Hi Experts, Is there any way to show legend in pie charts using simple xml/advanced xml in splunk 6.0.1 I understand it shows labels with colors on the pie chart itself, but we require a legend like it is shown in other type of charts. Please suggest any workaround. ... View more

Hi, I am trying to index data from sql server. I am able to fetch the data using dbquery but not able to add data to index, I have used following configurations in inputs.conf. I have tried to add data to default index as well as custom index. But no success. Please provide your inputs Sample data 2 abc rcl [script://$SPLUNK_HOME\etc\apps\dbx\bin\jbridge_server.py] disabled = 0 [batch://$SPLUNK_HOME\var\spool\dbmon\*.dbmonevt] crcSalt = <SOURCE> disabled = 0 move_policy = sinkhole sourcetype = dbmon:spool [dbmon-dump://test_ext_db/sql] index = vaibhav output.format = kv output.timestamp = 0 query = select * from table_splunk sourcetype = db table = table_splunk host = chdsez203099d interval = auto [dbmon-tail://test_ext_db/dbinput] output.format = kv output.timestamp = 0 query = SELECT * FROM table_splunk {{WHERE $rising_column$ > ?}} \r\n\r\n table = table_splunk tail.rising.column = id ... View more

Hi, Is it possible to select multiple rows in table and perform drilldown. Please provide your inputs. ... View more

Hi, I want to pass parameter value from drop down to saved search in simple xml. I am using @go?s to call savedsearch. Is there any way out to pass parameter value. Thanks ... View more

Hi, I am running splunk 4.3 on windows xp. I am having access issue in local folder of all the app i create in splunk. Other folders are accesible but local folder is not accessible through windows explorer.I can access the views and nav through splunk ui. I am not amdin of my system. Admin of my system is able to access all the folders. Is there any work around for this. ... View more

Hi, I am having events with start datetime and end datetime in it.I want to calculate difference between them in the format:- Number of days-number of hours-number of minutes-no of seconds-number of miliseconds The date format is as mentioned below Startdate :- 12/24/2012 02-13-41.224 Enddate :- 12/24/2012 02-14-46.330 I tried various convert options but splunk is not calculating the difference and not able to convert datetime in epoch format.Everytime it displays blank values. Any help will be appreciated and useful. ... View more

Hi, I wanted to know what is the best technique used for creating fields for multiple sourcetypes. For example if i have 4 sourcetype named st1,st2,st3,st4 I want to extract a field which displays errros. So shall I create duplicate fields for each sourcetype or there is some better method available. ... View more

Hi, I am using following two parameters in the "redirector" module to pass the timerange from view to flashtimeline. $search.timeRange.earliest$ $search.timeRange.latest$ But when the time range of view is "All time", the timerangepicker of flashtimeline gets distorted.This is beacuse timerangepicker displays "over custom relative time range" in flashtimeline and it cant take this much text.Any fix for this? can we display "All time" only in timerangepicker of flashtimeline? Thanks ... View more