Hello everyone, I'd like to create a bottleneck graph. Basically, I'd like to use two files. One of the files is a recent file and the other is 7 days before the recent file. e.g. If I have 3files as below in one index, 1. 20181022.csv 2. 20181025.csv 3. 20181030.csv When I display the data on 2018/10/30... 2018/10/23 is 7 days before 2018/10/30. But, there isn't a file for that day. In that case, I'd like to use the file that is the nearest to 2018/10/23 within 7 days. So, I'd like to use the data of 20181030.csv file and 20181025.csv. When I display the data on 2018/10/25 It's the same way as above. 2018/10/18 is 7 days before 2018/10/25. But, there is no data for that date. So, I'd like to use the file 20181022.csv. This file is the nearest to 2018/10/18 within 7 days. How can I search for the file that is the nearest within 7 days before the recent file? The nearest file has to be within 7days. Please let me know how to do. I need search query. Thank you in advance. ... View more

hello everyone. I'd like to know what will happen if i exceed the license volume limit. After getting the warning how should i do? If I get the warning over 5 times, what will happen? can't i search anymore? or do i have to reset my license? now, my splunk version is 6.6.2. And I'd like to know what license volume is. e.g. I have a license 1GB / day. If I create two 500MB index, that is exceeded the limit? if it's not, how do i know how many data I used in a day? If you have a good search query or other way to check data, please let me know. ... View more

hello, every one I wrote like this in inputs.conf. [monitor:///home/ec2-user/aaa/] host = ip-10-0-0-xxx index = aaa whitelist = aaa[^/]*\.csv$ sourcetype = csv crcSalt = <SOURCE> [monitor:///home/ec2-user/bbb] host = ip-10-0-0-xxx index = bbb whitelist=bbb[^/]*\.csv$ sourcetype = csv crcSalt = <SOURCE> I can put the new data to 'aaa' index, but If i do as below process, I can't put the data to 'aaa' index. step 1. put the ' aaa_20181004.csv' to the aaa folder. This step is ok. (I can check the data in the aaa index) step 2. delete the 'aaa_20181004.csv' on the splunk . This step is ok. of course i deleted 'aaa_20181004.csv' on the aaa folder. step 3. put the ' aaa_20181004.csv' again to the aaa folder. - This step has problem. I can't read 'aaa_20181004.csv'' again even though there is ' aaa_20181004.csv' in the aaa folder. after step 3, There isn't aaa_20181004.csv' in the aaa index. how should I do. But If I do that process to bbb. all steps are fine. Just different thing is the contents of aaa and bbb. I'll put the file to folder daily.(aaa_20181003.csv , aaa_20181004.csv , aaa_20181005.csv ...) I'd like to know daily data. thank you in advance. ... View more

hello everyone I'd like to display multiple column headers on the table like the below image. I can create the table, but the problem is the column headers. It doesn't matter what color they are. I'd like to make just two rows as a column header. And, I'd like to make three groups on the first column header row. Please refer to attached image. I'm waiting for your information. Thank you in advance. ... View more

Hello everyone. I'd like to combine a column chart with an area chart. I attached an image of the graph that I want to create. I already know If I use the overlay option, I can merge it with a line chart. But in this case, I don't need a line chart. If you have a good idea , Please let me know that. Thank you in advance. ... View more

hello everyone, I'd like to know how to combine three types of charts in one chart. I'd like to make just one chart using column chart, line chart, area chart. I've known that if overlay option , two types of charts can combine in one chart. But I've never seen the chart that more than three types of charts are combined in one chart. I appreciate if you give me some information. Thank you in advance. ... View more