BUG Fixed starting at 6.5.1: http://docs.splunk.com/Documentation/Splunk/6.5.2/ReleaseNotes/6.5.1 "2016-10-25 SPL-129359, SPL-128210 Table Page not refreshed when refreshing search" ... View more

Try this solution: https://answers.splunk.com/answers/400053/condition-match-and-set-token-in-drilldown-not-wor-1.html ... View more

According to this doc: http://docs.splunk.com/Documentation/ITSI/2.4.1/User/CreateCorrelationSearch ITSI saves the alerts as a correlation search. You can find the corresponding correlation search to your multiKPIAlert and add an email action there. ... View more

Try this: |stats earliest(_time) as start latest(_time) as end by JobExecID ... View more

Try this one: |appendpipe [stats sum(amount) as total_debit by dr_account |rename dr_account as account] |appendpipe [stats sum(amount) as total_credit by cr_account |rename cr_account as account] |stats values(total*) as total* by account |eval balance=total_debit-total_credit Result: account total_credit total_debit balance -------------------------------------------------- 111111 4250000 5500000 1250000 222222 1500000 11070000 9570000 333333 1000000 3000000 2000000 444444 1250000 555555 14070000 ... View more

Assuming uptime values makes sense: for this example first two lines have the same starting time. And timestamp is recognized as _time field, If the source looks like this: |makeresults |eval a="time=15-01-2016 02:05:34.00, uptime=1231 BR time=15-01-2016 02:45:32.00, uptime=3629 BR time=16-01-2016 06:03:15.00, uptime=93253" |table a |makemv delim="BR" a |mvexpand a |rename a as _raw |extract |eval _time=strptime(time,"%d-%m-%Y %H:%M:%S") |table _time uptime _time uptime -------------------------------- 2016-01-15 02:05:34 1231 2016-01-15 02:45:32 3629 2016-01-16 06:03:15 93253 Then the following query will calculate the precentage of uptime and downtime |makeresults |eval a="time=15-01-2016 02:05:34.00, uptime=1231 BR time=15-01-2016 02:45:32.00, uptime=3629 BR time=16-01-2016 06:03:15.00, uptime=93253" |table a |makemv delim="BR" a |mvexpand a |rename a as _raw |extract |eval _time=strptime(time,"%d-%m-%Y %H:%M:%S") |table _time uptime |eval start=_time-uptime,end=_time |eval startc=start,endc=end |convert ctime(*c) |sort - _time |dedup start |reverse | streamstats values(end) as before_end window=1 current=f |eval downtime=start-before_end |stats sum(uptime) as uptime sum(downtime) as downtime |eval overall=uptime+downtime |eval uptime=(uptime/overall)*100,downtime=(downtime/overall)*100 |table uptime downtime Result: uptime downtime 95.08 4.92 ... View more

So you have 3 contacts in the email attribute, but only 2 of 3 are getting that mail? It seems like your mail server and configuration are fine, but there a problem with the address itself. Try to enter only the one that is missing and hit 'Test PDF' If he still doesn't get it, his email address or mail server is rejecting that address. ... View more