The link you provided contains some powershell examples to extract the information. Do they not work? ... View more

The default location for indexes is $SPLUNK_HOME/var/lib/splunk, but when you create an index you have options to store the Home Path, Cold Path and Thawed Path elsewhere. Querying the index rest endpoint will give you a lot of information regarding your indexes, including their paths. Try the search command | rest /services/data/indexes and you should see what you need to backup. Dave ... View more

I don't know if the recent versions of the ODBC drivers used in DB Connect support Common Table Expressions, a form of pseudo views, but here are a couple of articles explaining how to use them Oracle Common Table Expression SQL Server Common Table Expression I seem to recall I had difficulties using them in earlier versions of DB Connect Dave ... View more

I think this answer may help you to do that? Dave ... View more

I understand your requirement is more involved, but given the basic datasets from above the following search produces similar results to that shown: index=MYINDEX source=MYSOURCE | stats values(error) as error values(name) as name by id | eval error=if(isnull(error),"NULL",error) | mvexpand error | table id name error Dave ... View more

Hi It appears that the comment macro was shipped in Splunk 6.5. The documentation for 6.4 shows how to create the macro. However, I don't think this will solve your issue if the noop didn't work. It was a long shot and I thought the removal of the spaces may have been related to whether the fields command was the last portion of the search, and maybe adding 'extras' may have fooled the system into not removing the spaces. Dave ... View more

What happens if you add a comment at the end of the search, or use a noop command, so your search becomes index=index Category="$Category_1$" | eval eval_1=substr(field_1,1,7) | top limit=$TopNo_1$ eval_1 | fields - percent `comment("comment text")` or index=index Category="$Category_1$" | eval eval_1=substr(field_1,1,7) | top limit=$TopNo_1$ eval_1 | fields - percent | noop ... View more

Hi Given what you have so far I think you need to include epochtime in your chart command, so it becomes eval epochtime=strptime(DATUM,"%d.%m.%Y") | eval datefield=strftime(epochtime,"%d.%m.%Y") | chart list(VOL_DDC_OUT) by epochtime, datefield,host useother=f | tail 15 | sort epochtime | fields - epochtime I'm not sure why you're initially evaluating datefield as that is just the same value as DATUM isn't it? Dave ... View more

There is some developer documentation that covers setting up navigation for an app Dave ... View more

I think this answer may point you in the right direction Dave ... View more

If your panels need to be of different widths you can try this answer Dave ... View more

The troubleshooting section of the DB Connect documentation, contains an entry "Database inputs are getting disabled" Dave ... View more

Hi Does your data really look like that, with the fields always fixed length as you have shown, or can the fields be variable length? Dave ... View more

Hi You probably need to make use of the Advanced Timestamp settings. You can try it out from the Add Data screen, select 'upload', select the file you want to index, and select Next. In the Set Sourcetype panel, expand the Timestamp field on the left and select Advanced. Here you can set some attributes to tell Splunk where the timestamp field is located in your event. For your event you need to tell Splunk the Timestamp format and the Timestamp prefix (these are explained in the Splunk Enterprise documentation here) For 'Timestamp format' try the strptime() format string %y%m%d%H%M%S For 'Timestamp prefix' try the regex to skip the first 4 characters \w{4} You could also enter 16 in the 'Lookahead' field, so Splunk will only consider characters in positions 5-16 as the timestamp. Dave ... View more

What troubleshooting have you performed? Do any meaningful diagnostics appear in the logs mentioned in the troubleshooting guide? If not, I'd also change the logging level as described in the documentation and re-examine the logs. Dave ... View more

Hi I haven't tested this, but could you use something like index=testindex (host=server1 OR host=server2) sourcetype=WinEventLog:Application | eval not_available=if(EventCode=700 OR EventCode=702,1,0) | eval available=if(EventCode!=700 OR EventCode!=702,1,0) | timechart span=1d sum(available) as available sum(not_available) as not_available You can also use eval functions within stats/chart/timechart commands, as shown in the Search Manual. index=testindex (host=server1 OR host=server2) sourcetype=WinEventLog:Application | timechart span=1d sum(eval(if(EventCode!=700 OR EventCode!=702,1,0))) as available sum(eval(if(EventCode=700 OR EventCode=702,1,0))) as not_available Dave ... View more

Why are you using subsearches? Does the following come close to what you're trying to achieve? index=lync_scs source="WinEventLog:Lync Server" (EventCode=4410 OR EventCode=41113) | timechart span=1d count by EventCode Dave ... View more

If I were in your situation I'd increase the logging for the DB Connect app, as described in the troubleshooting section of the documentation. If you don't see any clues in the logs I'd open a case with Splunk support. There's a link in the app on Splunkbase to 'File a case' Dave ... View more

The timechart command has a limit option, I thought the default was documented, but don't see it in the docs. This earlier answer states the default is 10. Dave ... View more

The Release notes for the Enterprise version contains details of recommended AV exclusions Dave ... View more

Could you set a calculated field in props.conf for the field(s) in question, maybe something like EVAL-field1 = if(field1="NULL",null(),field1) Then in the search you could use ... | where if(isnull(field1),1,0)=1 My instance of Splunk complains about datatype mismatch when I try ... | where field1=null(), but that may just be down to my sample data. Dave ... View more

Stephen I don't think your appendcols subsearch is matching the requirement you listed, I don't think it handles the Mon-Fri requirement in item 3. You may have intentionally omitted it to illustrate your thinking. If you do need a Mon-Fri average, you may also need to use something to identify the week number of the events and in association with the associated day number of an event and ignore those events from the average weekly calculation. This answer may help calculate the week number. You may also need to use streamstats and not appendcols and a subsearch to calculate the weekly average for the the table. I'm sorry I'm not able to try either of my ideas at the moment, but I thought I'd post an alternative method as food for thought. Dave ... View more