Try double escaping like so: "\\w+\\.\\w+\\?ACTION=.*" ... View more

Splunk can automatically extract field=value pairs. so if you have timestamp field1=value1 field2=value2 and so on ... splunk would automatically do the extraction for you. Naturally this only works if you have control over the logging format. If that is not in your hand (log format), you could try using the interactive field extractor to specify simple regex based extraction for your fields. ... View more

Have you looked at the diff command? More information at the following link: http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Diff Also, since you are at it, you could use the set command if you want union, difference, or intersection of two searches. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Set ... View more

Have you looked at this approach? Might be what you are looking for. http://answers.splunk.com/answers/7556/timechart-how-do-i-combine-these-two-charts-into-one.html ... View more

isn't the 'if statement' unnecessary if you are already using the drop down selection? Assuming your drop down selection is working, why won't this work for you? index=$index$ build=$build$ | ... ... View more

were you able to fix this? ... View more

Do you always have to extract the same portion? (000198799600) Do you have more sample data? ... View more

have you tried this rex max_match=2 field=_raw " (?i)(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})*" with max_match parameter set to 2 as mentioned in this http://answers.splunk.com/answers/47381/how-to-extract-all-matching-values-from-an-event-using-regex.html ... View more

hodor also sample data. ... View more

you could pipe your rangemap logic before the table command. It should work. ... View more

It will return average of your load average.... on second thoughts (and further reading of the documentation!), May be what you need is the xyseries. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xyseries You may have to create a dummy field with the Y-axis label like so: ... | eval y_field = "load_times" | xyseries date_time y_field, load_time I haven't used this but I have a feeling this will suit your case. ... View more

Have you tried using some other name instead of Value (say avg_time_taken or so)? ... View more

have you looked at this answer? http://answers.splunk.com/answers/37896/date-without-year-wrong-index.html ... View more

Have you tried adding an index =[your index] line to the inputs.conf file on your forwarder? ... View more

First off, any modifications should be made in local folder. So you need to copy your views to Splunk//etc//apps//My_App_Name//local//data//ui//views Secondly, you must specify navigation for your views in a separate xml in the following path. Splunk//etc//apps//My_App_Name//local//data//ui//nav//default.xml the nav xml will be of this form: <nav search_view="search" color="#0072c6"> <view name="your first view" default='true' /> <view name="your second view"/> </nav> and so on. Also, this will create a menu item for each view that you specify. You can group them using collections keyword in your navigation xml. You can lookup the documentation for that. Having said so, this copies all views in to a single application( and not individual dashboards). Hope this helps. ... View more

How did you try to copy the dashboard? ... View more

I just went by your requirement. Just read up the documentation about appendcols and join. Specifically, appendcols synopsis states that it "Appends the fields of the subsearch results to current results, first results to first result, second to second, etc." In your case, the subsearch returns just one event (the total stats count), and that is why it was getting appended to only one event from your main search. In case of join, all events are combined based on common field (if none specified)... Hope this helps. ... View more

Any particular reason why it won't work. May be we can help you with that. ... View more

Copy/Paste the relevant dashboard xml code (from the source apps) to the xml in your app. ... View more

Try this instead: index=myindex sourcetype="mysource" ""$token$"" ""$token2$"" | rex "(?i)(?P[^<]+)" | search tracktrace ="*" | rex "(?i)(?P[^<]+)" | table myvalue I am assuming token and token2 are populated properly and the rex extraction is named tracktrace. I forgot to add tracktrace="*" in the previous comment. ... View more