I have the following xml: I want to have Name=$unit$ for the line eval token. And will have other conditions to be Name=$campus$ , etc. But I can't seem to find an escape character for splunk to understand that I want to refer to a token instead of a String. I tried 'unit', $unit$, '$unit$'. But all of them don't work. Will I be able to do this with splunk today? If not, What could be a good work around? Thanks! ... View more

I want to create a dropdown list for my dashboard. But I can't figure out how to make a dropdown like this in Splunk. Or maybe the option isn't available for now. How can I do this in Splunk? Thanks! ... View more

I have a dashboard which comes with a universal time field. I want to use it for my timecharts as well. But it acts differently when my time filter is set within a specific month. It works if I select the time field as "advanced" and set the earliest to -1mon@mon and latest to @mon. I want my timecharts to compare the month in time field and the previous month. For example, if I select the time to be in the month of September then my timechart will take that month to be the latest time frame and earliest to be August. Is this possible in Splunk? Thanks. ... View more

I have the following search: index="monthlycdr" | eval "transporttype"=replace('Transport Type',"\"","") | eval "tt"=case( match(transporttype, "(?i)voice_sip"), "Sip_voice",match(transporttype, "(?i)sIp"), "Sip", match(transporttype, "(?i)voice_H323"), "H323_voice",match(transporttype, "(?i)H323"), "H323", match(transporttype, "(?i)pstn"), "PSTN") | stats count by tt with the option: And this is my result picture: I know by default splunk has this percentage to 3 decimals. But is there anyway I could round it to 1? If not, how can I calculate it manually in my search base on the search that I have now? I've tried to calculate the percentage from my search but due to the case statement, I can't figure out a way to calculate the percentage value. Thanks! ... View more

I have a restful api endpoint that I can make a http get to but it requires that I have to add the from-date and to-date as arguments. They have to be in this format: from-date=2017-10-27T00:00:00&to-date=2017-10-27T23:59:59. I want to make "from-date" to be the current time minus 15 min and the "to-date" to be in the above format for current time. I did some research and find that I could write a handler to do this. But I still don't understand it. Before I wrote a custom handler class in responsehandler.py to handle the response object after the url get call. But since these arguments have to be added to the url for the http get to work. I still don't know how this will work. Could anyone help me with this please? Thanks ... View more

I have the following data from csv file that I want to index into splunk. I want to set the timestamp to be the highlighted portions but if I select auto for timestamp it will grab the first timestamp that it detects. So I modify the props.conf file to add the following line: TIME_PREFIX=^([^,]*,){4} which tell it to take the timestamp after the 4th comma. But for some reasons it grabs the 10-27-2017 along with 00:04:44 but skip the 6:20 PM (which is the actual time that i need). Is there anything I could do to avoid this? Thanks! ... View more

I want to read a file in the zip archives and index it into Splunk with REST modular input app. The following is my code for the handler: I have been doing research to get my code to work for a week now with no result. I tried running the code on an actual zip file and it works. But when I make change to the actual responsehandlers.py, it doesn't run the whole class and I believe it got stuck in the line file = zipfile.ZipFile(io.BytesIO(response_object.content)). Which is why I wrote the line print_xml_stream(response_type) and print_xml_stream("test2") to test it and only the first print works. The response_type that got index is "text", which lead me to wonder if rest modular input works for handling zip file since on the drop-down list, I only see json, xml and text. I read a few thing about python sdk that run on rest, would this be a good work-around? ... View more

I have been searching about this for the last couple of days. I don't think Splunk have this feature but I just want to make sure if I was right. So I have this search: index="monthlycdr" | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" | timechart span="1mon" avg("Call Duration") as "TotalCD" Which give me this result: But when I covert my search to 00:00:00 format it doesn't show the trend. Here is the new search: index="monthlycdr" | eval "Call Duration"=replace('Call Duration',"\"","") | convert dur2sec("Call Duration") as "Call Duration" | timechart avg("Call Duration") as "TotalCD" | eval "TotalCD"=tostring($TotalCD$,"duration") | eval TotalCD=replace(TotalCD,"(\d+):(\d+):(\d+).(\d+)","\1:\2:\3") Which give me this result: I want the second search to have trend just like the first search. But I believe I can not do this due to a string conversion. Am I right that Splunk wont be able to do this, at least for now? ... View more

I can not figure out how to color the trend instead of the value. This is my search: I found a documentation about it on splunk but it doesn't show how to use it or what command I should use. I look around and try option like colorvalue, rangemap, .... but have no result. This is the example i saw on splunk documentation site: I want the big number to be black and the trendline along with the number below it to be a different color depend on the number. Did I do anything wrong here? Thanks ... View more

I want to display the total event count for the current month and then compare it to the total event for the last month and the up or down arrow to be the difference between this month event and last month along with the number of the count below it. Is it possible that this could be done with Splunk? Like this: I have this search but I don't know what would come next since everything I try after that failed: index="monthlycdr" earliest=-2mon@mon latest=@mon ... View more

When I do a stats count by a specific column. The count for each of them work. Here is the picture: But when I actually try to count only the Failed Attempt call. The result is 0. Did I do something wrong here? ... View more

My json file is very long but most of the information in there is redundant. I just want to get all the segments that start with the line callIdentifier and end with the line endTime. The number of segment like this is in the json file is unpreditable. Is there a way I could do this with Splunk? Here is the example of the json file: { "plcmCallList" : [ { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/f5a9acac-2878-460e-8744-aa64a110a128", "rel" : "self", "type" : "application/vnd.plcm.plcm-call", "title" : "Self Relationship" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/f5a9acac-2878-460e-8744-aa64a110a128/call-events", "rel" : "urn:com:polycom:api:rest:link-relations:events", "type" : "application/vnd.plcm.plcm-audit-event-list", "title" : "Call Events" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/f5a9acac-2878-460e-8744-aa64a110a128/subscription-events", "rel" : "urn:com:polycom:api:rest:link-relations:subscription-events", "type" : "application/vnd.plcm.plcm-subscription-event-list", "title" : "Subscription Events" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/f5a9acac-2878-460e-8744-aa64a110a128/property-changes", "rel" : "urn:com:polycom:api:rest:link-relations:property-changes", "type" : "application/vnd.plcm.plcm-audit-property-change-list", "title" : "Property Changes" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/f5a9acac-2878-460e-8744-aa64a110a128/signaling-diagram", "rel" : "urn:com:polycom:api:rest:link-relations:signaling-diagram", "type" : "image/png", "title" : "Signaling Diagram" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/f5a9acac-2878-460e-8744-aa64a110a128/bandwidth", "rel" : "urn:com:polycom:api:rest:link-relations:bandwidth", "type" : "application/vnd.plcm.plcm-bandwidth", "title" : "Bandwidth" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/f5a9acac-2878-460e-8744-aa64a110a128/qos", "rel" : "urn:com:polycom:api:rest:link-relations:qos", "type" : "application/vnd.plcm.plcm-qos", "title" : "QoS" } ], "destinationDetails" : { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/devices/c6acb1b6-4e7b-45da-ae74-4dd7f26de805", "rel" : "urn:com:polycom:api:rest:link-relations:device-details", "type" : "application/vnd.plcm.plcm-device", "title" : "device-details" } ], "deviceIdentifier" : "c6acb1b6-4e7b-45da-ae74-4dd7f26de805", "ipAddress" : "199.81.66.22", "deviceName" : "abc70-tam", "deviceModel" : "PolycomRealPresenceGroup310", "deviceVersion" : "6.1.0", "aliases" : [ "sip:abc70-tam@ute.jjjj.com" ], "registrationStatus" : "ACTIVE", "site" : "ABC", "territory" : "Default DMA Territory (dma-l4)", "authenticationStatus" : "NOT_APPLICABLE" }, "originatorDetails" : { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/devices/642b14bb-c624-4e72-aa0e-7dba421b22ba", "rel" : "urn:com:polycom:api:rest:link-relations:device-details", "type" : "application/vnd.plcm.plcm-device", "title" : "device-details" } ], "deviceIdentifier" : "642b14bb-c624-4e72-aa0e-7dba421b22ba", "ipAddress" : "199.81.66.17", "deviceName" : "abc70-oled", "deviceModel" : "PolycomRealPresenceGroup310", "deviceVersion" : "6.1.0", "aliases" : [ "sip:abc70-oled@ute.jjjj.com" ], "registrationStatus" : "ACTIVE", "site" : "ABC", "territory" : "Default DMA Territory (dma-l4)", "authenticationStatus" : "NOT_APPLICABLE" }, "callIdentifier" : "f5a9acac-2878-460e-8744-aa64a110a128", "originator" : "sip:abc70-oled@ute.jjjj.com", "dialString" : "sip:abc70-tam@ute.jjjj.com", "destination" : "abc70-tam", "nodeId" : "fc4d797f-e368-485e-94b6-58fb8c13f683", "callStatus" : "Ended", "callDuration" : "0:1:70", "callSignaling" : "SIP", "cluster" : "vrh12345.ute.jjjj.com", "entityTag" : "ecb9cf92882c65d6e1dce00f759e515c", "startTime" : "2017-10-27T14:06:55.912-0500", "endTime" : "2017-10-27T14:08:05.980-0500" }, { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/64d5b15a-84aa-419c-b861-ce632311fb55", "rel" : "self", "type" : "application/vnd.plcm.plcm-call", "title" : "Self Relationship" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/64d5b15a-84aa-419c-b861-ce632311fb55/call-events", "rel" : "urn:com:polycom:api:rest:link-relations:events", "type" : "application/vnd.plcm.plcm-audit-event-list", "title" : "Call Events" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/64d5b15a-84aa-419c-b861-ce632311fb55/subscription-events", "rel" : "urn:com:polycom:api:rest:link-relations:subscription-events", "type" : "application/vnd.plcm.plcm-subscription-event-list", "title" : "Subscription Events" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/64d5b15a-84aa-419c-b861-ce632311fb55/property-changes", "rel" : "urn:com:polycom:api:rest:link-relations:property-changes", "type" : "application/vnd.plcm.plcm-audit-property-change-list", "title" : "Property Changes" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/64d5b15a-84aa-419c-b861-ce632311fb55/signaling-diagram", "rel" : "urn:com:polycom:api:rest:link-relations:signaling-diagram", "type" : "image/png", "title" : "Signaling Diagram" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/64d5b15a-84aa-419c-b861-ce632311fb55/bandwidth", "rel" : "urn:com:polycom:api:rest:link-relations:bandwidth", "type" : "application/vnd.plcm.plcm-bandwidth", "title" : "Bandwidth" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/64d5b15a-84aa-419c-b861-ce632311fb55/qos", "rel" : "urn:com:polycom:api:rest:link-relations:qos", "type" : "application/vnd.plcm.plcm-qos", "title" : "QoS" } ], "destinationDetails" : { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/devices/c6acb1b6-4e7b-45da-ae74-4dd7f26de805", "rel" : "urn:com:polycom:api:rest:link-relations:device-details", "type" : "application/vnd.plcm.plcm-device", "title" : "device-details" } ], "deviceIdentifier" : "c6acb1b6-4e7b-45da-ae74-4dd7f26de805", "ipAddress" : "199.81.66.22", "deviceName" : "abc70-tam", "deviceModel" : "PolycomRealPresenceGroup310", "deviceVersion" : "6.1.0", "aliases" : [ "sip:abc70-tam@ute.jjjj.com" ], "registrationStatus" : "ACTIVE", "site" : "ABC", "territory" : "Default DMA Territory (dma-l4)", "authenticationStatus" : "NOT_APPLICABLE" }, "originatorDetails" : { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/devices/642b14bb-c624-4e72-aa0e-7dba421b22ba", "rel" : "urn:com:polycom:api:rest:link-relations:device-details", "type" : "application/vnd.plcm.plcm-device", "title" : "device-details" } ], "deviceIdentifier" : "642b14bb-c624-4e72-aa0e-7dba421b22ba", "ipAddress" : "199.81.66.17", "deviceName" : "abc70-oled", "deviceModel" : "PolycomRealPresenceGroup310", "deviceVersion" : "6.1.0", "aliases" : [ "sip:abc70-oled@ute.jjjj.com" ], "registrationStatus" : "ACTIVE", "site" : "ABC", "territory" : "Default DMA Territory (dma-l4)", "authenticationStatus" : "NOT_APPLICABLE" }, "callIdentifier" : "64d5b15a-84aa-419c-b861-ce632311fb55", "originator" : "sip:abc70-oled@ute.jjjj.com", "dialString" : "sip:abc70-tam@ute.jjjj.com", "destination" : "abc70-tam", "nodeId" : "fc4d797f-e368-485e-94b6-58fb8c13f683", "callStatus" : "Ended", "callDuration" : "0:0:22", "callSignaling" : "SIP", "cluster" : "vrh12345.ute.jjjj.com", "entityTag" : "115072029b78ce0d56d958e1d8abb9e6", "startTime" : "2017-10-27T14:06:25.459-0500", "endTime" : "2017-10-27T14:06:47.467-0500" }, { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/b08725c4-ad38-4d48-9d32-faf5bf8134d8", "rel" : "self", "type" : "application/vnd.plcm.plcm-call", "title" : "Self Relationship" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/b08725c4-ad38-4d48-9d32-faf5bf8134d8/call-events", "rel" : "urn:com:polycom:api:rest:link-relations:events", "type" : "application/vnd.plcm.plcm-audit-event-list", "title" : "Call Events" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/b08725c4-ad38-4d48-9d32-faf5bf8134d8/subscription-events", "rel" : "urn:com:polycom:api:rest:link-relations:subscription-events", "type" : "application/vnd.plcm.plcm-subscription-event-list", "title" : "Subscription Events" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/b08725c4-ad38-4d48-9d32-faf5bf8134d8/property-changes", "rel" : "urn:com:polycom:api:rest:link-relations:property-changes", "type" : "application/vnd.plcm.plcm-audit-property-change-list", "title" : "Property Changes" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/b08725c4-ad38-4d48-9d32-faf5bf8134d8/signaling-diagram", "rel" : "urn:com:polycom:api:rest:link-relations:signaling-diagram", "type" : "image/png", "title" : "Signaling Diagram" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/b08725c4-ad38-4d48-9d32-faf5bf8134d8/bandwidth", "rel" : "urn:com:polycom:api:rest:link-relations:bandwidth", "type" : "application/vnd.plcm.plcm-bandwidth", "title" : "Bandwidth" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/b08725c4-ad38-4d48-9d32-faf5bf8134d8/qos", "rel" : "urn:com:polycom:api:rest:link-relations:qos", "type" : "application/vnd.plcm.plcm-qos", "title" : "QoS" } ], "destinationDetails" : { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/devices/c6acb1b6-4e7b-45da-ae74-4dd7f26de805", "rel" : "urn:com:polycom:api:rest:link-relations:device-details", "type" : "application/vnd.plcm.plcm-device", "title" : "device-details" } ], "deviceIdentifier" : "c6acb1b6-4e7b-45da-ae74-4dd7f26de805", "ipAddress" : "199.81.66.22", "deviceName" : "abc70-tam", "deviceModel" : "PolycomRealPresenceGroup310", "deviceVersion" : "6.1.0", "aliases" : [ "sip:abc70-tam@ute.jjjj.com" ], "registrationStatus" : "ACTIVE", "site" : "ABC", "territory" : "Default DMA Territory (dma-l4)", "authenticationStatus" : "NOT_APPLICABLE" }, "originatorDetails" : { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/devices/642b14bb-c624-4e72-aa0e-7dba421b22ba", "rel" : "urn:com:polycom:api:rest:link-relations:device-details", "type" : "application/vnd.plcm.plcm-device", "title" : "device-details" } ], "deviceIdentifier" : "642b14bb-c624-4e72-aa0e-7dba421b22ba", "ipAddress" : "199.81.66.17", "deviceName" : "abc70-oled", "deviceModel" : "PolycomRealPresenceGroup310", "deviceVersion" : "6.1.0", "aliases" : [ "sip:abc70-oled@ute.jjjj.com" ], "registrationStatus" : "ACTIVE", "site" : "ABC", "territory" : "Default DMA Territory (dma-l4)", "authenticationStatus" : "NOT_APPLICABLE" }, "callIdentifier" : "b08725c4-ad38-4d48-9d32-faf5bf8134d8", "originator" : "sip:abc70-oled@ute.jjjj.com", "dialString" : "sip:abc70-tam@ute.jjjj.com", "destination" : "abc70-tam", "nodeId" : "fc4d797f-e368-485e-94b6-58fb8c13f683", "callStatus" : "Ended", "callDuration" : "0:0:30", "callSignaling" : "SIP", "cluster" : "vrh12345.ute.jjjj.com", "entityTag" : "8bda37701498b0b2f6a5a5aaec15cb74", "startTime" : "2017-10-27T14:05:45.421-0500", "endTime" : "2017-10-27T14:06:16.282-0500" }, { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/71bc1d27-d101-469d-9519-a7639410c0a7", "rel" : "self", "type" : "application/vnd.plcm.plcm-call", "title" : "Self Relationship" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/71bc1d27-d101-469d-9519-a7639410c0a7/call-events", "rel" : "urn:com:polycom:api:rest:link-relations:events", "type" : "application/vnd.plcm.plcm-audit-event-list", "title" : "Call Events" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/71bc1d27-d101-469d-9519-a7639410c0a7/subscription-events", "rel" : "urn:com:polycom:api:rest:link-relations:subscription-events", "type" : "application/vnd.plcm.plcm-subscription-event-list", "title" : "Subscription Events" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/71bc1d27-d101-469d-9519-a7639410c0a7/property-changes", "rel" : "urn:com:polycom:api:rest:link-relations:property-changes", "type" : "application/vnd.plcm.plcm-audit-property-change-list", "title" : "Property Changes" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/71bc1d27-d101-469d-9519-a7639410c0a7/signaling-diagram", "rel" : "urn:com:polycom:api:rest:link-relations:signaling-diagram", "type" : "image/png", "title" : "Signaling Diagram" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/71bc1d27-d101-469d-9519-a7639410c0a7/bandwidth", "rel" : "urn:com:polycom:api:rest:link-relations:bandwidth", "type" : "application/vnd.plcm.plcm-bandwidth", "title" : "Bandwidth" }, { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/reports/calls/71bc1d27-d101-469d-9519-a7639410c0a7/qos", "rel" : "urn:com:polycom:api:rest:link-relations:qos", "type" : "application/vnd.plcm.plcm-qos", "title" : "QoS" } ], "destinationDetails" : { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/devices/642b14bb-c624-4e72-aa0e-7dba421b22ba", "rel" : "urn:com:polycom:api:rest:link-relations:device-details", "type" : "application/vnd.plcm.plcm-device", "title" : "device-details" } ], "deviceIdentifier" : "642b14bb-c624-4e72-aa0e-7dba421b22ba", "ipAddress" : "199.81.66.17", "deviceName" : "abc70-oled", "deviceModel" : "PolycomRealPresenceGroup310", "deviceVersion" : "6.1.0", "aliases" : [ "sip:abc70-oled@ute.jjjj.com" ], "registrationStatus" : "ACTIVE", "site" : "ABC", "territory" : "Default DMA Territory (dma-l4)", "authenticationStatus" : "NOT_APPLICABLE" }, "originatorDetails" : { "atomLinkList" : [ { "href" : "https://vrh12345.ute.jjjj.com:8443/api/rest/devices/c6acb1b6-4e7b-45da-ae74-4dd7f26de805", "rel" : "urn:com:polycom:api:rest:link-relations:device-details", "type" : "application/vnd.plcm.plcm-device", "title" : "device-details" } ], "deviceIdentifier" : "c6acb1b6-4e7b-45da-ae74-4dd7f26de805", "ipAddress" : "199.81.66.22", "deviceName" : "abc70-tam", "deviceModel" : "PolycomRealPresenceGroup310", "deviceVersion" : "6.1.0", "aliases" : [ "sip:abc70-tam@ute.jjjj.com" ], "registrationStatus" : "ACTIVE", "site" : "ABC", "territory" : "Default DMA Territory (dma-l4)", "authenticationStatus" : "NOT_APPLICABLE" }, "callIdentifier" : "71bc1d27-d101-469d-9519-a7639410c0a7", "originator" : "sip:abc70-tam@ute.jjjj.com", "dialString" : "sip:abc70-oled@ute.jjjj.com", "destination" : "abc70-oled", "nodeId" : "fc4d797f-e368-485e-94b6-58fb8c13f683", "callStatus" : "Ended", "callDuration" : "0:2:157", "callSignaling" : "SIP", "cluster" : "vrh12345.ute.jjjj.com", "entityTag" : "758e7384f69a1b27afc26323ee014d9a", "startTime" : "2017-10-27T13:55:00.837-0500", "endTime" : "2017-10-27T13:57:38.545-0500" } ] } ... View more