I have a bar chart and the user clicks on a bar and it then displays a table corresponding to the bar that was clicked. I would now like the user to be able to click on one of the table rows to then allow the user to see the raw transaction that comprised that table row. What I currently have is the following: <dashboard> <row> <panel> <chart> <title>Unhandled Exceptions</title> <searchString>source="*PerfMetrics*" earliest=@month | transaction host startswith="START]" endswith=eval(match(_raw,"END]") OR match(_raw,"unhandled")) | where NOT match(_raw, "END]") | chart count by host</searchString> <earliestTime>0</earliestTime> <latestTime/> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> . . . <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <drilldown> <set token="type_tok">$click.value$</set> </drilldown> ``</chart> It is not displaying the line "table depends="$type_tok$"" that should be here. <!--table depends="$type_tok$"--> <title>Table for "$type_tok$"</title> <searchString>source="*PerfMetrics*" earliest=@month host="$type_tok$" | transaction host startswith="START]" endswith=eval(match(_raw,"END]") OR match(_raw,"unhandled")) | where NOT match(_raw, "END]") | table _time, User, host, Action, PlanName, Dept, AffProcessSize </searchString> <option name="drilldown">row</option> </table> </panel> </row> </dashboard> I don't see how to set up the plumbing for an additional table and search to just display the raw data corresponding to that clicked upon row. (I also don't see how to format the code so that it is readable here.) ... View more

We get unformatted stack traces dumped into the same source type as our event logs. I'd like to strip off the time/date and the host fields from events identified as a stack trace, probably truncate off the seconds from the time, and then use the time and host to re-search the logs looking for matching events to help diagnosing application issues. Could anyone suggest an approach for this? Can one do some kind of join, or a subsearch? ... View more

When using times.conf, after having copied it to my own .../apps/appname/local directory and having put "Disabled = True" in all the clauses I didn't want shown, I still get these other sections such as "Relative," "Real Time," "Date Range," etc. The menu entries I have not disabled appear under the heading Presets. Also under Presets, in addition to the entries I did not disable, there is one entry that is grayed out called "Relative" Any idea how to get rid of these other sections and the grayed-out "Relative" entry under Presets? The xml for the dropdown portion is just as follows. (which may not display) Assortment Analytics . . . ... View more

I Have transactions within transactions, namely something like the following: PlanId, [OPEN PLAN START] Action="AAA" . PlanId, [OPEN PLAN End] Action="AAA" PlanId, [BBB START] Action="BBB" . . PlanId, [BBB End]Action="BBB" PlanId, [MMM START] Action="MMM" . . PlanId, [MMM End]Action="MMM" this would be followed by another transaction with a new PlanId, etc. I can do the following: source="blahblah" | transaction PlanId startswith="[OPEN PLAN START]" | table PlanId, Action, duration which gives me a table of the PlanIds, Actions, and durations of the outer transaction. The question is, how can I get the durations of the individual actions within each PlanID, namely the duration of AAA, BBB, MMM, etc. Also, it would be of interest to get the average durations of all AAA, BBB, MMM etc across all PlanIds. ... View more

We have had a number of forwarders down for a considerable period and now that they are forwarding their data we are exceeding our daily limit. Today will be the third day over limit on an enterprise license. Any way to keep the indexer from indexing while still allowing searches? Then if I see the limit is being neared, I could stop the indexer from indexing for the day. Not sure how many days this will continue, but probably a few thereby putting us in violation of our license. I guess the drastic step would just be to stop splunk if the limit was being neared and continue doing that until the backlog has been cleared. ... View more

I have data records in the following format: Method=OuterTransactionName Type=Start ID=12345 Method=InnerTransactionNameAAAA Type=Start ID=12345 Method=InnerTransactionNameAAAA Type=End ID=12345 Method=InnerTransactionNameBBBB Type=Start ID=12345 Method=InnerTransactionNameBBBB Type=End ID=12345 . . . Method=InnerTransactionNameZZZZ Type=Start ID=12345 Method=InnerTransactionNameZZZZ Type=End ID=12345 Method=OuterTransactionName Type=End ID=12345 So, every transaction record has the same id, with the outer transaction having a method name different from the inner transaction method names. Not sure how to structure the search to both list and/or find the durations of both the outer transaction as well as the inner transactions ... View more