Version 4.3.4 The chart colors appear just fine in the legend, but not within the chart. Also, notice that "count" field appears as an item in the legend -- why is the chart doing that? I've broken the counts up into ranges using rangemap so I expect that the count should be replaced by range. It looks like the color is being assigned due to the value of "count" be assigned GREEN. Here's the general syntax of my query: " my events" | stats min(_time) as start by thing1 | eval duration=now()-start | rangemap field=duration "0m-20m"=1-1199 "20m-40m"=1200-2399 "40m-60m"=2400-3599 "60m+"=3600-15000 | stats count by range <row> <chart> <searchName>My Saved Search</searchName> <title>Count of events in My Saved Search</title> <option name="charting.chart">column</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.stackMode">default</option> <option name="charting.layout.splitSeries">false</option> <option name="charting.legend.placement">bottom</option> <option name="charting.fieldColors">{"0m-20m":0x00FF00,"20m-40m":0x3399CC,"40m-60m":0xFFFF00,"60m+":0xFF0000}</option> <option name="charting.legend.labels">["0m-20m","20m-40m","40m-60m","60m+"]</option> <option name="charting.seriesColors">[0x00FF00,0x3399CC,0xFFFF00,0xFF0000]</option> <option name="charting.fieldColors">{0m-20m:0x00FF00,20m-40m:0x3399CC,40m-60m:0xFFFF00,60m+:0xFF0000}</option> <option name="charting.legend.masterLegend"></option> <option name="charting.secondaryAxis.maximumNumber">""</option> <option name="charting.secondaryAxis.minimumNumber">""</option> <option name="charting.secondaryAxis.scale">""</option> </chart> </row> ... View more

Join is much more efficient. Is it possible to fillnull on a join so that I can collect the results for events for which there isn't an event to join? sourcetype=1 | join host [ search sourcetype=2 | fields host,result ] | table host,result ... View more

I'm using events from 2 sourcetypes to determine whether a transaction is complete. Quite simply, if there are 2 events, then transaction is complete. A single event means incomplete transaction. There has got to be a better way than running a transaction and searching for eventcount=1. ... View more

I'm try to chart some data using span=1d and was wondering if it possible to dedup data across a timerange with span? For example, I want to dedup duplicate users in a single day, but I also want those users to show up in previous days when I'm charting over a week. I'm guessing * | dedup user | timechart span=7d .. would eliminate users from showing up in day 2-7. I hope that makes sense. ... View more

We need Splunk to be able to poll remote hosts for WMI events. How do we run Splunk as an account that is NOT part of the DA group? This is an issue with our System Administrator not allowing Splunk user to be part of DA. I've seen a lot of posts and questions/answers and some documentation but nothing straight-forward. ... View more

I need a syntax example for host_regex to pull the hostname out of a share like the following: [monitor://\\norcal_server\c$\Windows\System32\LogFiles] ... View more