Thanks! Only thing is _geo_count needs to be int, so in my case value * 1000 will do the job. Now I can plot many kind of data, like temperature, pressure, etc... I hope _geo_count can handle other number/text format as well. ... View more

Now I have this, and see how this configuration works. Some answers mentioned rebooting splunk will affect the number of warm buckets, so interested in the result. maxDataSize = 1024 (bucket size is to be 1GB, or gib enough to hold 1 day indexing volume) maxHotIdleSecs = 86400 (1 day, for hot to warm roll or call the holl-hot-bucket script) maxWarmDBCount = 30 (30 buckets = 30days, for warm to cold) frozenTimePeriodInSecs = 7776000 (90 days in sec, cold to frozen) coldToFrozenDir = /archive/myindex ( after 90 days, index goes here) Thank you all for helping me out! ... View more

Yes, I rebooted, but no luck. I think hotDB is not controlled by fronTmePeriodInSecs. Also noticed that Splunk's bucket mover is triggered when: - backetsize is exceeded (hot to warm) - backet number is excceeded (warm to cold) - backet age is exceeded (cold to frozen/delete) Seems very hard to set exactly 3 month retention. ... View more

Hi ziegfried, I was trying to write some geocoding lookup script so any place or address can be changed into _geo. (or put google map API into map module so search results of names of place/addresses can be plotted on the map) This works pretty good for me now, so I will go with this solution. Thank you! ... View more

Is this something you are looking for? This will put time data on Y: "SOMESEARCH" | bin _time span=6h | chart count by _time Then, set chart type to bar. ... View more

Is this someting similar to what you wanted? SOMESEARCH | eval age = now() - _time | bucket age bins=4 | chart count by age I think "bucket" command will do the job. ... View more

I read this answer, but this does not solve my question... Is there NO way to specify the exact retantion period by Splunk??? http://splunk-base.splunk.com/answers/2392/how-can-i-rotate-all-hot-and-warm-buckets-older-than-30-days-into-cold-storage ... View more

Yes, I actually set the values same as your example with correct paths. However, there is still nothing in coldToFrozenDir after 600+ sec. Data is continuously generated and indexed. Any idea? ... View more

Hi, I was looking for the answer to the same question as yours, but I ended up with the use of $8, which is the path to the compressed search result as results.csv.gz in splunk's var/run/splunk/dispatch directory. Modifying the JS would also work, but I am afraid the modification you make probably will be overwritten when you upgrade the splunk software. Better check with Splunk support. ... View more

Thank you for your post. * I accepted the first one ... View more

Thank you! This is something I need to do, I understood. ... View more

Hi I also had a same question. http://splunk-base.splunk.com/answers/53883/how-to-configure-mv_add-in-the-search-language and I came up with this search... "some saerch to filter" | rex field=string max_match=10000 "(?<chars>...)" | chart count by string chars This will get any 3 chars in a field called string. I hope this also good for you. ... View more

To share with community, here is something close but actually not working search, but this can do similar job.. sourcetype=wordcount | dedup string | rex field=string max_match=10000 "(? ...)" | chart count by string chars ... View more

Thanks! Yea, I definitely want this to be in doc.. ... View more

Thanks, this is also great information! ... View more

Iguinn, Thanks for your post! This would work particually for a search 'abc'. What I am trying to do is also to count how many 'a', 'b', 'c', 'ab', 'ac', 'bc', 'abc' etc. The reason I need this is my language does not have space between words, and sometimes it is required to get how many times specific characters are found in a description field(string field this time) in an event. I really appreciate your comments! ... View more

I am not sure if this is good solution for you, but I had a similar situation where I needed to get the splitted values from multivalued fields. Basicly the way to split the multivalued field was the same as the one posted by csharp_splunk. This was how I tested and is messy, but it worked. * | head 1 | eval classifications = "1;2;3;4;5;6" | makemv delim=";" classifications | top classifications | fields classifications | search classifications=2 This returns 2 only. The part: * | head 1 | eval classifications = "1;2;3;4;5;6" is just to create dummy fields... ... View more

I was looking for the same thing, and with latest Splunk, I could do the following. | rest /servicesNS/*USERNAME*/*APPNAME*/saved/searches | table title qualifiedSearch I may be wrong, but wanted to share for those who will look for this in the future... e.g. "| rest /servicesNS/admin/search/saved/searches | table title qualifiedSearch" then I get this: title qualifiedSearch ------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Errors in the last 24 hours search error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) ) Errors in the last hour search error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) ) Indexing workload search index=_internal (source=*/metrics.log* OR source=*\\metrics.log*) group=per_sourcetype_thruput | timechart span=10m per_second(kb) by series Messages by minute last 3 hours search index=_internal source="*metrics.log" eps "group=per_source_thruput" NOT filetracker | eval events=eps*kb/kbps | timechart fixedrange=t span=1m limit=5 sum(events) by series Splunk errors last 24 hours search index=_internal " error " NOT debug source=*splunkd.log* Top five sourcetypes search index=_internal (source=*/metrics.log* OR source=*\\metrics.log*) group=per_sourcetype_thruput | chart sum(kb) by series | sort -sum(kb) | head 5 ... View more