Hi, I want an alert to be triggered every 30 minutes from 7 p.m. to 11:30 p.m. only. I tried this but it doesn't seems to be working as expected. Is this possible to do? I had a look at the cron expression and came up with something like this, but it's not working: */30 30,19,23 * * * Please help! ... View more

Hi, I have three fields, lets call them: x = 6 y = 6 z = 0 What I want to be able to do is compare each of the fields with each other, and basically return the field that doesn't match, essentially, z is the only field that doesn't match so I would need that to be returned. I don't want to specify the field names because I want to be able to reuse this query. Is this possible? Here's what I've done so far: index=xxx sourcetype=xxx | fieldsummary | fields field,count | regex field="^([A-Z_]+)$" | where... Thanks ... View more

Hi I have two different sources, Im trying to display the fields present in both those sources to verify what fields they contains. This is what I have so far: index=drv (sourcetype=xxx OR sourcetype=yyy) NOT host="oo" | fieldsummary | eval test="xxx" | eval reference="yyy" | table field test field reference I know it's wrong, but that's where I am at the moment. I need to have multiple "fields". I also would like to know how I can count the number of fields present in both source types Thanks! ... View more

Hi, I need to be able to validate the format of a file. This entails checking if a date column is actually a date column and if the format of the date value is in the correct format. I'm not concerned with the content of the data, i.e. im not validating the content, rather I'm more focused on the structure of the data. Does splunk allow this? And if so how would I go about achieving this? Thanks ... View more

Hi Guys, I have a simple question. I have a search query, and it basically outputs lots of fields. Is there a way of filter for a specific column in the search query? index=xxx sourcetype=xxx host=xxx OR host=xxx| eval UNIQUE=toString(xx)| eventstats dc(host) as ID by UNIQUE | where ID=2 | eval raw=toString(YYYY)| stats values(host) AS hosts BY raw | where mvcount(hosts) = 1 | replace xxx with xxx, xxx with xxxin hosts Kind Regards Mahbs ... View more

Hi, I've had a look through on Splunk on this matter and couldn't find anything definitive. Im trying to export my results in a csv format. At the moment, I'm only able to export in PDF format. Ideally, I'd like to achieve this without having to go through the back end, but If I need to I will. Does anyone have any suggestions? Thanks ... View more

Hi, I'm trying to implement a time picker. I've created a token for it. I was just wondering, how would I go about using the preset options to update my graph. I thought I could pass my token to a my query in the "earliest" and "latest" field and then somehow in the background it would find data for instance in the last 30 seconds. This is my search query, please note, I have been able to get this filter to work for dropdowns wherein, you have a list of dates, a start date and end date is selected, and the graph is updated accordingly. I need to do the same thing using the time picker. Search Query source="xxx" host="xxx" index="xxx" sourcetype="xxx" earliest=-0d@d latest=now | multikv | eval ReportKey="Today"| append [search index="test" sourcetype="csv" earliest=$source_tok$ latest=$End_Date$|multikv| eval ReportKey="CPU"]|timechart span=1m avg("CPU") by ReportKey This is all I have at the moment for the timer panel: <input type="time" token="tp_tock" searchWhenChanged="true"> <label>Time Picker</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> ... View more

Hi Splunkers! I was just wondering, is there a detailed time picker tutorial I could follow? Im new to splunk and was hoping to find something like this: https://www.splunk.com/blog/2012/02/19/compare-two-time-ranges-in-one-report.html Thanks! ... View more

Hi, I'm having a bit of trouble with this query of mine. source="xxx" host="xxx" index="xxx" sourcetype="xxx" earliest=-1d@d latest=-0d@d | eval ReportKey="Yesterday"|timechart span= 1m avg("CPU") by ReportKey This is the error I'm getting: "Error in 'timechart' command: The specifier '1m' is invalid. It must be in form (). For example: max(size)." ... View more

Hi, So I've created a drop down for start date and end date which is receiving dates from the "_time" variable from a query I'm running. Now, the _time variable holds date in the following format for instance: 30/10/2017 00:30:00. I want to be able to manipulate my graph so that whatever date is selected, the graph is updated to represent the data from a specified time period. The issue is, the drop down panel represents the dates as 30/10/2017, the time element is missing. When passing a token containing the date to the earliest field, i get an error message saying the value passed isnt acceptable: //Code for drop down and populating it with dates. <input type="dropdown" token="source_tok" searchWhenChanged="true"> <label>Select Start Date</label> <choice value=""></choice> <default>Start Date</default> <populatingSearch fieldForLabel="Date" fieldForValue="Date">index="test" | stats count by Date</populatingSearch> </input> //This is the search query, wherein the output (date) is being passed into the dropdown panel: source=xxx host=xxx " index="test" sourcetype="csv" earliest=-1d@d latest=-0d@d | eval ReportKey="Yesterday" | append [search index="test" sourcetype="csv" earliest=$source_tok$ latest=$End_Date$ | eval ReportKey="Last Week"]|timechart span= avg("CPU") by ReportKey Im passing my token to the "earliest" field so that data shown in that time period is shown, for What could be the solution? I tried to create my own timestamp variable which would include the time, but its not showing up on the dropdown section. Here's what I done: eval newTime = strftime(Date, "%m-%d-%Y:%H:%M:%S") But I'm not sure how to use the newTime variable ... View more