Oh but you can! It's defined in the default.meta file in an app's metadata directory. See more information here: http://docs.splunk.com/Documentation/Splunk/6.0/AdvancedDev/SetPermissions And here for the spec: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Defaultmetaconf ... View more

It's not as much that it's not able to handle it as that it has no idea that the string you're asking it to sort is a timestamp. When you convert() _time to Date/Time, you will get a string that happens to represent a time in a text format, but any sort command you will throw at it just knows that it's some kind of text that it's supposed to sort. It's better to use fieldformat so you can represent the data the way you want but still be able to sort it. By the way you don't need to sort this because Splunk will already grab the most recent events first. index=eaccess Card_Name="John*" | fieldformat _time=strftime(_time,"%m/%d/%y %I:%M:%S %p") | table _time, Location ... View more

You can use the fact that subsearches are run before the main search, so first of all run search A in a subsearch so that the CSV file exists, then use it in all your other searches. searchB [search searchA | outputcsv ... | return ""] | outputcsv ... | append [search searchC | outputcsv ... ] | append [search searchD | outputcsv ... ] ... View more

Setup a delimiter based field extraction in props.conf / transforms.conf. In props.conf, you put something like: [yoursourcetype] REPORT = getcsvfields And in transforms.conf: [getcsvfields] DELIMS = "," FIELDS = tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG ... View more

Either setup a transaction based on _time : index=counts | eval count_a=case(category=1 AND type='A', count1, category=2 AND type='A', count2) | eval count_b=case(category=1 AND type='B', count3, category=2 AND type='B', count4) | transaction _time | table _time, count_a, count_b Or for better performance, use stats . index=counts | stats count(eval(category=1 AND type='A')) as count1, count(eval(category=2 AND type='A')) as count2 by _time ... View more

You'll want to use a subsearch (see http://docs.splunk.com/Documentation/Splunk/6.0/SearchTutorial/Useasubsearch ). sourcetype=transaction_detail [search sourcetype="transaction_status" status="completed" | fields transaction_id] | stats count by vendor_id ... View more

There are two ways I see you can do this depending on what kind of results you want. If you want to plot each and every data point over time, it's as simple as adding this at the end of the search: | table _time ratio Because a line chart (or area, or similar) works by taking the first column of its input as the X axis value and the rest of the columns to be the value that should be plotted on the Y axis, it doesn't matter if these columns were generated by a chart command or not. One problem you will run into is that if you do this over a result set that includes many data points, your graph will take a long time to load or even drop data past a certain point - iirc the new JSChart module takes more datapoints than the FlashChart module that was previously used by default, but there's still a limit and there will still be performance issues even before you approach that limit. Because of this, timechart automatically divides the input into buckets of time and will output only one value per bucket. By default timechart will create a maximum of 100 buckets, which means that if you search the past 5 hours, each bucket will be 3 minutes long (300 minutes divided by 100 buckets = 3 minutes per bucket). Now, because timechart divides the events into buckets based on time, several events might end up in the same bucket, and timechart somehow needs to find a way of still representing only one value out of that. This is why you can't just simply do timechart ratio - you need to specify a statistical function that tells timechart what to do with its input. You could do timechart first(ratio) as ratio which unsurprisingly grabs the first value in each span and outputs that. You could use last , or avg to take an average, or max , or, or... tl;dr: For the timechart option, do something like sourcetype=production eventtype="completedTransaction" tag=pilot | stats count as transactions| join [search sourcetype=production eventtype="totalErrors" tag=pilot | transaction host maxspan=3m | stats count as errors] | eval ratio=(errors/transactions)*100 | fieldformat ratio=tostring(round(ratio,1))+"%" | timechart first(ratio) as ratio ... View more

No, this cannot be done using Splunk. It's generally best practice to use a separate syslog daemon for receiving syslog and having Splunk read the files it creates. That way you can solve the particular problem you have, and you're also more free to perform maintenance on Splunk without having to worry about losing syslog data. See more (and similar) information here: http://answers.splunk.com/answers/1513/is-there-a-way-to-maintain-the-source-ip-of-the-udp-syslog-packet-when-forwarding-to-a-3rd-party-syslog-listener ... View more