can u show the savedsearch query.? how are you running it ... View more

@harish_l , Dyude try this, | inputlookup target_lookup | search [| gentimes start=-1 | eval targetType="$targetType$" | makemv targetType delim="," | mvexpand targetType | table targetType] | table targetType run the savedsearch by passing multiple values | savedsearch reportname targetType="value1,value2" ... View more

dyude , This might help you.. https://docs.splunk.com/Documentation/AddonBuilder/2.2.0/UserGuide/ConfigureDataCollection ... View more

| makeresults | eval date="D:\Program Files\X620\ABC\TGF\Files\sss\Nsences_2016_10_10_12_50.csv Complete, status : 226 Transfer complete." | rex field=date "\\\Files.*\\\(?P<filename>.+)\s\w+," ... View more

Hi @kazuya_takizawa , あなたはこれを試すことができます グローバル設定が有効になっているかどうかを確認してください。 デフォルトでは無効になっています。有効にする必要があります。あなたはUIを介してそれを行うことができます。データ入力> Httpeventcollector>グローバル設定 ... View more

Hi @kazuya_takizawa , あなたはこれを試すことができます, HTTPEventcollectorが有効になっているか確認してください。 データ入力<Http Event Collectorで確認できます。 トークンが存在するかどうかも確認してください。存在しない場合は、新しいトークンを作成してください。 ... View more

Hi dyude @jspmehra , You can refer this link , https://docs.splunk.com/Documentation/Splunk/7.2.5/Data/Getdatafromscriptedinputs Hope this helps! ... View more

Glad! it worked for you! (Y) ... View more

@balcv, Have you applied it on your sourcetype(your sourcetype name)? ... View more

You can try this, |makeresults |eval data="Id-214f1652024d824e1f4cef63be666139\x00" | rex field=data "Id\-(?P<field_name>.*)\\\\" ... View more

try running this search .. ive kept some different values | makeresults | eval Field1="20.7,100,56,45,400" | makemv delim="," Field1 | mvexpand Field1 | appendcols [| makeresults | eval Field2="93,15,23.6,10.5,11" | makemv delim="," Field2 | mvexpand Field2] |appendcols [| makeresults | eval Field3="45.1,42.4,67.6,45,90" | makemv delim="," Field3 | mvexpand Field3] |appendcols [| makeresults | eval LogTime="10/03/2019 08:25:09,12/03/2019 08:25:09,13/03/2019 08:25:09,14/03/2019 08:25:09,15/03/2019 08:25:09" | makemv delim="," LogTime | mvexpand LogTime] |chart list(Field1) as Field1 list(Field2) as Field2 list(Field3) as Field3 by LogTime ... View more

@beetaj, Can u post a screenshot ? Mostly it shouldn't effect. ... View more

hi dyude @beetaj , Iam able to see the chart wrt your values.! sorry for the typo mistake in the above query.. Your index | chart list(Field1) as Field1..... * ... View more

@balcv, You just have to put Your Sourcetype Name for which you are filtering the logs . So basically you can do this for a host OR source OR sourcetype. You can follow this props.conf doc, this will give you an idea. https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Propsconf ... View more

@moizmmz , Try this , index=video-eng-live | rename message.timestamp as time | eval time=strftime(time/1000, "%m-%d-%Y %H:%M:%S") | dedup message.concurrent_sessions, time | eventstats sum(message.concurrent_sessions) as "New Concurrent Sessions" by message.account | and check the fields .. der should be a "New Concurrent Sessions" field Let me know if it works! ... View more

Hi @ips_mandar, What type of data you are forwarding? May be , you can try Splunk Stream app... https://splunkbase.splunk.com/app/1809/ ... View more

Hi @skjennings , Did it work? ... View more

Hi dyude @twh1 , Check the field name of EventTime and copy as it is. Can you try this, index=main sourcettype="SQL" host=ABC | eval Total_CPU_Utilization=("SQL CPU Utilization"+"Other Process CPU Utilization") |chart latest("SQL CPU Utilization") as "SQL CPU Utilization", latest("Other Process CPU Utilization") as "Other Process CPU Utilization", latest(Total_CPU_Utilization) as "Total CPU Utilization" by EventTime ... View more

Hi @tan_junyuan , You need to do it at the indexer level, i mean in the indexer.You should not make any changes in forwarder (not a good practice). This doc might help you! https://docs.splunk.com/Documentation/Splunk/7.2.4/Knowledge/Exampleconfigurationswithprops.conf ... View more

Hey dyude @jip31 , If you are running this search | loadjob savedsearch="admin:XX:FO_BatteryHealth_Status" .. please check the app OR report name, might be a spelling issue if its coming in a normal search, then it should come with loadjob also ..may be you are missing out something OR Ders another way you can run a savedsearch with loadjob command, ie with the search_id Just open the report name in search and then inspect job ... in the job inspector URL you will find sid=blahblah |loadjob blahblah You can refer this doc https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Loadjob Let me know if this works! ... View more

@skjennings , no not lookup .. the addon But before that what you can do is, you can refer this link and get the required files. They have fixed the csvs. https://github.com/inspired/cisco_ios let me know if it woks. ... View more

Hi @toddhawkins , Can you check this link ... hope this might help you! https://answers.splunk.com/answers/440464/do-users-need-some-capability-to-use-search-comman.html ... View more