Can you post that into your question. It' will be much easier to read. (Click the "edit" link under your post.) ... View more

I'm pretty sure that atomic moves are always a good thing. I know splunk does renames when moving files into $SPLUNK_HOME/var/spool/splunk when writing summary indexing .stash files, for example. ... View more

Also note that views with realtime searches should not be schedule for PDF delivery. From the 4.1.2 known issues page: It is possible to create a dashboard which has a real-time search on it and then have it scheduled for delivery. This is not actually supported. (SPL-29782) ... View more

Isn't the slope of your chart backwards? A=1 not A=5 ... View more

Let me throw out a general thought/observation before jumping into your question... It seems like your coming from a very programmatic perspective with this question. And while such a background can be quite useful at certain time when using splunk, you should try to keep in mind that it's geared towards end users, analysis, system admins (and even aiming at being management-friendly) and so therefore it generally doesn't require a programmatic thinking to get results (don't get me wrong, there are lots of goodies for programmers too). I'm just trying to point out that it may be easier to wrap your head around getting the most out of splunk if you try to approach it from a non-programmer's perspective. Enough of that, jumping in to your question... It seems like there's some confusion about how multi-valued fields work. If you have a set of related x-y values, you generally have one event that represents a single set of (x,y) coordinates. Not a single event that contains pairs of x/y values (which is where splunk would you the a multi-valued x and a multi-valued y. So when you ask about the pseudo-example "| chart Array1 by Array2" that would more accurately translate into trying to chart an array-of-arrays by another array-of-arrays. (Now it would be possible to collapse arrays of arrays into a single array first, perhaps that's where you questions is going... but I don't think it's supported out the box, and I suspect there may be another (easier) way) What splunk offers If you have multiple fields then you can unroll them with mvexpand but you can't do that with two fields at the same time. And doing two mvexpand commands back to back will not work right either.) If you want to chart an independent list of x and y coordiantes, then I think you want to use the xyseries command. But I'm not sure how this would work exactly with multi-value fields. ... View more

Thanks Stephen. Guess I'll have to hard-code the login info in the script (or in a password file) for the time being... I'll be looking forward to 4.1.4. BTW, is there a SPL number for this issue? ... View more

Was this a 4.1 change? Or did it happen in 4.0 and I just missed it? ... View more

Thanks for your answer. Yeah, I noticed that newly created tags started showing up in the .meta files, which seems to complicate things a bit. Before we pretty much had all of are tags setup to be global, but now users (or an admin) must remember to go change the permissions manually for others to leverage the tag as well. I suppose I get why this is necessary. (Another thing I've notice is that if you create a new eventtype with tags, and share the event type, you still have to go share all the tags one by one. It's a bit tedious.) ... View more

I added a link to the docs. If you feel like it should be explained better or in more details, feel free to email the people who maintain the docs with your thoughts or ideas. Their email is [email protected] ... View more

Answer to question 2 This type of scenario certainly requires some sort of startswith/endswith logic because your field values seem to repeat too frequently. (There could be a timing related fix, e.g. using maxpause or maxspan , but you'll have to decide if that is possible with your data or not. See link at bottom of this post.) I think I found a working solution by using just "startswith" without using "endswith" (the keepevicted=true doesn't seem to matter in this test case.) I did some playing around with your provided sample data (I copied and pasted into a temp file and used splunk to load it with the file command without indexing it 😉 splunk rocks!) | file /tmp/examplefile.txt | sort -_time | rex "ip=(?<ip>\d+)" | rex "\s(?<router>\w+)\s\[" | transaction router,ip startswith="aaaaaaa" | eval my_closed_txn=if(searchmatch("bbbbbbb"),1,0) The first 3 search commands are needed to attempt to match your environment; you can pretty much ignore them. Side note: BTW, Simply using searchmatch is not 100% accurate here. This is because we are not ensuring that it is the last event, we are only making sure that the text string "bbbbbbb" exists within the combined transaction event's text (the _raw field). So this can be a problem if "bbbbbbb" occurs as the second event of 3, this approach will not catch that. You can work around this by using match instead of searchmatch in combination with a multiline regex that explicitly will match the bbbbbbb on the last line only. Of the top of my head (aka untested), you could probably use an expression like this: | eval my_closed_txn=if(match(_raw, "(?ms)^.*[\r\n][^\r\n]+\bbbbbbbb\b(?:[\r\n]+|$)",1,0) In case your not a regex guru, " \b " means boundary, which is even more confusing when you are already matching "b"s. 😉 So this approach would be more accurate, but often it's not worth the hassle. (I have used this approach when analyzing FTP transactions to see if the last session event was a "successful logout", so this kind of thing is needed from time to time.) Make sure you note this Q&A: Does combining startswith and maxspan in a transaction work? Hope this helps. ... View more

Out of curiosity, how may events are you summarizing? If you are creating adding over 10,000 summary events each 30 minutes, you must be dealing with a pretty high volume of events.. Have you confirmed that you are actually generating more than 10,000 events in your search and that it's not all fluffed up because of using sistats ? ... View more

Well, you still have two options. (1) create a custom drill down that takes into consideration your extra eval logic, or (2) create this an an indexed field as you suggested. (Neither option seems best. If you setup an indexed field than that will obviously take effect only for new events, so you may make things more complicated for a time by needing two different ways to get to this field, but if you don't setup an indexed field you may regret every time you end up trying to use it and are constantly work around it....) ... View more

Out of curiosity, how may events are you summarizing? If you are creating adding over 10,000 summary events each 30 minutes, you must be dealing with a pretty high volume of events... ... View more

Hmm. You could try: ... | collect addtime=true index=my_summary name="name of your saved search" I don't know if that will make a difference or not. To be honest the summary index commands are confusing. There's collect , stash pycollect , pystash , summaryindex , sumindex , .... Some of them are python implentations and other are not. ... View more

Yes. That is correct, and what you are seeing is explained by Ledion's answer. The command entry in the alert_actions.conf file is what is being used to generate the collect command which is what was causing the extra "maxtime" key to showup in the summary index. If you apply Ledion's fix you can make "maxtime" disappear completely in either summary indexing option, which to me seems preferable over updating all your summary indexing saved searches (guess it depends on how many you have.) But you are correct, you do have that option too. ... View more

I tried running my search command from a saved search that was set with dispatch.spawn_process = false , but I still get the auth errors. Any ideas on a workaround? ... View more

Still not sure what your are really asking here, but perhaps the following question/answer would be helpful to you. You both seem to be looking at Citrix/MetaFrame POST events: search that captures sum of users by url ... View more

Sorry. I told you the wrong logfile. Try this search instead: index=_internal source=*web_service.log toPrimitive OR Traceback ... View more

Side note: It doesn't look like your limit (5) is honored when you are using sitop instead of top . ... View more

You can use localop to "prevent subsequent commands from being executed on remote peers." Not sure if that's your issue or not, but I guess this could help you find out. ... View more

Yeah, " " only shows one value. ... View more

Thanks Glenn. It's certainly possible to get a custom search script to add fields (it's pretty easy from a pure programmatic perspective), but your right in saying that rex (or kv ) could be used after translatefix . Thanks again for jumping in. 😉 ... View more

I think the docs have examples. Look in the developer guide for setting up simple XML dashboards. ... View more

Can you get more info about this and add it to your post? Do a search like this and report back the full traceback message: index=_internal source=*python.log toPrimitive ... View more