thanks, found it under the inputs.conf , a section for netstat /bin/netstat.sh this is exactly what i want.. ... View more

Think this can be done with search not, can any of you provide me a syntax where in i can do a search not when a column value=matches a pattern. thanks. ... View more

Morris, thanks for your response. the pattern match value is coming from an drilldown input. so if user clicks on "Exception" i still need to show that, so cannot use the !="exception". i am not able to explain the scenario here , but ill try. i have 2 columns , one which has install status and the other which has the exception status. install status has yes/no AND exception status has "exception/no" so if input value is yes, i get all the yes, irrespective of exception status, bcoz yes means installed, so thats ok if input values is exception, then irrespective of install status, it will show exception, this is also ok now problem i have is with "no", if install status is "no" and exception status is "exception", then i would like to exclude the exception systems out of "no" click report. so i was looking at some solution , which after the report output can exclude exception="exception" rows in case "install status"="no" hope the problem is explained.. sorry for long write up. ... View more

with the optional solution of using column charts, you can use the stacked chart with scale set to use "log " instead of linear.. ... View more

Please check this previous link on similar issue, see if this helps : https://answers.splunk.com/answers/637224/how-to-display-multiple-data-points-when-hovering-1.html ... View more

unfortunately , i need to show it by counter as its getting fed into a summary index , after which the visualization is configured.. the above one gives me the data, but the counter fields are still rows.. i need counter rows as columns and _time as column and host as column the counter rows which are now columns should have the appropriate values for each column. ... View more

Thanks for your response , im missing the counter field which has the actual rows that should be columns. such as FreeMB etc... how to include the counter field as well.. ... View more

|table Value _time host counter value _time host counter 42 somedate test idle 43 somedate test notidle 52 anotherdate test idle 55 anotherdate test notidle i want to see below, how to do it with chart.. host _time idle notidle test somedate 42 43 test anotherdate 52 55 ... View more

Vinay, what you mentioned above are static entires, that works. but my list in the input is coming from dynamic entires.. so how to make it choose dynamically with asterix.. below is my xml input code.. <input type="dropdown" token="Site" searchWhenChanged="true" > <label>Select Site</label> <fieldForLabel>Site</fieldForLabel> <fieldForValue>Site</fieldForValue> <search> <query>index=testindex=-3d@d latest=now |dedup Site|table Site |sort by Site</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> ... View more

Another question on this, the uf data collected runs every 15 mins, so if i have to see the same output based on each run time, how do i do that.. it does not work for me when i run |chart last(Value) by host counter _time ... View more

Thanks for reply. This does not help my case, can you check the screenshot i attached, the dropdown list is dynamic and i would like to enforce a asterix so that 3 entries are considered. Basically i need to consider all that contains BANG in the dropdown input.. but i can only choose 1 in that list... ... View more

Screenshot of the issue, i am unable to make the asterix choice.. how do i make the drop down accept bang* as an option ... View more

any kind of data sources, maybe start with just the csv format.... im not looking for a solution right here, but trying to understand splunk's capability to do it... ... View more

yes, this works for me too just like above . thank you John. ... View more