| makeresults | eval field2count = split("n,y,n,n,y,n,n,y,n,n,n,y",",") | mvexpand field2count | stats count(eval(field2count="n")) as n count(eval(field2count="y")) as y count(field2count) as total | eval n = round(n/total,3) *100, y = round(y/total,3) *100 | fields - total | transpose | rename column as field2count, "row 1" as total ... View more

While this works perfectly for any number within last 24 hours but when I change time to 7 days or something else, title shows the "...in the Custom time" Any fix for this ? ... View more

STEP: 1 From the search bar open service app and then find out window installer and start/restart it.   STEP: 2 Run cmd as an administrator and excute these commands one by one. msiexec /unreg msiexec /regserver regsvr32 vbscript.dll And then restart your system. I hope this on will help you... ... View more

Use this if you are working on Clustered environment  |  rest /services/authentication/current-context splunk-server=local  | table username  Use this if you are working on standalone environment |  rest /services/authentication/current-context  | table username ... View more

Hi, Folks. I'm sorry for necroing this post. I'm replying for other guys who would run into this question later. Ok, there seems to be a bit of misunderstanding on action field in index=_audit. There is a reason why we cannot do index=_audit action="login attempt" When you look closely the actual events: If the _raw says "... action=login attempt info=success ..." We get action=success If the _raw says "... action=login attempt info=failed ..." We get action=failure   So, yeah... In short, we do have those "login attempt" actions. It's just that we have underlying evals indicating whether the login action is a success or a failure. Cheers. ... View more

Man you just saved my life! ... View more

thanks, don't forget to vote. ... View more

your welcome, don't forget to vote ... View more

Hi simpkins1958, Try with this query, it work fine!!!! your base search...| rex newPhoneNumber=phoneNumber mode=sed "s/,/ /g" Eg: with this, 2,147,483,648 become 2 147 483 648 ... View more

hi, if your multiselect not populate, it means that the user that you entered in the textbox has no session_id, trying to get others users to see. precision, there or you wrote session_id = $session_id$ , remove and put just $session_id$ because prefix session_id= is already defined in multiselect. for the input text the user, remove <default>user1</default> and put <default>*</default> try and let me know if it works. please forgive my english. if it works, don't forget to vote my previous answers. ... View more

Just to update, if anyone want to move mutiple knowledge objects from one app to another then it'll be pain in Splunk WebGUI because you need to move knowledge object one by one, to simplified this I have created python script which uses Splunk REST API to move multiple knowledge objects https://github.com/harsmarvania57/splunk-ko-change (NOTE: Please use that script at your own risk :P) ... View more

Hi , Do you want me to add the new entries on those files in different location? Whenever we create the new index, it updates indexes.conf file with details right? I am seeing the entries under splunk_management_console folder indexes.conf file. so I've updated frozen time details there. I am scared to add all the entries to those indexes.conf file, in case if it creates any other issues. Please advise. Thanks! ... View more

Thank you @mjscoggins . It worked. C:\Program Files\Splunk\bin Follow this breadcrumb and click on splunk.exe will be able to login successfully. ... View more

https://docs.splunk.com/Documentation/SplunkCloud/latest/Service/SplunkCloudservice#Splunk_Cloud_service_limits_and_constraints I believe this implies that Splunk Cloud is running on a 32 core host(max_searches_per_cpu) + 6(base_max_searches) searches coming to a total of 38 concurrent searches per search head. You may also be eligible for a search cluster in Splunk Cloud at volumes of 1TB/day and higher (Check with your sales rep). Once on a search cluster which requires a minimum of 3 nodes, you should be able to run 3 x (38) or a total of 114 concurrent searches. By default Splunk cloud max_searches_perc will only let the scheduler use up to half of the 38 searches (19). You may be able to adjust that percentage upward if have fewer adhoc search users and wish to give the scheduler the ability to run more concurrent searches or lower the value to leave more adhoc searches for users. max_searches_perc = <integer> * The maximum number of searches the scheduler can run, as a percentage of the maximum number of concurrent searches, see [search] max_searches_per_cpu for how to set the system wide maximum number of searches. * Default: 50 ... View more

find the regular expression that returns the events of the index main I call regex1 . next try like this: 1-props.conf Add this stanza to $SPLUNK_HOME/etc/system/local/props.conf: [Event_By_Index] TRANSFORMS-index = override-index-by-host 2-transform.conf Add this stanza to $SPLUNK_HOME/etc/system/local/transforms.conf: [override-index-by-host] SOURCE_KEY = MetaData:Host REGEX = regex1 // regular expression that returns the events FORMAT = name_index // name of the index that will receive data DEST_KEY = _MetaData:Index ... View more

You can also find the version in splunk web. Help->About ... View more

To expand on this, since I recently ran into the very same issue. If you have a search time field extraction and an event that should contain the field but doesn't, you can't do a search for fieldname="" because the field doesn't get extracted if it's not there. But if you search for events that should contain the field and want to specifically find events that don't have the field set, the following worked for me (the index/sourcetype combo should always have fieldname set in my case): index=myindex sourcetype=mysourcetype NOT fieldname=* All of which is a long way of saying make sure you include search criteria that should always find events with that field set. ... View more

The search I posted in my answer below seems to show that the _indextime field doesn't mean that the particular event is available for search. For a couple of our base searches, the _indextime is never more than 2-3 seconds after the event time, but the most recent event available to a particular search can be 30+ seconds old. ... View more

16 EB - check ... View more

Somesh Thank You so much will try this and let you know ... View more

Hi, your table has how many values? because if your table has multiple values, then how will you proceed if these values do not relate to each other? ... View more

For your information, I removed Splunk Enterprise and Installed the free license version. Thanks ... View more

you are welcome ... View more

Try this index=_internal source=*license_usage.log type=usage |eval gb=round((b/1024/1024/1024), 2) | lookup index_name indexname AS idx OUTPUT baname | timechart usenull=f span=1d sum(gb) as total_usage by baname Above will give you the usage in GB spread across time window. If you still want this to be sorted on total_usage, then try below index=_internal source=*license_usage.log type=usage |eval gb=round((b/1024/1024/1024), 2) | lookup index_name indexname AS idx OUTPUT baname | timechart usenull=f span=1d sum(gb) as total_usage by baname|untable _time baname total_usage|sort - total_usage ... View more

@PowerPacked this is a very old question from 2016 to bump, however you should be able to apply table row coloring based on String values as well. Following is an olde answer of mine: https://answers.splunk.com/answers/581747/change-row-color-when-the-field-time-value-increas.html or https://answers.splunk.com/answers/583047/can-i-color-a-cell-based-on-condition.html You would need to ensure to add a setTimeout() function if you are running Splunk 6.6 or higher . Refer to another answer: https://answers.splunk.com/answers/614788/splunk-dashboard-examples-table-row-highlighting-b.html Finally also wanted to show you purely SimpleXML based approach for table row coloring based on expression colorPalette format.: https://answers.splunk.com/answers/820403/how-to-change-font-color-based-on-a-condition-for.html Please upvote the respective answer/s if you find them helpful 🙂 ... View more