try this: ^:(?P<error>.*)$ if the complete string you're looking at is ":test string 123:test test test123" and you just want to remove the ":" this works. ... View more

is ":test string 123:test test test123" the string you want to use that regex? if it is, you are capturing 2 groups group "testERROR" - :test string 123:test test test123 unnamed group - :test test test123 what do you want to capture? this? "test test test123" use https://regex101.com to test your regex ... View more

the dedup will keep the first occurrence of each value for the given field. Since you'll have you table ordered by _time (same order as event in the search results) it will give you the last entry for each host. the complete search will give you how many are enter and exit: index=indexname sourcetype=XYZ:DB maintmode_host=wildcard | table _time maintmode_host maintmode_state | dedup maintmode_host | stats count by maintmode_state to get the list of the ones enter: index=indexname sourcetype=XYZ:DB maintmode_host=wildcard | table _time maintmode_host maintmode_state | dedup maintmode_host | search maintmode_state="enter" in the last search just replace "enter" in the maintmode_state with whatever you want to look for. There are great way to improve your searches. If you have time take a look at eventtypes. ... View more

just to clarify, you can see the data in splunk looking only at the index, right? if so: check if you are searching using smart or verbose mode while searching. check if you have the props stanza for the sourcetype assigned to the events. (run this ./splunk btool props list --debug) ... View more

Hey skoelpin Try this: index=vertex7-access RTG_Error="500" earliest=-6d@d latest=-1@d | timechart span=1d count AS totals | stats avg(totals) AS last_week_avg | appendcols [search index=vertex7-access RTG_Error="500" earliest=-1d@d latest=now | timechart span=1d count AS today_avg] | eval alert = if((today_avg>last_week_avg*1.5),"true","false") Then you just need to choose alert if custom condition is met: alert=true There might be another solution without subsearches but this should work. ... View more

If the lines you want get from the csv is the top you and do it like you have but in the inputlookup use also the "max" and "start" arguments. If not, instead of appending via the inputkooup, try to use the append [subsearch] command to get the csv data, filter it and then appending it. something like: index="logmon_logs" |top useother=f limit=10 CHKOUTErrorMSG by _time|timechart count by CHKOUTErrorMSG| append [|inputlookup chkouterrorNew.csv | <whatever you want to filter>]| sort -_time | outputlookup chkouterrorNew.csv ... View more

have you checked your user roles in both servers? you might have different permission for index access and (depending on the search you are doing) you might have different default indexes for search. ... View more

You only get the point because the bar graph on has one value. if you'll get only one value at all times why not use a gauge instead? you can set the limits on the gauge multiple levels. ... View more

To schedule a search you need to create a saved search by going to settings - searches - new. There you can find the option to schedule the search with basic time options or using cron. When you use the loadjob you use the name you gave to your saved search. This way will load the search results of the last time splunk runned your search. ... View more

The tag is handled in search time. the tags will be applied to the events that fulfill the tag stanza, In the case the host field. If you change the tag to something else all the events from that host will have the new tag. You can work this out by using a different host name or using a proper naming convention for web servers vs app servers. ... View more

try this: | chart values(total_size) as "Total Size" values(used_size) as "Used Size" values(avail_size) as "Avail Size" over Event_time change the field names inside the values() to match your extracted fields. ... View more

Here is some information from splunk docs http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Forwarderdeploymenttopologies It has link for multiple solutions (load-balancing, forward to 3rd parties and to splunk clusters) ... View more

try this: [monitor:///opt/log/www*/access.log] sourcetype=access_combined host_segment=3 index=web [monitor:///opt/log/www*/secure.log] sourcetype=linux_secure host_segment=3 index=main ... View more

I used this answer to deal with that kind of logs before. http://answers.splunk.com/answers/153101/unable-to-extract-multi-word-values-from-cef-fields.html They used props/transforms and regex instead of sedcmd to extract everything and apply a transforms to the content after the last pipe. ... View more

i think there's a problem with you where clause... try with this: | where myHour=10 AND (myMin >=00 AND myMin<=15) if it still doesn't work check if your evals (myMin and myHour) are showing proper values. I tested it using some splunk auto extracted date fields and i was getting the proper events index=_internal | where date_hour=10 AND (date_minute>=00 AND date_minute<=15) ... View more

Sure, it was just an example on how the vertical lines could be achieved. ... View more

Look at dynamic drill down in docs http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/Understandbasictableandchartdrilldownactions ... View more

Try this: <link> <![CDATA[/app/[name of the app where the view is]/sql_statement_failed?dboperationcode=$row.dboperationcode$&host=$host$&earliest=$earliest$&latest=$latest$]]> </link> ... View more