Use the below search to get the views that are edited, index=_internal source=*web_access.log* /app/ action=edit | rex "/app/(?<app_name>.\w+)/(?<dashboard_name>.\w+)" | table _time, user, app_name dashboard_name ... View more

Hello, Try something like this, your base search.. ... | eval temp=mvzip(interface_name,bytes_received,"###") | mvexpand temp | rex field=temp "(?<interface_name>.*)###(?<bytes_received>.*)" | fields - temp | xyseries _time, interface_name,bytes_received Description: Use interface_name,bytes_received fields and make a single field called temp by using mvzip. use mvexpand to populate the actual values, extract the fields using rex. use xyseries to populate the values. Make sure the 2 field names are correct (interface_name,bytes_received ) ... View more

myfield is the string, epochvalue will have the epoch time. format will be %d %b '%y your base search, | eval epochvalue=strptime(myfield,"%d %b '%y") Read further on date variables & strptime https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables Sample: |stats c | eval myfield="15 Feb '17" | eval epochvalue=strptime(myfield,"%d %b '%y") ... View more

Yes. field name with space you can use in the format. Sample is below, <dashboard> <row> <panel> <table> <search> <query>index=_internal | head 100 | bin span=1d _time | stats count by _time sourcetype |rename sourcetype as "Source Type"</query> <earliest>0</earliest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <format type="color" field="Source Type"> <colorPalette type="map">{"splunkd":#6DB7C6,"splunk-access":#F7BC38,"s":#AFEEEE}</colorPalette> </format> <format type="color" field="count"> <colorPalette type="minMidMax" maxColor="#31A35F" midColor="#A2CC3E" minColor="#FFFFFF"></colorPalette> <scale type="minMidMax" maxType="percentile" maxValue="100" midType="percentile" midValue="50" minType="percentile" minValue="0"></scale> </format> </table> </panel> </row> </dashboard> ... View more

Concluding the above, what kind of data we are dealing with? what are the reason not to install universal forwarder? you have mentioned you have full access ( We have contoll on all the servers ). why can't install universal forwarder I would suggest the best way would be, install the universal forwarder in your server. if you still consider forwarder check the below easy options. update your application to post the data to splunk forwarder. create a script to perform to post. Assuming in-case installing forwarder manual is the issue then use some continuous deployment, if you dont want to go with licensed one then create a script to do the work. what is the reason not to install universal forwarder? what kind of data we are dealing with? you have mentioned you have full access ( We have contoll on all the servers ) steps to start exploring would be, http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/InstallaWindowsuniversalforwarderfromthecommandline Sample scripts, https://answers.splunk.com/answers/34896/simple-installation-script-for-universal-forwarder.html Posting clear would help others to help you further. ... View more

i think you are looking for the field linecount This search will help you to know the event lines base search | table linecount, _raw you can group by the linecount or _raw to explore further. ... View more

try something like this, base search | rex "E/Rules_(?<rulename>\w+).*(DeviceException|ZigbeeServiceException):\s+(?<result>.*)$" Hope this will helps you. ... View more

yes, you can pass the macro's based on the token selection. basic sample code: <form> <label>Form example: source type time chart</label> <!--autoRun means the search runs as soon as it is loaded. --> <!-- Do not need a submit button --> <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="sourcetype_tok"> <label>Select a source type</label> <default>splunkd</default> <choice value="splunkd">splunkd</choice> <choice value="splunk_web_access">splunk_web_access</choice> <choice value="splunkd_ui_access">splunkd_ui_access</choice> </input> </fieldset> <row> <panel> <chart> <search> <query> index = _internal sourcetype=$sourcetype_tok$ | timechart count by sourcetype </query> <earliest>-7d</earliest> <latest>-0d</latest> </search> </chart> </panel> </row> </form> Insead of query use the following, <query> `your_macro($<your token>$)` </query> In-case if you want to create / populate the macro you have to use sub search . samples: https://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms ... View more

Hello, try the below search, .... your base search |eval temp=Timestamp+"###"+Field1 |xyseries temp Field2, Field3 | rex field=temp "(?<Timestamp>.*)###(?<Field1>.*)" | fields - temp | table Timestamp, Field1, * Sample, raw data creation, |stats c | eval Timestamp="2017-01-01" | eval Field1="AAA" | eval Field2 ="Key1" | eval Field3="Key1val" |append[ |stats c | eval Timestamp="2017-01-01" | eval Field1="AAA" | eval Field2 ="Key2" | eval Field3="Key2val" ] |append[ |stats c | eval Timestamp="2017-01-01" | eval Field1="AAA" | eval Field2 ="Key3" | eval Field3="Key3val" ] | table Timestamp, Field1, Field2, Field3 Sample data with logic, |stats c | eval Timestamp="2017-01-01" | eval Field1="AAA" | eval Field2 ="Key1" | eval Field3="Key1val" |append[ |stats c | eval Timestamp="2017-01-01" | eval Field1="AAA" | eval Field2 ="Key2" | eval Field3="Key2val" ] |append[ |stats c | eval Timestamp="2017-01-01" | eval Field1="AAA" | eval Field2 ="Key3" | eval Field3="Key3val" ] | table Timestamp, Field1, Field2, Field3 |eval temp=Timestamp+"###"+Field1 |xyseries temp Field2, Field3 | rex field=temp "(?<Timestamp>.*)###(?<Field1>.*)" | fields - temp | table Timestamp, Field1, * Hope this will helps you, ... View more

based on the previous comments i understand your data is something like this date total_cards 1-Feb 1000 1-Feb 400 1-Feb 500 2-Feb 400 2-Feb 300 2-Feb 200 2-Feb 100 Expected is date total_cards 1-Feb 1900 2-Feb 1000 then try the below search, ... base search | bin span=1d _time | stats sum(total_cards) as Total by _time I am not sure why you have calculated the multiplication of count and total_cards. In-case that's what you want means try the below query, base search | bin span=1d _time |stats count by total_cards,_time | eval total = (total_cards*count) | eventstats sum(total) AS Total by _time | table _time Total Hope this helps you. ... View more

try something like this, your base search.... | eval o1=o |nomv o1 | rex mode=sed field=o1 "s/\n/|/g" ... View more

try something like this, your base search .. | rex "(?<id>\w+)\s(?<fields>.*)" | eval temp=split(fields,"&") | mvexpand temp | rex field=temp "(?<field>.*)=(?<value>.*)" | table id, field, value Sample |stats c | eval _raw="ID1 field1=value1&field2=value2&field3=value3" |append[|stats c | eval _raw="ID2 field1=value1&field2=value2&field3=value3&field4=value4"] | rex "(?<id>\w+)\s(?<fields>.*)" | eval temp=split(fields,"&") | mvexpand temp | rex field=temp "(?<field>.*)=(?<value>.*)" | table id, field, value your raw event should like as per your question... post your sample events . ID1 field1=value1&field2=value2&field3=value3 Hope this helps you!! ... View more