Hi, Just to be more explicit,  1. Try to get the local IP address of the computer running Splunk. From de CLI run ifconfig if you run a linux system or ipconfig if you run a windows System instead --- lets say the ip addres you got there is 192.168.100.3 2. Also try to know on witch port your splunk Enterprise is running--- Lets say 8000 3. Now from the remot machine, oppen your browser and enter: 192.168.100.3:8000 4. It's done.  ... View more

Hi, you can also extract each part of the field and then display only the maximum value: |rex field=ApplicationA "^(?P<m1>\d+)\.(?P<m2>\d+)\.(?P<m3>\d+)"|eventstats max(m1) as max_first_part|sort- m2|where m1=max_first_part|head 1 ... View more

Run your base search and save it as a report. Let say top_errors Reference your report like this: Search from report Original report Top Errors (Past 10 minutes) <search ref="top_errors" /> <!-- Modify time bounds --> <earliest>-10m</earliest> <latest>now</latest> </chart> </panel> <panel> <title>Modified time bounds and visualization</title> <chart> <title>Top Errors (Past 4 hours)</title> <search ref="top_errors"> <!-- Modify time bounds --> <earliest>-4h</earliest> <latest>now</latest> </search> <!-- Change visualization --> <option name="charting.chart">column</option> </chart> </panel> </row> </dashboard> ... View more

Reference a search from a report rom a report can help you: read it here: http://docs.splunk.com/Documentation/Splunk/6.4.0/Viz/Savedsearches thanks ... View more

Panels in the dashboard use a post-process search to further modify the results of a base search. The base search can be a global search for the dashboard or any other search within the dashboard. if you set a base search, both two panel will retrieve the results from the base search . ... View more

Hello! Add a query tag to reformat results from a base search in your panels: eg <table> <title>Top Errors (Past 10 minutes)</title> <search base="top_errors"> <query> search log_level=error | stats sum(count) as count </query> <earliest>-10m</earliest> <latest>now</latest> </search> </table> For more informations, read Post-process examples here: http://docs.splunk.com/Documentation/Splunk/6.4.0/Viz/Savedsearches thanks ... View more

Hello! Please let's get a sample of your events. Thanks ... View more

Try this with appedncols http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Appendcols index=calfile CALFileRequest.TPID=* CALFileRequest.SSN=* CALFileRequest.TransactionIdentifier=* | rename CALFileRequest.TPID AS TPID, CALFileRequest.SSN AS SSN, CALFileRequest.TransactionIdentifier AS TransID | where TPID!=SSN | table SSN TPID TransID | appendcols [search index=calfile \<CALFileResponse\> CALFileResponse.TransactionIdentifier=* _raw="*\<Street\>*" | rename CALFileResponse.TransactionIdentifier AS TransID, "CALFileResponse.CALFileData.Street" AS Street | table Street] thanks ... View more

Hello. Search the foo.csv lookup file (under $SPLUNK_HOME/etc/system/lookups or $SPLUNK_HOME/etc/apps//lookups). like this: | inputlookup foo.csv For more informations about the inputlookup command read this: http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Inputlookup Thanks ... View more

Hello! You must use the configuration bundle method. For more information read this first http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Managecommonconfigurations ant then read this: http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Manageappdeployment Thanks ... View more

Hi. You must edit outputs.conf configuration file on your forwarders. Read "Filter data by target index" here http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Routeandfilterdatad If any question, let know Thanks ... View more

Hello! Let's get a sample of your data please. ... View more

Hello! Did you check the timerange filter in the pivot ? ... View more

Hello! Did you nottice that your both search queries are different? ok.png is using the span=1m , but problem.png is not using it ... View more

Take this as an example. You can put your inputs.conf file in $SPLUNK_HOME$/etc/system/local [monitor://<path>] index = myindex sourcetype = mysourcetype ... <attrbute> = <val> <attrbute> = <val> ... View more

Thanks nfilippi. Was an error. ... View more

Hello. Please let see the search query you are using. ... View more

Hello, this is an example you can use: <input type="dropdown" token="operation" searchWhenChanged="true"> <label>Change the ticket status Update:</label> <choice value="Open">Open</choice> <choice value="Closed">Closed</choice> <default></default> <change> <condition value="Open"> <unset token="operation"></set> <set token="new_operation">mynewoperation</set> </condition> <condition value="Closed"> <unset token="operation"> </set> <set token="new_operation2"> mynewoperation2</set> </condition> </change> </input> ... View more

Hello. Try something like this: base search|eval couple=if((mailfrom="A" AND mailto="B") OR (mailfrom="B" AND mailto="A"),"AB",if((mailfrom="B" AND mailto="C") OR (mailfrom="C" AND mailto="B"),"BC",if((mailfrom="A" AND mailto="C") OR (mailfrom="C" AND mailto="C"),"AC",0)))|stats count by couple Thanks ... View more

Hello. In fact, you must install a Universal Forwarder (UF) on each of the 6000 workstations to get logs of each machine. But if you have a Windows Event Collectort Server, which collect logs of all the 6000 machines, you can install your UF on this machine if you like. For more informations about forwarding data, read here: http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Universalforwarderdeploymentoverview Thanks. ... View more

Hello. choose one or more fields in your event, and Add this attribute in your props.conf file, to tell Splunk to specify all such fields which constitute the timestamp TIMESTAMP_FIELDS = field1,field2,...,fieldn eg: TIMESTAMP_FIELDS = "Date Last Logged In" Thanks ... View more

Hello. Try like this; index=...... STATUS=*|stats count as Total_orders by _time|timechart span=1d Total_orders Thanks ... View more

Hello! Make this search on the receiver index=_internal and verify the number of hosts that you have, to know if data are comming from the forwarder. Thanks ... View more

Hello. This may help: http://docs.splunk.com/Documentation/6.3.1511/latest/Alert/Emailnotification Thanks ... View more