Is there any way the results of a normal search and threshold search can be combine and displayed in a single table on the dashboard ? The data i have is just 2 fields . Machine name and its problem machine1 - disk failure machine2 - virus failure machine 3 - cpu utlization 15% machine4 0- cpyu utlization 80% machine5 - ram crash I want the results to be displayed as below ignoring the machine with CPU with 15% utlization and only display machine with cpu utlization higher than 50% So the results of the table should be : machine1 - disk failure machine2 - virus failure machine4 0- cpyu utlization 80% machine5 - ram crash ... View more

I need a daily count of events of a particular type per day for an entire month June1 - 20 events June2 - 55 events and so on till June 30 available fields is websitename , just need occurrences for that website for a month ... View more

Please let me know as to how we run a schedule search and Set alert conditions for scheduled searches and sent results by mail Below are the fields. I want to be able to receive an alert when the CPU value cross 80 Servername: CPU usage : ... View more

is there a way to search for more than 1 eventtype for a single host and display the same in a stats table fields available are hostsname eventtype= eg disk full, disk crash, cpu high need to display all hosts which have more than 1 eventtype .eg a hostname with both cpu high and disk full ... View more

Hi guys need your help. is there a tool which can monitor and forward logs from windows 2000/2003 servers to Splunk? ... View more

I am trying to detect a virus outbreak in our network. Just want to check if 3 or more hosts have the same virusname in a subnet usually the first 24 bits match Fields available VirusName=conficker Host IP address=X.X.X.X ... View more

Need to find hosts where an event of a type was not followed by event of another type within an hour I need to find hosts where virus infection was detected and it failed to perform any action, where "None" is not followed up by of the other events " Blocked OR removed OR quarantined" in 1 hour Fields available are ComputerName= VirusName= Action Taken= Sample log 10/11/2014 20:01 : ComputerName=test1 VirusName=conficker ActionTaken=None 10/11/2014 20:02 "ComputerName=test1 VirusName=conficker ActionTaken=blocked 10/11/2014 22:01 : ComputerName=test20 VirusName=conficker ActionTaken=None 10/11/2014 20:01 : ComputerName=test30 VirusName=conficker ActionTaken=None 10/11/2014 20:02 "ComputerName=test30 VirusName=conficker ActionTaken=removed As you can seen above, no action was taken by antivirus on Computer test20. I need to write a search query to create a report or dashboard to find any such machine. Any pointers in the right direction would be appreciated ... View more