me on this? ... View more