Hi chanduira, I think that you can't do it on splunk web. It is only possible using transforms.conf. Follow also the link : This will help you! https://answers.splunk.com/answers/317952/set-wildcard-lookup-match-without-access-to-transf.html ... View more

This is because you search through many application-logs. Follow link to have information about tag: http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Defineandusetags ... View more

In this case, you will give message like the name of your tag ... View more

Although all the different application-logs are not constructed in the same way, you can extract individually " error" message in each application and then use the tag concept to name them the same way . ... View more

Hi edwinmae, I think that It is normal that the error message is missing ,because your results ( index=*_application sourcetype=* source=* host=* Error | top limit=20 host sourcetype source ) displayed in the form of table. you can click on Events tab to review error in events. Assure you that you are in Verbose mode before run your search query. So no problem! Your result matches the events that contain the error message. Note: Although all the different application-logs are not constructed in the same way, you can extract individually " error" message in each application and then use the tag concept to name them the same way . Link for tag concept: http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Defineandusetags ... View more

Hi dlespron, If i understand your problem well,there is a concept of Row Grouping in simplexml. Here is an example of a row with one panel which has two visualizations in it. <dashboard> <row grouping="2"> <chart> ... </chart> <single> ... </single> </row> </dashboard> Just apply to your dashboard view. ... View more

Hi HattrickNZ, Please,You have forget to accept my answer! This work fine. ... View more

Hi simpkins1958, Try with this query, it work fine!!!! your base search...| rex newPhoneNumber=phoneNumber mode=sed "s/,/ /g" Eg: with this, 2,147,483,648 become 2 147 483 648 ... View more

Thanks vrmandadi, I see that you sent me also points. You could also do it by just vote has left my response ... View more

Hi splunker9999, Try to follow the link https://answers.splunk.com/answers/6505/how-to-make-my-custom-dashboard-the-default-screen-when-users-log-into-splunk.html I think is that you want!! ... View more

If i understand, try this: (index="Index1" ip1=*) OR (index="Index2" ip2=*) |where (ip1=ip2) |table ip1 ip2 ... View more

Hi vinay_kadagave, Try to run queries like follow depend you: index=Index1 | chart count by ip1 | join ip1 type=outer [ search index=Index2 | fields ip2 | rename ip2 as ip1 ] Or try (index="Index1" ip1=*) OR (index="Index2" ip2=*) | eval ip=if(isnull(ip2),ip1,ip2) | fields index ip | chart count(ip) AS count over ip by index | where Index1=Index2 ... View more

Hi Cvetanga, If you are in splunk free, there is no authentication available in the Free version, so no password can be set. You may use firewalls and/or proxies to limit access to Splunk instead. on the other hand, you can use the command line like follow if you want to change an admin user password: ./splunk edit user admin -password newPassword -role admin -auth admin:changeme This command changes the admin password from changeme to newPassword . Note that the passwords with special characters that would be interpreted by the shell (for example $ or !) must be either escaped or single-quoted: ./splunk edit user admin -password 'newpass$' -role admin -auth admin:changeme or ./splunk edit user admin -password 'newpass\$' -role admin -auth admin:changeme You can also follow the link: https://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password.html or https://answers.splunk.com/answers/778/how-can-i-change-the-admin-password-before-splunk-is-started-the-first-time.html This will help you. ... View more

Hi vrmandadi, Try to verify if your role have not the search restrictions and see explanation to monitor this by follow the link: http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Addandeditroles ... View more

Hi syjayaraj, remove your csv file returns to delete the data therein. In the search bar, you can use delete operator . To do this, your role must have the capability to do so. If you are an admin user, you must go add can_delete role because admin role don't have it by default. After to this, run a search that returns events of your csv file like follow: source= (name_of_your_file.csv) OR (Path/../ name_of_your_file.csv)|delete This will remonve all data in your csv file For more Explanation follow the link: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk#Delete_events_from_future_searches I think that to see where your csv file is located, go to opt/Splunk/var/lib/splunk/defaultdb/db/hot_v1_0/rawdata if you use default index to index your file. Note: hot_v1_0 is newsly created directory. follow opt/Splunk/var/lib/splunk/your_index_nama/db/hot_v1_0/rawdata for for your particular index. ... View more

Hi paola92, Try to follow the link for more explanation: https://answers.splunk.com/answers/126772/how-many-users-can-access-a-dashboard.html ... View more

Hi IRHM73, Try this: | set intersect [search index=_audit action=edit_user operation=edit OR operation=create |rename object as user |eval timestamp=strptime(timestamp, "%m-%d-%Y %H:%M:%S.%3N") |convert timeformat="%d/%b/%Y" ctime(timestamp) |stats max(timestamp) as "created" by user |join user [|rest /services/authentication/users splunk_server=local |fields title |rename title as user] ] [ search index=_audit action="login attempt" | stats max(timestamp) as _time by user, sourcetype ] | where isnull(sourcetype) | fields - sourcetype] ... View more