Thanks for this. Simply adding the multiselect doesnt help as the query needs to update accordingly for multiple values. <prefix>(</prefix> <valuePrefix>ScriptName ="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <suffix>)</suffix> does the trick. ... View more

Great, thanks! ... View more

cool. can you accept or vote for the answer. ... View more

This is tricky. When you use eval , it uses where -style logic ("WSL") which is slightly different than search -style logic ("SSL"). WSL presumes that the right-hand-side ("RHS") s a field name, where as SSL presumes it is a string. Furthermore, you cannot make SSL interpret the RHS as a field name HOWEVER you can make WSL interpret either. The way to make WSL interpret the RHS as a string is to put it inside double-quotes, like count(eval(date_month="august")) . This is why we always teach people to use search when RHS is a constant and use where when RHS is a field name (even though you can make where do either) and also to ALWAYS use double-quotes when RHS is a constant, not a field name, even when (e.g. with search ) it is not necessary. ... View more

i would use loadjob. http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Loadjob Loadjob will use the results from a previously ran report, just make sure your time range encompasses the entire time frame of the report. In other words, if the report was ran this morning, but covered data for the previous month, make sure that you run loadjob for the previous month to now, at least that's my experience. You also need to make sure you're saving the results long enough. If you need to access the results only every 24 hours, then you only need to save them for 24 hours. |loadjob savedsearch="username:appname:savedsearchname" |search field1=x..... or use |where field1=field2 or just |fields field1 field2 depending on what you're trying to accomplish, exactly. ... View more

@sbbadri - Order of the first two is reversed. You need to test 3600 before you test 86400. ... View more

If I understand you correctly, you would like to use the values of the previously generated-by-rex-at-search-time field ClientID inside of a later rex call as part of the RegEx string/pattern, right? ... View more

Use timechart (which creates empty slots by default), like this: index=* | timechart span=1d count(eval(searchmatch("(match1)"))) AS match1 count(eval(searchmatch("(match2)"))) AS match2 | rename _time AS Time | fieldformat Time=strftime(Time, "%m/%d/%y") ... View more

Works perfect, thank you! Though, someone recommended me to use makeresults instead of gentimes. Is there any practical difference? ... View more

Not as far as I know! ... View more

This solution does not hide the panel but it hides the "no results found" message. ... View more

You should be aware that all of these answers are throwing away events where field cs_user has no value at all (e.g. isnull(cw_user) ) which you might care about, or might not. ... View more

After I used your configuration the problem still persisted. After removing the date from extracted fields for the search it worked. ... View more

<form> <label>testDDCB</label> <fieldset submitButton="true" autoRun="true"> <input type="time" token="time_tok"> <label>Time Range:</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="radio" token="exclude" searchWhenChanged="true"> <label>Exclude/Include</label> <choice value="1">With Reassigned</choice> <choice value="2">without Reassigned</choice> <change> <eval token="fq">if($value$=="1","|search category=*","|search NOT catergory=reassigned")</eval> </change> </input> <input type="dropdown" token="cat_tok" searchWhenChanged="true"> <label>Category</label> <fieldForLabel>category</fieldForLabel> <fieldForValue>category</fieldForValue> <search> <query>index=* sourcetype=xxx $fq$ | dedup category | table category</query> <earliest>-4h@m</earliest> <latest>now</latest> </search> </input> </fieldset> </form> ... View more

Comment is now posted (inputs.conf) ... View more

Assumptions: 1) There are connection events with pc_id and pc_connection. 2) There are error events with pc_id and pc_error. 3) You want all events where the pc_error value is "bluescreen" linked to the last known pc_connection for that pc_id. Then you want the results to be counted up, by pc_connection. Try this... index=main pc_id=* (pc_connection=* OR pc_error="bluescreen") | rename COMMENT as "That should be all the events. Limit them to the fields we need, plus _time" | fields pc_id pc_error pc_connection | rename COMMENT as "Kill any mutant events that got through eith a pc_connection and a different pc_error" | where pc_error="bluescreen" OR isnull(pc_error) | rename COMMENT as "Sort and then copy pc_connection values forward across time, then kill pc_connection records" | sort 0 pc_id _time | streamstats last(pc_connection) as pc_connection by pc_id | where isnotnull(pc_error) | rename COMMENT as "Now we have only error records. Stats them up." | stats count as BlueScreened values(pc_id) as pc_id by pc_connection added pc_id to the results. ... View more

Regex processing: 1) If regex is correct , you should see extracted field in interesting fields for that sourcetype by using spl query. 2) from GUI, settings->fields-> field extractions-> search for sourcetype or field name. it should fetch some results CPU and Memory: 1) Install Splunk_TA_nix splunk Addon. So it will report cpu, memory and other os related stats. 2) Settings->Montoring Console-> Resource Usage-> Resource usage:Instances-> select the instance - for this you need setup montoring console ... View more

Your last table command is removing the field with today's date. Replace your last table command with this | table * 91_180_days 91_180_days_c 180_plus_days 180_plus_days_c OR | table 2* 91_180_days 91_180_days_c 180_plus_days 180_plus_days_c ... View more

&lt; = < &gt; = > ... View more

try this, index=_internal sourcetype=scheduler "report 1" OR "report 2" | stats count by savedsearch_name status result_count alert_actions | append [| inputlookup critical_reports.csv] Please go through link for further details, http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Append https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Appendcols ... View more

there is nothing in document in the link you provided, where we can monitor log files using SPLUNK SDK C#, could you please help me on this . appreciate your help . ... View more

thanks to you both. but the result is still in one row and not in one column. so, if I try to use your tip, I'll get the following outcome: _time | max(NumberResourceMailBoxes) | max(NumberSharedMailBoxes) | max(Number AnitvirusPositive) 2017-07 | 123 | 3456 | 8797 2017-08 | 111 | 222 | 3333 but I want to have it like this: _time | Description | Value 2017-07 | max(NumberResourcemailBoxes) | 123 2017-07 | max(NumberSharedMailBoxes) | 3456 2017-07 | max(NumberAntivirusPositive) | 8797 ...... ... View more

Tam, You can use RegEx to edit the data before you index your file into Splunk. As data passes through our pipeline, we have the option to use RegEx to identify/classify the data as we write it into our Flat File Time-series Index. The answer to your question posted by sbbadri will work for you; you can these RegEx expressions that he listed to remove the double quotes " from your raw events. If you want to verify if an expression will return an expected string, use regex101.com. "Props.conf" file can be found in the /Splunk/etc/system/default directory. It includes settings for the processing properties of your data e.g. line-breaking, character encoding, timestamp recognition, event segmentation, automated host, sourcetype matching overrides, search-time field extraction definitions. More information on props.conf stanzas: https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Propsconf ... View more

This works perfectly! Thank you ... View more