Try this. props.conf: [<yoursourcetype>] REPORT-machinename = machinename transforms.conf: [machinename] SOURCE_KEY = MetaData:Source REGEX = (?<=ne\/)(?<machinename>.*)?(?=\/MD) ... View more

Will you post your inputs.conf? You probably have a [monitor] stanza that defines the host. Or, if this is the result of a summary-indexing search, the host field will be the name of the search head that ran the search and created the summary data. If that's the case, you probably don't want to override the host field, but instead have your summary search include a different field name for the host of the summary data, perhaps h (which is what Splunk uses in the _internal index to denote a host different from the one that generated the data). ... View more

You could make use of the REST API to have a cron job on each server search your Splunk instance for its own status, and perform the restart if necessary. ... View more

Note: this will only limit the options shown. It won't limit the actual searches they can run. The user could override the timepicker values by setting earliest/latest in the search string. ... View more

One possible solution, if all else fails, is to bring everything in as one sourcetype, then modify the sourcetype at index time via a transform. inputs.conf: [montitor:///<your path] sourcetype = tempsourcetype props.conf: [tempsourcetype] TRANSFORMS-set_st = set_st_infaccess,set_st_inferror transforms.conf: [set_st_infaccess] REGEX = cib\logs\httpd\(inf_)?(un)?mana[\w\d-.]*_access_log$ SOURCE_KEY = MetaData:Source DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::app:WRWFP:infaccess [set_st_inferror] REGEX = cib\logs\httpd\(inf_)?(un)?mana[\w\d-.]*_error_log$ SOURCE_KEY = MetaData:Source DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::app:WRWFP:inferror You would create one transform per source regex/sourcetype combination. ... View more

You can specify a different timestamp: | bin span=5min <timestamp field> You may need to look into how that field needs to be formatted to work with the bin command. ... View more

How long does that subsearch take to run, if you run it by itself? Your join subsearch looks like it returns just one field, SearchIfZero , and your join statement looks like it's trying to join on the field searchresult . Is this the actual search you're running, or has it been modified to post here? ... View more

I think this would give you max transactions per second: <base search> | bin span=1s _time | stats count as TPS by source, sourcetype, fieldA, fieldB, _time | stats max(TPS) by source, sourcetype, fieldA, fieldB ... View more

Is the pattern defined by the literal term divvo ? ... View more

No, you need the values to be extracted before using mvexpand. However, you might want to reconsider how your data is indexed, if it makes more sense for each line to be a separate event (which from an outsider point of view makes the most sense to me). ... View more

Is there any reason not to split those into multiple events? If not, you could do: | mvexpand check_amount |eval fixed_value = round(check_amount / 100, 2) Which would result in one event per check. Edit: converted from comment to answer. ... View more

Is check_amount a multi-value field, as indicated by MV_ADD=true? I think that may break your eval. ... View more

And you see the check_amount field populated using that last search? ... View more

Do you still have this issue if you run the search in verbose mode, or changing the name of the field resulting from eval ? ... View more

You can set earliest/latest using a subsearch if necessary. In this case, you can set earliest using an eval based on info_max_time , created via addinfo . Try this, which should set earliest to be essentially latest-1d : host=host123 index=security123 sourcetype="SplunkLog123" [| makeresults | addinfo | eval earliest=relative_time(info_max_time, "-1d") | table earliest] Edit: Try this instead: [| makeresults | addinfo | eval earliest=relative_time(info_max_time, "-1d") | table earliest] host=host123 index=security123 sourcetype="SplunkLog123" I've seen issues before with Splunk interpreting earliest=/latest= as key/values pairs of the data itself (instead of time modifiers) if they aren't at the start of the query. ... View more

Perhaps a little modulus action: if(field1%field2==0, "true", "false") ... View more

Try changing your search to only return results that meet your alert threshold: index=os sourcetype=df MountedOn="/var/opt/" | stats latest(PercentUsedSpace) AS latest_pct_used by MountedOn | search latest_pct_used>85 And as shown above, you probably don't care about the average, so much as you care about the last known percent used. ... View more

Ooooh, I like this, assuming it works. I had never considered specifying index-time transforms by source instead of sourcetype. ... View more

Your stats search named the values() function output Time, so _time isn't available. Try changing your sort to: sort -Event_Count Time Or change your values() function to name the field _time. Edit: and change your values() function to use eval(), as per the answer below. ... View more