Hi chanduira, I think that you can't do it on splunk web. It is only possible using transforms.conf. Follow also the link : This will help you! https://answers.splunk.com/answers/317952/set-wildcard-lookup-match-without-access-to-transf.html ... View more

This is because you search through many application-logs. Follow link to have information about tag: http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Defineandusetags ... View more

In this case, you will give message like the name of your tag ... View more

Although all the different application-logs are not constructed in the same way, you can extract individually " error" message in each application and then use the tag concept to name them the same way . ... View more

Hi edwinmae, I think that It is normal that the error message is missing ,because your results ( index=*_application sourcetype=* source=* host=* Error | top limit=20 host sourcetype source ) displayed in the form of table. you can click on Events tab to review error in events. Assure you that you are in Verbose mode before run your search query. So no problem! Your result matches the events that contain the error message. Note: Although all the different application-logs are not constructed in the same way, you can extract individually " error" message in each application and then use the tag concept to name them the same way . Link for tag concept: http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Defineandusetags ... View more

Hi dlespron, If i understand your problem well,there is a concept of Row Grouping in simplexml. Here is an example of a row with one panel which has two visualizations in it. <dashboard> <row grouping="2"> <chart> ... </chart> <single> ... </single> </row> </dashboard> Just apply to your dashboard view. ... View more

Hi HattrickNZ, Please,You have forget to accept my answer! This work fine. ... View more

Hi simpkins1958, Try with this query, it work fine!!!! your base search...| rex newPhoneNumber=phoneNumber mode=sed "s/,/ /g" Eg: with this, 2,147,483,648 become 2 147 483 648 ... View more

Thanks vrmandadi, I see that you sent me also points. You could also do it by just vote has left my response ... View more

Hi splunker9999, Try to follow the link https://answers.splunk.com/answers/6505/how-to-make-my-custom-dashboard-the-default-screen-when-users-log-into-splunk.html I think is that you want!! ... View more

If i understand, try this: (index="Index1" ip1=*) OR (index="Index2" ip2=*) |where (ip1=ip2) |table ip1 ip2 ... View more

Hi vinay_kadagave, Try to run queries like follow depend you: index=Index1 | chart count by ip1 | join ip1 type=outer [ search index=Index2 | fields ip2 | rename ip2 as ip1 ] Or try (index="Index1" ip1=*) OR (index="Index2" ip2=*) | eval ip=if(isnull(ip2),ip1,ip2) | fields index ip | chart count(ip) AS count over ip by index | where Index1=Index2 ... View more

Hi Cvetanga, If you are in splunk free, there is no authentication available in the Free version, so no password can be set. You may use firewalls and/or proxies to limit access to Splunk instead. on the other hand, you can use the command line like follow if you want to change an admin user password: ./splunk edit user admin -password newPassword -role admin -auth admin:changeme This command changes the admin password from changeme to newPassword . Note that the passwords with special characters that would be interpreted by the shell (for example $ or !) must be either escaped or single-quoted: ./splunk edit user admin -password 'newpass$' -role admin -auth admin:changeme or ./splunk edit user admin -password 'newpass\$' -role admin -auth admin:changeme You can also follow the link: https://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password.html or https://answers.splunk.com/answers/778/how-can-i-change-the-admin-password-before-splunk-is-started-the-first-time.html This will help you. ... View more

Hi vrmandadi, Try to verify if your role have not the search restrictions and see explanation to monitor this by follow the link: http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Addandeditroles ... View more

Hi syjayaraj, remove your csv file returns to delete the data therein. In the search bar, you can use delete operator . To do this, your role must have the capability to do so. If you are an admin user, you must go add can_delete role because admin role don't have it by default. After to this, run a search that returns events of your csv file like follow: source= (name_of_your_file.csv) OR (Path/../ name_of_your_file.csv)|delete This will remonve all data in your csv file For more Explanation follow the link: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk#Delete_events_from_future_searches I think that to see where your csv file is located, go to opt/Splunk/var/lib/splunk/defaultdb/db/hot_v1_0/rawdata if you use default index to index your file. Note: hot_v1_0 is newsly created directory. follow opt/Splunk/var/lib/splunk/your_index_nama/db/hot_v1_0/rawdata for for your particular index. ... View more

Hi paola92, Try to follow the link for more explanation: https://answers.splunk.com/answers/126772/how-many-users-can-access-a-dashboard.html ... View more

Hi IRHM73, Try this: | set intersect [search index=_audit action=edit_user operation=edit OR operation=create |rename object as user |eval timestamp=strptime(timestamp, "%m-%d-%Y %H:%M:%S.%3N") |convert timeformat="%d/%b/%Y" ctime(timestamp) |stats max(timestamp) as "created" by user |join user [|rest /services/authentication/users splunk_server=local |fields title |rename title as user] ] [ search index=_audit action="login attempt" | stats max(timestamp) as _time by user, sourcetype ] | where isnull(sourcetype) | fields - sourcetype] ... View more

Hi manhuang, Try this index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40 |appendcols [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2] |appendcols [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8] ... View more

Hi cusello, tsidx is an file or index? If you want to delete this logs, try to run a search who will displays you your logs and delete them after like follow link: http://docs.splunk.com/Documentation/Splunk/4.1/Admin/RemovedatafromSplunk use the delete operator, run a search that returns the events you want deleted. Make sure that this search returns ONLY events you want to delete, and no other events. For example, if you want to remove the events you've indexed from a source called /fflanda/incoming/cheese.log so that they no longer appear in searches, do the following: Disable or remove that source so that it no longer gets indexed. Search for events from that source in your index: source="/fflanda/incoming/cheese.log" Look at the results to confirm that this is the data you want to delete. Once you've confirmed that this is the data you want to delete, pipe the search to delete: source="/fflanda/incoming/cheese.log" | delete ... View more

Hi proylea, I apologize because I have made ​​a mistake . Indeed , I forget to remove the $ in mark : <set token=$> and <unset token=$> The source code will have to be rather like this: <input type="dropdown" token="submitted:StarId" searchWhenChanged="true"> <label>Run query</label> <choice value="1">No</choice> <choice value="2">Yes</choice> <default>1</default> <change> <condition value="1"> <unset token="submitted:StarId"></unset> </condition> <condition value="2"> <set token="submitted:StarId">dbxquery</set> </condition> </change> </input> <panel depends="$submitted:StarId$"> <table> <title>Trade detail</title> <option name="showPager">true</option> <option name="count">10</option> <drilldown target="_trade"> <link> <![CDATA[ /app/eproduct/order_detail?earliest=$row.earliest$&latest=$row.latest$&clOrdId=$row.StarID$ ]]> </link> </drilldown> </table> </panel> Thanks for your remark. ... View more

Hi IRHM73, Try to remove <search> </search> and write only: <searchTemplate>|rest /services/search/jobs |search NOT (author="splunk-system-user" OR author="monitoring") |search title!="" |search author =$author$ |addtotals fieldname=duration *duration_secs |convert rmunit(duration) as numSecs |eval stringSecs=tostring(duration,"duration") |eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3s") |rex field=stringSecs "\.(?<ms>\d{2})" | rex field=stringSecs "(?<myRest>.+)s\." |eval stringSecs=myRest. "s " .ms. "ms" |eval NoOfDays=floor((searchLatestTime-searchEarliestTime)/(3600*24)) |where NoOfDays>=90 |eval earliestTime=strptime(earliestTime, "%Y-%m-%dT%H:%M:%S") |convert timeformat="%d/%b/%Y" ctime(earliestTime) |eval latestTime=strptime(latestTime, "%Y-%m-%dT%H:%M:%S") |convert timeformat="%d/%b/%Y" ctime(latestTime) |eval daterange= "From: ".earliestTime.", To: ".latestTime |makemv delim=", " daterange |sort +author |table author eai:acl.app title daterange NoOfDays stringSecs |rename author as "Search Author", eai:acl.app as "App Used", title as "Query", daterange as "Query Date Range", NoOfDays as "Query Date Range (Days)", stringSecs as "Query Runtime" </searchTemplate> ... View more

Hi taracksinha, Try to follow the link: https://answers.splunk.com/answers/168898/how-can-we-find-all-the-searches-alerts-dashboard.html this could help you! ... View more