No, it does not. ... View more

This is interesting... If I look for the saved search against my load balance I don't get the result, but if I tried directly to one of the SH it works... ggarcia-osx:~ ggarcia$ curl -ks -u 'ggarcia:********' "https://s<load_balance>:8089/servicesNS/-/ssn/saved/searches/ggarcia_test_jason" | grep '<title>' ggarcia-osx:~ ggarcia$ curl -ks -u 'ggarcia:********' "https://<hostname>:8089/servicesNS/-/ssn/saved/searches/ggarcia_test_jason" | grep '<title>' <title>savedsearch</title> <title>ggarcia_test_jason</title> It worked now... Thank you... ggarcia-osx:~ ggarcia$ curl -k -u 'ggarcia:*******' "https://<hostname>:8089/servicesNS/admin/ssn/search/jobs/export" -d search=" savedsearch ggarcia_test_jason" <?xml version='1.0' encoding='UTF-8'?> <results preview='0'> <meta> <fieldOrder> <field>_time</field> <field>msg</field> </fieldOrder> </meta> <messages> <msg type="DEBUG">Configuration initialization for /usr/ssn/splunk/etc took 277ms when dispatching a search (search ID: 1524759462.1375367_512742A3-6B36-4E10-8BD6-D073A8FD06D5)</msg> <msg type="DEBUG">search context: user="ggarcia", app="ssn", bs-pathname="/usr/ssn/splunk/etc"</msg> </messages> <result offset='0'> <field k='_time'> <value><text>2018-04-26 09:17:42.000 PDT</text></value> </field> <field k='msg'> <value><text>test for Jason</text></value> </field> </result> </results> ... View more

Damien, That is a good question... I tried to list all Saved Searches and the one I am trying is not there: ggarcia-osx:~ ggarcia$ curl -ks -u 'ggarcia:*******' "https://splunk.ssnsgs.net:8089/servicesNS/-/-/saved/searches" | grep '<title>' <title>savedsearch</title> <title>Bucket Copy Trigger</title> <title>DMC Alert - Abnormal State of Indexer Processor</title> <title>DMC Alert - Critical System Physical Memory Usage</title> <title>DMC Alert - Expired and Soon To Expire Licenses</title> <title>DMC Alert - Missing forwarders</title> <title>DMC Alert - Near Critical Disk Usage</title> <title>DMC Alert - Saturated Event-Processing Queues</title> <title>DMC Alert - Search Peer Not Responding</title> <title>DMC Alert - Total License Usage Near Daily Quota</title> <title>DMC Asset - Build Full</title> <title>DMC Asset - Build Standalone Asset Table</title> <title>DMC Asset - Build Standalone Computed Groups Only</title> <title>DMC Forwarder - Build Asset Table</title> <title>DMC License Usage Data Cube</title> <title>Errors in the last 24 hours</title> <title>Errors in the last hour</title> <title>Indexing workload</title> <title>instrumentation.lastSent</title> <title>instrumentation.licenseUsage</title> <title>instrumentation.reportingErrors</title> <title>License Usage Data Cube</title> <title>Messages by minute last 3 hours</title> <title>Orphaned scheduled searches</title> <title>Splunk errors last 24 hours</title> <title>Top five sourcetypes</title> Maybe because it is SH Cluster? Thank you, ... View more

Thank you. The problem is that not all data is processed. It got cut around Total_fw_ver_3.2.1a=2 ... View more

I built this one as test: | makeresults | eval _raw="Total_fw_ver_0.0.00=2 Total_fw_ver_0.10.00=1 Total_fw_ver_1.6.04=215 Total_fw_ver_1.6.07=8 Total_fw_ver_1.6.7a=1 Total_fw_ver_1.6.08=39 Total_fw_ver_1.6.09=310 Total_fw_ver_1.8.0f=6 Total_fw_ver_1.8.01=21 Total_fw_ver_1.8.04=4 Total_fw_ver_1.8.04=581 Total_fw_ver_1.8.06=2 Total_fw_ver_1.8.08=1 Total_fw_ver_1.8.08=4 Total_fw_ver_1.8.8f=9 Total_fw_ver_1.8.09=6379 Total_fw_ver_1.9.01=1 Total_fw_ver_1.10.02=2 Total_fw_ver_1.10.04=1 Total_fw_ver_1.10.6a=424 Total_fw_ver_1.10.6e=1496 Total_fw_ver_1.10.78=1 Total_fw_ver_1.10.b1=1 Total_fw_ver_2.0.01=1 Total_fw_ver_2.0.02=9 Total_fw_ver_2.0.05=80 Total_fw_ver_2.2.00=3 Total_fw_ver_2.2.02=6303 Total_fw_ver_2.2.04=13957 Total_fw_ver_2.5.10=3 Total_fw_ver_2.6.02=2 Total_fw_ver_2.6.02=2 Total_fw_ver_2.6.03=5 Total_fw_ver_2.6.03=24 Total_fw_ver_2.6.03=1 Total_fw_ver_2.6.03=1 Total_fw_ver_2.6.3a=1665 Total_fw_ver_2.6.3b=6837 Total_fw_ver_2.6.3c=3 Total_fw_ver_2.6.5b=1 Total_fw_ver_2.6.06=19 Total_fw_ver_2.6.6b=35 Total_fw_ver_2.6.07=1 Total_fw_ver_2.6.09=153 Total_fw_ver_2.6.09=123 Total_fw_ver_2.6.9a=3242 Total_fw_ver_2.6.9b=22824 Total_fw_ver_2.6.9c=283 Total_fw_ver_2.6.23=1503 Total_fw_ver_2.7.3b=1 Total_fw_ver_2.7.63=1 Total_fw_ver_2.7.80=1 Total_fw_ver_2.8.00=3 Total_fw_ver_2.8.0b=1 Total_fw_ver_2.8.0c=2 Total_fw_ver_2.8.01=5 Total_fw_ver_2.8.1a=3 Total_fw_ver_2.8.03=47 Total_fw_ver_2.8.03=3 Total_fw_ver_2.8.03=1 Total_fw_ver_2.8.04=1 Total_fw_ver_2.8.4a=4 Total_fw_ver_2.8.4b=1 Total_fw_ver_2.8.4c=1 Total_fw_ver_2.8.05=37 Total_fw_ver_2.8.06=537 Total_fw_ver_2.9.3b=1 Total_fw_ver_2.9.61=1 Total_fw_ver_2.9.3b=1 Total_fw_ver_2.10.03=1 Total_fw_ver_2.10.3a=1 Total_fw_ver_2.10.04=4 Total_fw_ver_2.10.06=1 Total_fw_ver_2.10.6a=6 Total_fw_ver_2.10.6b=113 Total_fw_ver_2.10.08=4 Total_fw_ver_2.10.08=1176 Total_fw_ver_2.10.8a=17338 Total_fw_ver_2.10.8b=44485 Total_fw_ver_2.10.8c=16138 Total_fw_ver_2.10.10=1 Total_fw_ver_2.10.10=7 Total_fw_ver_2.10.12=7 Total_fw_ver_2.10.12=8 Total_fw_ver_2.10.14=60 Total_fw_ver_2.10.14=4 Total_fw_ver_2.10.14=777 Total_fw_ver_2.11.28=1 Total_fw_ver_2.11.72=1 Total_fw_ver_2.11.89=1 Total_fw_ver_2.12.00=36 Total_fw_ver_2.12.00=5 Total_fw_ver_2.14.0c=1 Total_fw_ver_2.14.1c=103 Total_fw_ver_2.15.65=2 Total_fw_ver_2.16.00=1 Total_fw_ver_2.16.01=9 Total_fw_ver_2.16.02=1 Total_fw_ver_2.16.3c=1 Total_fw_ver_2.16.05=41 Total_fw_ver_2.16.5a=78429 Total_fw_ver_2.16.5c=1 Total_fw_ver_2.60.00=1 Total_fw_ver_3.0.03=152 Total_fw_ver_3.1.9d=330 Total_fw_ver_3.1.be=688 Total_fw_ver_3.1.bf=5 Total_fw_ver_3.1.bf=543 Total_fw_ver_3.1.7b=1 Total_fw_ver_3.1.ad=3 Total_fw_ver_3.1.77=7 Total_fw_ver_3.1.4d=1 Total_fw_ver_3.1.8a=6 Total_fw_ver_3.1.df=1 Total_fw_ver_3.1.df=1 Total_fw_ver_3.1.b2=1 Total_fw_ver_3.1.c1=2 Total_fw_ver_3.2.01=71 Total_fw_ver_3.2.1a=2 Total_fw_ver_3.2.1b=101 Total_fw_ver_3.2.1c=4 Total_fw_ver_3.2.02=422 Total_fw_ver_3.2.02=23 Total_fw_ver_3.2.2a=9173 Total_fw_ver_3.2.2b=83566 Total_fw_ver_3.2.2c=27 Total_fw_ver_3.2.2f=9 Total_fw_ver_3.2.3b=4084 Total_fw_ver_3.2.3c=1 Total_fw_ver_3.3.63=2 Total_fw_ver_3.3.ab=1 Total_fw_ver_3.4.01=122 Total_fw_ver_3.4.02=1 Total_fw_ver_3.4.03=2270 Total_fw_ver_3.4.03=28135 Total_fw_ver_3.4.3c=140 Total_fw_ver_3.4.04=1 Total_fw_ver_3.4.04=504 Total_fw_ver_3.4.04=80 Total_fw_ver_3.4.4b=1488 Total_fw_ver_3.4.05=450 Total_fw_ver_3.4.05=1557 Total_fw_ver_3.4.5b=770 Total_fw_ver_3.4.5c=1769 Total_fw_ver_3.5.56=1 Total_fw_ver_3.6.00=1 Total_fw_ver_3.6.2b=79 Total_fw_ver_3.6.05=33 Total_fw_ver_3.6.5c=1 Total_fw_ver_3.8.01=1036 Total_fw_ver_3.8.01=61 Total_fw_ver_3.8.1a=6943 Total_fw_ver_3.8.1b=93929 Total_fw_ver_3.8.03=5 Total_fw_ver_3.8.3b=14110 Total_fw_ver_3.8.05=1 Total_fw_ver_3.9.42=1 Total_fw_ver_3.9.4f=4 Total_fw_ver_3.10.00=35 Total_fw_ver_3.10.00=1987 Total_fw_ver_3.10.0a=138716 Total_fw_ver_3.10.0b=5419356 Total_fw_ver_3.10.01=1571 Total_fw_ver_3.10.01=10450 Total_fw_ver_3.10.1b=92 Total_fw_ver_3.99.15=2 Total_fw_ver_4.0.01=4 Total_fw_ver_47.d0.80=1 Total_fw_ver_Total=6050939" | KV | head 1 | stats values(Total_fw_ver_*) as Total_fw_ver_* | transpose column_name="Metrics" | rename "row 1" as "Value" | eval fwver=replace(Metrics,"^Total_fw_ver_","") | eval fwver=replace(fwver,"_",".") | table fwver Value There is a Total_fw_ver_Total=6050939 that is not in the final output, also addtotals of this table should be the be at least 6050939. Is there any limitation of KV or stats? Thank you. Gerson ... View more

@niketnilay, It sort of worked... Unfortunately in my case, I have much more than 1000 key=value fields and it is truncating it. But I have a question, what | KV does? I noticed that it converted 1.0 to 1_0 (in my case I need all versions) but I couldn't find this in my env. Thank you, Gerson ... View more

It worked like a charm. Thank you!!! ... View more

@cmerriman Yes I tried it, but I am confusing with the result: maxpause=30s: index=main sourcetype=app | transaction jobId jobExecId startswith="Expanding device group" endswith="Job complete" maxpause=30s | search taskName=highFrequencyLogRead Returns: 38 events (11/28/17 12:40:48.000 PM to 11/28/17 1:40:48.000 PM) maxpause=1s index=main sourcetype=app | transaction jobId jobExecId startswith="Expanding device group" endswith="Job complete" maxpause=1s | search taskName=highFrequencyLogRead Results: 19 events (11/28/17 12:42:24.000 PM to 11/28/17 1:42:24.000 PM) maxpause=5s index=main sourcetype=app | transaction jobId jobExecId startswith="Expanding device group" endswith="Job complete" maxpause=5s | search taskName=highFrequencyLogRead Results in: 36 events (11/28/17 12:44:22.000 PM to 11/28/17 1:44:22.000 PM) I need the opposite, only returns when the pause between entries in the transaction is greater than 30s. What am I doing wrong? Thank you. ... View more

@woodcock, no that is not it. This search: | tstats count where index=apps sourcetype=myapp by mytoken | dedup mytoken | fields - count Is correct since that is exactly what I need to show in the dropdown list. 'mytoken' in this case is a field in the record. Also the reject is working because when I set $ops$ this input panel is not visible. But even though it is not visible, it is setting $mytoken$ with blank: <set token="mytoken"></set> If I change it to <set token="mytoken">Anything</set> Then, mytoken is passed to the next panel with Anything. Weird, humm? Thank you, Gerson ... View more

No, that is not what the timer pick sets. it sets 2 variables: <earliest>-7d@h</earliest> <latest>now</latest> The provided code works for dropdown lists. Thank you, ... View more

@DalJeanis and @niketnilay, thank you very much. The tag in Simple XML was the trick. I also replace the stat command by table (duhhh). But I don't want dedup the output since each line is one process analyzed by oom-killer and it may be for different hosts. Another point is I am adding and subtracting 1s of the 2nd search because earliest and latest with the same value returns no data: index=os earliest=1499726450 latest=1499726450 No results found. ... View more

Yes I can, it is not about the duration, it is the "method" I used to pick the hours in the day: where date_hour>11 AND date_hour<15 Let's say the user pick 11pm to 1am (that is 2 hours of data per day during 7 days) The "equation" will be: where date_hour>22 AND date_hour<3 That will return 0 always. ... View more

It worked, Thank you very much I really appreciate it. ... View more

That worked, thank you very much: index=main sourcetype=app-gmr eventtype=start_job OR eventtype=end_job | table _time ssnservice eventtype jobId JobExecID | join jobId [ search index=main sourcetype=app-gmr INFO job read was already scheduled | rex field=_raw "]: {} (?.*) with id (?\d+) " ] | stats earliest(_time) as start latest(_time) as end by JobExecID |convert ctime(start) |convert ctime(end) Sorry to take advantage of you, I really appreciate your help. The output will have (obviously) the same time for start and end when there is no start_job or end_job records in the output, for example: 2258760 02/09/2017 03:02:30.352 02/09/2017 03:02:30.352 2258779 02/09/2017 02:59:30.369 02/09/2017 02:59:30.369 ... 2261282 02/09/2017 14:00:00.110 02/09/2017 14:00:00.110 2261296 02/09/2017 14:05:00.070 02/09/2017 14:05:00.070 Is there any way I could have NOT_STARTED or NOT_ENDED if there is no start_job or end_job records. This is way to advance to me and I am learning a lot. ... View more

ehudb, It worked fine: index=main sourcetype=app-gmr eventtype=start_job OR eventtype=end_job | table _time ssnservice eventtype jobId JobExecID | join jobId [ search index=main sourcetype=app-gmr INFO job read was already scheduled | rex field=_raw "\]: {} (?.*) with id (?\d+) " ] | **stats earliest(_time) as start latest(_time) as end** by JobExecID But how can I format the _time to "readable" value? I tried: index=main sourcetype=app-gmr eventtype=start_job OR eventtype=end_job | table _time ssnservice eventtype jobId JobExecID | join jobId [ search index=ssn sourcetype=app-gmr INFO job read was already scheduled | rex field=_raw "\]: {} (?.*) with id (?\d+) " ] | stats earliest(strftime(_time,"%F %H:%M:%S:%3N")) as start latest(strftime(_time,"%F %H:%M:%S:%3N")) as end by JobExecID But I got: ... View more

Kiran, You need to remove the spaces after < and before > it is some format issue in the post. ... View more