Hello@ agu_srishti adding as a new answer, as i cant post an image in comments. custom command test can work, but am not sure it yields the results expected ----- as according to the python code. Thanks ... View more

Hi @dellytaniasetiawan look if test.py file has executable permissions on the server. and also try to run the search with | test as starting. Thanks ... View more

Hi @nareshmg give this a try you can add that condition to your dashboard search Thanks ... View more

all you need in commands is [getmetricdemo] filename=getmetricdemo.py passauth = true & the python file should be in the bin directory of the app, commands in local/default of the same app, meta file in metadata dir of same app. yes if its a cluster you need to push them from deployer to all search heads. Thanks ... View more

Hi @andrei1bc as somesoni2, mentioned you can look into index=_internal sourcetype=scheduler savedsearch_name=yoursearchname status=success/skipped/delegated/delgated_remote_error/delgated_remote_completion to analyze why its running twice & also you can look into index=_introspection sourcetype=splunk_resource_usage component=PerProcess data.process=splunkd data.process_type=search ------- search_props section will list out on what search head the search is running and many other things. Thanks ... View more

Hi @maniu1609 you should also set info regarding the command in metadata ---- local.meta or default.meta [commands/commandname] export = system owner = nobody Thanks ... View more

Hi @brosselle try this below query index=OS sourcetype=cpu | timechart avg(pctIdle) by host |eval calc = (100 - 'hostfieldnamefrompreviuosresults') | fields calc hostfieldnamefrompreviuosresults Thanks ... View more

what do you mean by affected ? ... View more

Hi @isabelcarvajal / opt / splunk / var / lib / splunk -- filesystem holds data for all indexes like _internal, _introspection,_audit, main. in each of these indexes, the data again is arranged based on the age ----- Hot, warm, cold, thawed db folder ----- hot &warm data colddb ----- cold data thaweddb ----- restore frozen data which can be searched. Please go through these doc for more understanding. http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/HowSplunkstoresindexes & aging of the data can be explained in this doc. https://wiki.splunk.com/Deploy:BucketRotationAndRetention thanks ... View more

Hi @nate_c you can add, update, delete data by working with a kvstore or lookup. and you can use lookup commands like inputlookup, outputlookup, lookup to work with kvstore or lookup files & also show these data as panels in the dashboards. go through this splunk doc, can be helpfull http://dev.splunk.com/view/webframework-tutorials/SP-CAAAEZT Thanks ... View more

Hi @dwing71641 Please use $field name$ from the search in the to mail address action Thanks ... View more

Even am not sure, why its listing 27th data from the march all i can think of is --- as we are doing a span of 1week, it might be pulling data from week starting in march and ending in April Work Around: if you do earliest as April 3rd you wont see the march 27th anymore. Thanks ... View more

Adding as an answer as i can't upload a image in comments. In missing tuesday's probably my local spunk was down Thanks ... View more

Hi @shraddhamuduli Please go through this splunk answer & give it a try https://answers.splunk.com/answers/528397/unable-to-login-to-splunk-enterprise-on-my-local-m.html Thanks ... View more

Hi @chandana204 Give this search a try index=retail_ca | timechart span=1d count by index | search retail_ca=0 Thanks ... View more

Hi @Vigneshprasanna use this query to extract the time from result. index="jboss" AUDIT_DATA="XXXXX" AND AUDIT_DATA=""XXXX8"" AUDIT_TIME>="2018-06-05 21:00:00" | table AUDIT_TIME | sort AUDIT_TIME | uniq | sort 2 AUDIT_TIME | reverse | return AUDIT_TIME | rex "AUDIT_TIME=\"(?P<time>.*)\"" | fields time Thanks ... View more

Hi @GeoCouloute if you have newer version of splunk 7.1.1 you can see a new option in settings --- search head clustering -- from there you can see the list of all search heads in the cluster. from CLI you can also execute the query ./splunk show shcluster-status --- to see the list of all search heads incuding the captain in the cluster. Thanks ... View more

Hi @roopasree There should be a common field in main & sub search to map the results correctly, if you want to just append the columns use the above answer ----- appendcols, append commands should work for that. if you want to map the results between main and sub search based on a specific field ----- join command should work for you. main search | fields date,open,close,incidentnum | join incidentnum [search subsearch | fields incident,type1,result,incidentnum] | stats c by date,open,close,incidentnum,incident,type1,result Thanks ... View more

Hi @abhi04 why dont you create an alert in a usual way your search | stats dc(source) as sourcecount & in trigger conditions ---- choose Custom --- sourcecount<13 Thanks ... View more

Hi @Maniteja81 You can use this settings on the right hand top side of the dashboard panel to make the changes the legend truncation gives you option to choose the y axis field values to be shown as - starting, start..end, ending. if you want to change the field values completely, you may need to rename them in the search only. Thanks ... View more

Hi @mahasd use the below search your search | NOT "Completed monitor recovery service" | stats c by host trigger if the count was greater than 0 and you will also get a list of hosts. Thanks ... View more

Hi @matstap add the below code in panel 1 from which you are passing the values a or b or c <drilldown> <set token="abc">$click.value$</set> </drilldown> and this code further to the drilldown panel you want to acheive <row depends="$abc$"> <panel> <title>Metric: $abc$</title> <table> <search> <query>index=yourindex field=abc </query> <earliest></earliest> <latest></latest> </table> </panel> </row> Thanks ... View more

Hi @Chandras11 add csv file to splunk through - settings - lookups - lookup tables Use lookup command to add the field with YES/NO to every event, ex: your search | lookup 123.csv host as hostname output fieldyesno finally filter out the events just with doing -- fieldyesno=YES/NO as per your wish Please go through this lookup documentation, willl be helpfull http://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/Lookup Thanks ... View more