lpolo has the correct answer, but I thought I'd clarify a bit. The operators match criteria, so: AND - is used in the format if(id=? AND name=?,TRUE, FALSE) so both criteria, working on a boolean basis, should return 1, then it will carry on and return true. OR - is used in the format if(id=? OR name=?, TRUE, FALSE) so it will continue if either of the fields match What you're attempting to do, is to check if the ID matches, or the name matches, then you wish to display the ID and the Name, so you should be using the OR; index=yourindex id=? OR name=? | table _time, id, name Hope that cleared things up. ... View more

Hi PPape, you're absolutely right, that was a typo, it is indeed 500MB/day. I have used the trial before for my VM. Although, after checking it's actually a 60 day trial. Yes sorry, last time I used the trial was a long time ago!!! The trial is now limited to 500mb/day. Apologies for any confusion. ... View more

Hi Kevin, Please accept the answer supplied to assist other users in the community ... View more

PJB, I think the sort of thing you might look at doing is an Icon Only rangemap, which you can use to display a Red Amber Green status for all of the above tasks. if you can provide some example data, and exactly what you're comparing against, I'm sure, if not me, someone in the community will be able to provide you with some searches. ... View more

Hi Jamey, Once you download the trial, this is a 60 day enterprise trial, which allows full functionality and has an index limit of 500mb/day, after the 60 days you can purchase a license or downgrade to the free version, please see this link: https://www.splunk.com/en_us/products/splunk-enterprise/free-vs-enterprise.html On the free license there is a 500gb Limit / day, but you can obtain an enterprise license trial from Sales if you would like to see the benefits as the free license means you don't have to logon. But some aspects of PPape's response are correct, such as using the config files to index only the data you want. As PPape said; inputs.conf props.conf transforms.conf EDIT - Corrected facts based on http://www.splunk.com/en_us/download/splunk-enterprise.html - thanks to PPape for pointing this out ... View more

Thanks for your concern, but in the interest of simplicity, lets stop this argument as it's no longer required and will not be an advantage to users, the fact is no answers have been unnecessarily down voted. Anyway, good question I must say, I had the same issue on my dashboard. Similar numbers too. ... View more

Toby, thanks for you co-operation and you will be recognised for helping the community, please strive to achieve as many badges as you can, but just out of interest, how comes you only joined Splunk answers in jan 2015? ... View more

Toby, this answer has been proven by the documentation and thus so should not be down voted. In the interest of the community please remove your down vote or I will be forced to report you for false down voting. I accept you may see it as an alphanumeric value but alphanumeric is classed as a string in basic programming language, which you will notice once you have completed some training on the subject, Once you have achieved the same amount of gold badges as I have, then please don't hesitate to let me know and then I'll be happy to explain why it's classed as a string. So, last time, please remove your negative vote, as it might not have been the answer you was looking for, but it is a factually valid answer and can be used in the future by other users ... View more

I Appreciate your quote from Taken, credits to 20th century fox, but in the interest of helping the community, your behaviour on this site should reflect that as such to help the community by upvoting and accepting correct answers so that others who have similar questions can understand. The down vote is designed to show that an answer is not correct and should probably only be used in rare circumstances where a member of the community is inaccurate in their answer and you believe this could be misleading to any other user. ... View more

HI Toby, Documentation is based on how the coding behind Splunk works, in the event you wish to argue this, please contact Splunk support (support@splunk.com) who i'm sure will be able to clarify why this works for you, or if you believe their documentation is wrong, be able to discuss it. There is no room for disagreement and as such please remove your negative vote as it does not contribute to the community as they may believe it's not a correct answer, when in actual fact, it's factually correct. ... View more

Toby, I appreciate that Splunk allows you to do maths with the E in there. But by Documentation of the Eval command (http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Eval) Maths will be done with any Alphanumeric field (Does not need to be a Number), it will only error in the event it is a Non-Alphanumeric Field. ... View more

Hi Toby, Going by the definition of a "Number": a quantity or amount. Hence making your field an alphanumeric value, which is recognised as a string. Please remove your negative vote, as technically it is a valid answer. ... View more

No problem, always happy to help 🙂 (Where I can anyway 😛 ) ... View more

Sahoo, Please provide an accurate example of your logs otherwise it's impossible for the community to help you. You must give as much detail as possible in order for anyone to be able to give you an accurate solution to your issue. Especially when regex's are concerned as they are based on the strings you are looking for. ... View more

I'm not 100% sure what your custom app is expected to do, but I'll create an answer so you can accept it so that others know for the future. don't forget to vote up ... View more

I take it this is the standard search & reporting app? If so can you post some screenshots of when you created the dashboard and re-produce the steps so that we can see any mistakes that may have been made. Thanks ... View more

@MuS also, at the top of the page, it never seems to update? It's still showing 2 gold 6 silver and 11 bronze, which was quite a while back, and is not the same as whats shown on my profile page ... View more

No problem ... View more

I'm also interested in this solution, I've tried this before but in the end gave up. ... View more