I can't seem to post this as a comment above!!! So I have posted it in the answer below ... View more

tksm that works but now, how do I group them together, so they fill the grey space. Is this straightforward? tks ... View more

Thats it. That search works. Thanks very much. And apologies for the brutalness of my question!! Yes that is using the csv file. And it gives me this. value2replacelookup_RHS_2takenOut_CatchThis values(status) Aaaaa 200 Bbbbb 304 Ccccc 303 Not Resolved 400 404 But this works the same:(this is using the lookup I defined with the same csv file, but i have to use fillnull here) index=_internal sourcetype="splunk_web_access" | lookup ABasicLookupFoSplunkOnMyMachine_2takenOutButCatchThis_lookup value2lookup | fillnull value="Not Resolved" value2replacelookup_RHS_2takenOut_CatchThis | stats values(status) by value2replacelookup_RHS_2takenOut_CatchThis If i don't use fillnull I thought the min/max/default = 1/1/"CAT Undefined" would work but it does not seem to as it gives me this index=_internal sourcetype="splunk_web_access" | lookup ABasicLookupFoSplunkOnMyMachine_2takenOutButCatchThis_lookup value2lookup | stats values(status) by value2replacelookup_RHS_2takenOut_CatchThis value2replacelookup_RHS_2takenOut_CatchThis values(status) Aaaaa 200 Bbbbb 304 Ccccc 303 ... View more

index=_internal sourcetype="splunk_web_access" | lookup ABasicLookupFoSplunkOnMyMachine_2takenOutButCatchThis.csv value2lookup | fillnull value="Not Resolved" value2replacelookup | stats count by value2replacelookup gives me: value2replacelookup count Not Resolved 2658 index=_internal sourcetype="splunk_web_access" | lookup ABasicLookupFoSplunkOnMyMachine_2takenOutButCatchThis.csv value2lookup | fillnull value="Not Resolved" value2replacelookup | stats values(status) by value2replacelookup_RHS_2takenOut_CatchThis gives me(but it is not showing the undefined values) value2replacelookup_RHS_2takenOut_CatchThis values(status) Aaaaa 200 Bbbbb 304 Ccccc 303 ... View more

index=_internal sourcetype="splunk_web_access" | stats values(status) by value2replacelookup_RHS_2takenOut_CatchThis gives me: value2replacelookup_RHS_2takenOut_CatchThis values(status) Aaaaa 200 Bbbbb 304 Ccccc 303 I have remove these 2 lines from my lookup table that i uploaded to splunk Ddddd 400 Eeeee 404 So I want to somehow know that 400 and 404 are there. ... View more

not sure I follow? Do I use lookups here? ... View more

I can't get the lookup to work... but i have my search stats values(fieldName) by Category and this gives me something like: fieldName,Category fieldName1,Cat1 fieldName2,Cat2 fieldName3,Cat3 fieldName4,Cat4 but it is not picking up the fieldName5 that I want to show as CAT Undefined after doing what you said with the min/max/default. Am I doing something Wrong? So what I want to see is: fieldName,Category fieldName1,Cat1 fieldName2,Cat2 fieldName3,Cat3 fieldName4,Cat4 fieldName5,CAT Undefined ... View more

tks, perfect ... View more

you should define the "Default matches" to "Cat_Undefined", that will be the default value. How do i do this exactly? Is this somehow done when I am uploading my csv file with the lookups? tks ... View more

can i use wild cards in the case statement? e.g. system_type=case(system_id=="Linux*" OR system_id=="Unix*") ... View more

Tried both these and they did not work ... measInfoId=1174(40551) ... measInfoId=1174(40551 OR 40572 OR 90518) ... View more

this worked for me ... | stats dc(c*) look for fields beginning with c , ... | stats dc(c*) | transpose look for fields beginning with c , transpose just flips it Now what i want to know is how to insert row number when i flip it using transpose ? found it here ... | stats dc(c*) | transpose | streamstats count as row | fields row * ... View more

thanks, tried rename every which way but that way 🙂 you should edit your answer so i can accpet it or can i accept it as is? ... View more

tks, but splunk regex is different, or so it seems to me? I am looking for that field extractor but can't find the one that i have seen on previous versions, similar to this ... View more

does 8 search = 8 panels limit? or can you somehow reuse a search? In relation to earliestTime, what should I set it to? Using the sample data below, If i have more columns, does this mean I have to reduce the number of Time datapoints I can use? Is this what you are getting at? samle dataset Time, networkElement, column1,column2,...columnN 1 .... ... View more

see my EDIT1 above. If you could check my XML that would be great as I do not think that is it. ... View more

I have just got splunk on my machine. My indexing volume licence has expired but i can still do the below search. And i hope to document my workings here. I start with this search: index=_internal sourcetype="splunk_web_access" | eval limit=if(user=="admin",15000,if(user=="-",1000,"NULL"))| stats count(uri) as Usage max(limit) as Limit by user | eval percent=Usage/Limit*100 | eval limit4Graph=Limit-Usage | fields user Usage limit4Graph percent And this gives me a stats like this user Usage limit4Graph percent - 404 596 40.400000 admin 11076 3924 73.840000 Then I want to do a stacked chart in the visualisation tab and save it as a panel in a dashboard. have just added a css file and a js file here C:\Apps\Splunk\etc\apps\search\appserver\static the search directory is where I created the dashbaord. Now the hard part want to be able to have the percentage values as labels over the graph, using ramdaspr link text link .....will see how we go ... View more

To answer my own question, i think splunk puts evertting to fast mode in the dashboard. ... View more

| eval origfield="NENAME1/Some text:romc" | rex field=origfield ":(?[^:]+)$" tks very much, where can I play with rex insplunk so I can see what part of the field it is extracting? something like this ... View more

could not get that to work I was getting Error in 'rex' command: Encountered the following error while compiling the regex ':(?[^:]+)$': Regex: unrecognized character after (? or (?- ... View more