Hello Splunkers, These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached. I am doing asset counts for the enterprise and am using charting to demonstrate them for high level reporting purposes. I see that my numbers appears to be coming out correctly within the Search "Events" tab details but trying to get visualization is difficult because I keep running into this limit. How do I increase it? I see some older references about XML or maybe a .conf file but nothing definite. Any suggestions? Thanks! ... View more

I have the main search returning results appropriately in the "Events" tab however, visualization returns incorrect graphs/counts. I have a similar issue with my intended sub search below. Essentially I am trying to find/make a list of 'hostname's in the sub search and then compare that to the main search to see what applications are installed on those hostnames. I have to normalize columns to read 'hostname' and ignore some fields. index=test_assets source="C:\\Splunk Test Assets\\SCEP.csv" OR source="C:\\Splunk Test Assets\\McAfee.csv" OR source="C:\\Splunk Test Assets\\DG-Windows.csv" OR source="C:\\Splunk Test Assets\\DG-Mac.csv" OR source="C:\\Splunk Test Assets\\PGP.csv" NOT "Windows Server 2008 R2 Standard" | rename "HostName" as hostname | rename "System Name" as hostname | rename name as hostname | rename "Host Name" as hostname | rename MACHINE_NAME as hostname | replace "C:\Splunk Test Assets\SCEP.csv" with SCEP IN source | replace "C:\Splunk Test Assets\McAfee.csv" with McAfee In source | replace "C:\Splunk Test Assets\DG-Windows.csv" with DG In source | replace "C:\Splunk Test Assets\DG-Mac.csv" with DG IN source | replace "C:\Splunk Test Assets\PGP.csv" with PGP IN source | chart count over hostname by source This is the sub search (below) that I am trying to mine for hostnames to compare to the main search (above) . The sub search returns an appropriate number of entries in the "Events" tab for "source" however when I go to visualization, the graphs are not representative of the counts I see in the "Events" tab. index=test_assets source="C:\\Splunk Test Assets\\WSUS.csv" OR source="C:\\Splunk Test Assets\\Altiris_hostnames.csv" OR source="C:\\Splunk Test Assets\\mac-AD.csv" NOT "System Type"=Virtual NOT "System Type"="Thin Client" NOT "Operating System"="Windows Server 2003 Standard Edition" NOT "Operating System"="Windows Server 2003 Standard x64 Edition" NOT "Operating System"="Windows Server 2008 R2 Standard Edition" NOT "Operating System"="Windows Server 2008 Standard Edition (full installation)" NOT "Operating System"="Windows 2000 Datacenter Server" NOT "Operating System"=Linux NOT "OS Name"=AIX NOT "OS Name"=AIX5L NOT "OS Name"=CentOS NOT "OS Name"=HP-UX NOT "OS Name"="HP-UX 11i v1" NOT "OS Name"=Linux NOT "OS Name"="Red Hat Enterprise Linux" NOT "OS Name"="Red Hat Linux" NOT "OS Name"=SunOS NOT "OS Name"="SUSE Linux" NOT "OS Name"="SUSE Linux Enterprise Server" NOT "OS Name"="Ubuntu Linux" NOT "Operating System"=VMWare NOT "OS Name"="Microsoft Windows Server 2003" | rename "System Name" as "hostname" | rename "name" as "hostname" | rename "HostName" as "hostname" | rename "Host Name" as "hostname" | rename MACHINE_NAME as "hostname" | replace "C:\Splunk Test Assets\Altiris_hostnames.csv" with Altiris in source | replace "C:\Splunk Test Assets\WSUS.csv" with Windows-WSUS IN source | replace "C:\Splunk Test Assets\mac-AD.csv" with Mac-WSUS IN source | dedup hostname | chart count over hostname by source So, two questions then I guess. Why are the source counts in the events tab not matching up and how to I join the second search as a sub search. ... View more

Hey Splunkers, I have a search that is successfully returning search results as needed, however, I'd like to clean up the results a little. The search returns the following: HostName=PC-USERNAME.DOMAINNAME.COM There are some databases that this search references that do not have the .DOMAINNAME.COM tacked onto the end of it and in the name of standardizing the search output, i'd like to clean it up so that they all look the same. Is it possible to remove .DOMAINNAME.COM from the HostNames in the search results? Thanks! ... View more

Hello Splunkers, I have a search that's coming up nicely but I need to refine the search further by sorting by a field name of Last Audit that happens to have dates in it in the format of 1/1/2011. I'd like to have my existing query but include something along the lines of "Last Audit"=>(1/1/2011). Basically, give me the results from anything since 1/1/2011. What do I need to add to create that functionality? Thanks! ... View more

Hello Splunkers, I'm working on a pie chart where I am trying to show the total number of assets and then show that same list of assets that has a particular software package installed. Both sets of info come from two .csv files specified by source=*.csv. I get the numbers correctly by doing the following: mysearch | | stats dc(HostName) by source The chart correctly shows: Total_Mac_Assets = 608 Total_Mac_Assets w/_DG_Installed = 475 However the Total_Mac_Assets needs to be the full “Pie” in the pie chart and the 475 needs to be a slice of that total. In the pie chart currently generated, it looks like 608 is half and 475 is half but 133 short of 608, if that makes sense. For example, if I were to have the software installed across all assets, the pie would be split evenly down the middle. How do I set the 100% range of the pie chart to equal Total_Mac_Assets = 608 and then have Total_Mac_Assets_w/_DG_Installed = 475 be a slice of that total? Thanks for any assistance. ... View more

Hello Splunkers, I'm processing results of an asset database search. I have one database that is the 'reference' database "database 1" that has lets say 500 assets in it. I have a second database that has lets say 350 assets in it that we are trying to get to match up so that it at some point also will equal 500 assets in it. I thought a marker gauge would be a good tool to communicate progress to mgmt in doing this. My search is built already where I have a basic 2 line chart with a header "source" above database 1 and database 2 columns and a header "count" above the count columns found in each database. I would like to make a gauge where the maximum of the gauge will always reference the count in the reference database 1 and the moving needle will always reference the count in database 2. Is that possible and if so, how do I do it? Thanks! ... View more

Hi Splunkers, I have built the following chart extracting hostnames from .csv files that have been exported from both associated databases: Host DB1 DB2 PCA 1 1 PCB 0 1 PCC 1 1 PCD 0 1 ...and so on. A list of hostnames and then a 1 or 0 to indicate that it's listed in a particular database. What I am trying to do is figure out how to provide totals on how many are in each database. So lets say the reference database 2 has the full number of hostnames. Out of that number how many are also listed in database 1. Like Database1=568 and Database2=900. Database1 and Database2 are currently listed as the /path/path/path/filename.csv source that the data sits in. Thanks for any help! ... View more

Hello Splunkers, I feel like I have the most basic of questions here but I can't get it to work. I have a .csv log file with some info. The key components of which is a field "Status". Status=Rejected or Status=Accepted. I am trying to get a line chart of the amount of Rejected over time along with the amount of Accepted over time but I can't figure it out. It's got to be a basic one. What am I missing? Thanks everyone. ... View more

Hello Splunkers, I am trying to correlate hostnames to multiple sources (4 .csv host files) to see if I can find where the same hostnames show up in those sources. I have the data into Splunk and have individually done initial searches through each of the host files to give myself a clean list of hostnames but I don't quite know how to sort through the resulting data to chart which hostnames appear in what sources. index=assets source="/scratch/assets/DG-Windows.csv" | dedup MACHINE_NAME index=assets source="/scratch/assets/DG-Mac.csv" | dedup MACHINE_NAME index=assets source="/scratch/assets/Altiris.csv | dedup System Name index=assets source="/scratch/assets/Asset-Mgmt.csv" | dedup HostName Does anyone know how this could be done? ... View more