It seems like Splunk 4.2 custom module css' urls are relative to the "appserver/modules/" directory rather than the "appserver/modules/MODULENAME/" directory (as it was on 4.1). So in the previous example, adding the module name to the url solves the problem: .cluster-icon.m-1 { background: url(GoogleMaps/img/m1.png) no-repeat scroll 0 0 transparent; ....... } . ... View more

If scatter is not working, you could try a workaround: set the lines to transparent and show the markers! save a line-chart report out of your search create a new dashboard and put the report into it edit the dashboard xml then under the <chart> element (simplified xml mode) ... Insert the following (charting reference in this guide😞 <option name="charting.chart.showMarkers">true</option> <option name="charting.chart.markerSize">3</option> <option name="charting.chart.lineStyle.alpha">0</option> If this is now working, try to go to advanced xml mode (instructions here). Then under the <module name="HiddenChartFormatter"> <param name="charting.chart">line</param> put (beware the tags names are different!): <param name="charting.chart.showMarkers">true</param> <param name="charting.chart.markerSize">3</param> <param name="charting.chart.lineStyle.alpha">0</param> Save the dashboard, click on the "Splunk" image top-left to reload them, select your dashboard/view from the menu. Here's a sample result ... View more

Have you tried with a rex field extraction? | rex "CN=(?<out>[^,]+)," ... View more

There actually is no easy way, I fear. You'd need to: compute the trendline equation to do that (y = m * _time + b) see http://www.tutorvista.com/content/math/geometry/straightlines/two-point-form.php extend the time field into future compute the new y over time (the easy part...just an eval) But.... which is the best window to compute your trendline upon? 5, 20, 30, 1000 events? That totally depends on the case... Ok, let's move on...here's my approach, in bullet point (I'll use _time as x axis, y as y axis): You need to compute the best trendline you see fit your data and produce a field "y" To compute the equation of a line you need 2 (x,y) couples, which you can produce by moving the previous event's y and _time values to the current event. I'll use autoregress and name the two points as (curr_time,curr_y) (prev_time,prev_y) You do the math and compute slope (m) and y-intercept (b) -> here's your equation! Now, you said you want the future...so you don't have data for it. You'll have to "gentimes", and then put your slope and intercept into each event. You compute the predicted value of y You chart y over time Here's my try. | gentimes start=01/01/11 end=02/28/11 increment=6h | eval jf=1 | join jf [ Get a time span and prepare to join the m and b values to all the results: search <you search and computation of y here> | autoregress y as prev_y | autoregress _time as prev_time | rename y as curr_y | eval curr_time=_time | head 1 Head 1 gets the latest event only, which now has data for the 2 points the prediction line will pass through. Now I'll do the math | eval m=(curr_y - prev_y)/(curr_time - prev_time) | eval b=(prev_y * curr_time - curr_y * prev_time) / (curr_time - prev_time) | eval jf=1 | fields + m b jf ] I now have a single result with three fields only, jf (join field) is just for the join operation. | eval y= m*starttime + b | eval _time=starttime | chart values(y) over _time Your predicted y value for the future. ... View more

Hi Lowell, I implemented the deduplication and sorting functionality in a custom command. Being your experience far greater than mine you won't have any problem to remove the deduplication logic (and maybe suggest any improvement 😉 Syntax: | mvdedup [[+|-]fieldname ]* with no parameter: will dedup all the multivalued fields retaining their order with one or more fieldnames: will dedup those fields retaining their order with one or more fieldnames prepended by a +|- (no empty space there!): will dedup and sort ascending/descending | mvdedup -id Here's the configs: commands.conf [mvdedup] type = python streaming = true maxinputs = 500000 run_in_preview = true enableheader = true retainsevents = true generating = false generates_timeorder = false supports_multivalues = true supports_getinfo = true mvdedup.py import sys import splunk.Intersplunk as si import string def uniqfy(seq,sortorder=None): seen = {} result = [] for item in seq: if item in seen: continue seen[item] = 1 result.append(item) if sortorder=='+': result.sort() elif sortorder=='-': result.sort(reverse=True) return result (isgetinfo, sys.argv) = si.isGetInfo(sys.argv) if isgetinfo: #outputInfo(streaming, generating, retevs, reqsop, preop, timeorder=False): si.outputInfo(True, False, True, False, None, False) sys.exit(0) results = si.readResults(None, None, True) fields={} if len(sys.argv) &gt; 1: for a in sys.argv[1:]: a=str(a) if a[:1] in ['+','-']: # set sorting order fields[a[1:]] = a[:1] else: # no sorting! fields[a] = None else: # dedup on all the fields in the data for k in results[0].keys(): fields[k] = None for i in range(len(results)): for key in results[i].keys(): if(isinstance(results[i][key], list)): if key in fields.keys(): results[i][key] = uniqfy(results[i][key],fields[key]) si.outputResults(results) Any suggestion is more than welcome ... View more

It seems like stats' "values" function sorts the values alphabetically ... | streamstats count as id | stats values(DynamicalValues) as dyn values(StaticValues) as st by id | eval Status = if(dyn != st, "NOT OK", "OK") Here I'm using streamstats just to assign each event a unique ID. Downsides: "values" will deduplicate values but for IP:port couples should not be a problem, right? you lose the _raw part and the other fields... ... View more