The following is my search …..My Search…… | stats count by orderid,source,host Which displays the following results orderid source host count 971729145 /jboss/server/12commerce/log/server.log kvcldprdapp02a 1 106283305 /jboss/server/20cap/log/server.log kvcldprdapp01b 1 147093787 /jboss/server/13commerce/log/server.log kvcldprdapp08b 1 569279529 /jboss/server/11commerce/log/server.log kvcldprdapp01a 2 670563206 /jboss/server/13commerce/log/server.log kvcldprdapp03b 1 862422991 /jboss/server/12commerce/log/server.log kvcldprdapp07b 1 038357748 /jboss/server/12commerce/log/server.log kvcldprdapp03b 1 Now how can i modify my search to display a separate column and shows the total count as follows orderid source host count Total_Count 971729145 /jboss/server/12commerce/log/server.log kvcldprdapp02a 1 8 106283305 /jboss/server/20cap/log/server.log kvcldprdapp01b 1 147093787 /jboss/server/13commerce/log/server.log kvcldprdapp08b 1 569279529 /jboss/server/11commerce/log/server.log kvcldprdapp01a 2 670563206 /jboss/server/13commerce/log/server.log kvcldprdapp03b 1 862422991 /jboss/server/12commerce/log/server.log kvcldprdapp07b 1 038357748 /jboss/server/12commerce/log/server.log kvcldprdapp03b 1 ... View more

Hi I have the following search which displays the Average of a field, but I am trying to put a time chart in hourly which shows the average of that particular hour. …..My Search……|rex "<Total_Amount_Due>(?<amount>\d+.\d+)</Total_Amount_Due>" | stats count by amount | where amount > 0 | stats avg(amount) as average How to modify my search to display the hourly average count? Any help or Suggestions? ... View more

I know there is a way to do that by creating a role and assigning that role to the Ldap Group, but I want to know is there any other way that I can assign directly to certain users that I prefer to instead of assigning that role to all the members in a dashboard. Any suggestions will be helpful Thanks ... View more

Hi I have the following search which displays the sum of a field, but I am trying to put a time chart in hourly which shows the sum of that particular hour. …..My Search……| rex "value(?<amount>\d+.\d+)" | stats count by amount |stats sum(amount) as total How to modify my search to display the hourly count? Any help or Suggestions? ... View more

The following are my search results <Total_Amount_Due>122.34</Total_Amount_Due> <Total_Amount_Due>2.3</Total_Amount_Due> <Total_Amount_Due>765.33</Total_Amount_Due> Now Please suggest me a Regex which displays all the amounts. Thanks in Advance ... View more

The following were my html search results <country>USA</country> <country>CANADA</country> <country>UK</country> <country>AUSTRALIA</country> How do I write the regex to extract and list out the countries and their count. Thanks ... View more

Hi, Whenever i create a new index in my licensed standalone version it automatically taking the home path,cold path as follows $SPLUNK_DB/hot/index1/db $SPLUNK_DB/cold/index1/db Where can i see the cold and hot bucket logs? ... View more

Can anyone please explain the steps to taken on the Splunk side to get the syslogs through UDP? After configuring the syslogs with port 1024 through UDP, where can we see the logs? And how can Splunk receive syslogs without the help of a Splunk Universal Forwarder? ... View more

The following were my search results: processor.ProcSavePriceInfoObjects.writeProperties(ProcSavePriceInfoObjects.java:1424) processor.ProcSavePriceInfoObjects.saveSubtotalPriceInfos(ProcSavePriceInfoObjects.java:1180) processor.ProcSavePriceInfoObjects.saveShippingItemsSubtotalPriceInfos(ProcSavePriceInfoObjects.java:1076) processor.ProcSavePriceInfoObjects.savePriceInfo(ProcSavePriceInfoObjects.java:1052) processor.ProcSavePriceInfoObjects.saveOrderPriceInfo(ProcSavePriceInfoObjects.java:807) processor.ProcSavePriceInfoObjects.runProcess(ProcSavePriceInfoObjects.java:716) Now I want list out only the results occurring after the "processor.proc" How to write a regex in Splunk as needed? ... View more

Hi, I have read the documentation provided in Splunk, but I just want the step by step commands to run on a Linux server from start to end since I don't have much knowledge in Linux. Also, does it require sudo access to upgrade Splunk? How do make a backup of Splunk and where to store the backup? Outside of the Splunk directory or inside of the Splunk directory? Is a backup really necessary to upgrade? Please do suggest me how to do that if anyone is experienced in upgrading Splunk. Thanks in Advance. Environment: StandAlone (Splunk server alone acts as indexer, search head, deployment server) Server details: Red Hat Linux License Purchased: 50 Gb per day ... View more

The following were the strings visible in my Splunk search results… An error occurred at line: 127 in the jsp file: /uk/store.jsp An error occurred at line: 23 in the jsp file: /browse/find_it_content.jsp An error occurred at line: 1 in the jsp file: /browse/find_it_content.jsp Now I want to extract the field and display the count for the path that appears after the string An error occurred at line: 1 in the jsp file: and also for the line number it appeared. Need the results like this : Line_number file count 56 /browse/stats.jsp (some count) …. …….. (some count) ... View more

The following were the different strings visible in my splunk search results… "SYSTEM_USE_CD" : "C" "SYSTEM_RSP_CD" : "0100" "SYSTEM_STAT_CD" : "ACCEPT" Now with the help of regex in my search string i want to display only these values and also want to see their stats count for these three of them like system_cd Count "SYSTEM_USE_CD" : "C" (some count) "SYSTEM_RSP_CD" : "0100" (some count) "SYSTEM_STAT_CD" : "ACCEPT" (some count) Please help me how to display these stats from a splunk search with the help of regex ... View more

Hi I have the following search which is presently displaying the list of eventcounts by the field "category_type", but I want to see the result in log size per field instead of event count. Is it possible to see like that? If yes please suggest me a way. index="abc" source="/opt/jboss/server/shoe/log/server.log" |stats count by category_type Thanks in Advance ... View more

Hi, The following is my Scenario I have the following 3 different searches as follows search 1 :- index="htc" sessionId="*cap" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount &gt; 1 | stats count as sessionId search 2 :- index="htc" sessionId="*com" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount &gt; 1 | stats count as sessionId search 3 :- index="htc" sessionId="*mob" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount &gt; 1 | stats count as sessionId Now I want to display all the stats count in a Dashboard with different columns like count of search 1 as "cap" , search 2 as "com" and search 3 as "mob" If you can observe all the searches are same except for the sessionid ending string. I had already written the following search but it was taking too much time and also not working for hourly time chart view. Could anyone modify the search? index="htc" sessionId="*cap" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount &gt; 1 | stats count as Cap | appendcols [search index="htc" sessionId="*com" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount &gt; 1 | stats count as Commerce ] | appendcols [search index="htc" sessionId="*mob" host="*" | stats values(host) as hosts, dc(host) as hostcount, values(source) as sources by sessionId | where hostcount &gt; 1 | stats count as Mobile ] Thanks in Advance ... View more

Hi I have two different searches and two different results as follows Search 1: index="xyz" ".handleCommitOrder"|xmlkv | timechart count(date_mday) span=1h Result of search 1: _time count(date_mday) 2015-09-30 09:00 38 2015-09-30 10:00 29 2015-09-30 11:00 57 2015-09-30 12:00 37 2015-09-30 13:00 30 search 2: index="xyz" source="/opt/jboss/server/abc/log/server.log" OR source="/opt/jboss/server/def/log/server.log" "Order_Number" |xmlkv | timechart count(Order_Number) span=1h Result of Search 2: _time count(Order_Number) 2015-09-30 09:00 714 2015-09-30 10:00 813 2015-09-30 11:00 967 2015-09-30 12:00 958 2015-09-30 13:00 110 Now I want to know the percentage difference of search 1 and search 2 and how can I display them in statistical result? Is it possible in Splunk ? Please help ... View more