Hello, I need to put together a report that involves counting certain characters in a field within Splunk. For instance, my query looks like "... | stats count by q". What I'm returned with the field "q" might look like either of the following: (summary:(superhydrophob*%20OR%20superoleophob*))%20AND%20(summary:(fabric%20OR%20hair%20OR%20skin))%20AND%20(publicationdate:[2007%20TO%202012]) %28summary%3A%28machine%20AND%20learning%20AND%20error%29%29%20AND%20%28publicationdate%3A%5B2007%20TO%202012%5D%29%20AND%20%28country%3AUS%29 Within those two results I'm interested in how many total colons there are, so because of HTML encoding I would be interested in both ":" as well as "%3A". So the total amount of characters with these two results that I would like to get back would be 6. Is there anyway I could do this within Splunk? Right now I have to export and use Excel, which is extremely time consuming. Any help would be greatly appreciated, thanks in advance. -Tyler ... View more

Every week I have a weekly report PDF sent out of our stats. Every week it sends out fine without any problems and I didn't change anything, but I got an error this week in the email: An error occurred while generating a PDF of this report: Failed to generate PDF: PDF server at /services/pdfserver/renderpdf returned error: Failed to generate a report using Firefox: Failed to start: Check that all Firefox dependencies are met Like I said, nothing was changed from last week when everything was fine. I've also tried to resend it several times and still get this same message. There are a few other reports that are sent out as well and those are actually sending out fine. Any ideas? Thanks in advance! ... View more

So I'm running a search that looks like this: (host="zakta01.inno-360.com" AND mwv-landscaping.inno-360.com AND "GET \/search" AND query=*) OR (host="web01.inno-360.com" AND source="/var/log/apache2/mwv_ssl_access.log" AND "/profile-services/talent") From that comes two fields that I'm interested in getting the stats for: 'query' and 'q'. So if I wanted to just get the stats for one of them i would do: ... | stats count by query My question is how would I combine them so I can get the stats for both 'query' and 'q' in one search? ... View more

So I'm trying to run a search in Splunk and have two fields combined to return one larger field. My basic search is: (host="web01.inno-360.com" AND source="/var/log/apache2/basf_ssl_access.log" AND "/profile-services/talent") OR (host="zakta01.inno-360.com" AND basf-landscaping.inno-360.com AND "GET /search" AND query=*) From that I'm interested in two fields: 1) 'query' 2) 'q'. I would like to combine these two fields to end with something like: ... | stats count by newField From searching I have tried using eval like this: ... | eval newField= query." ".q | stats count by newField However I've had absolutely no luck at all with this. Any help with this would be greatly appreciated. ... View more

I was curious if it is possible to insert your own values into a chart/table? For instance if I had a search that returned five different host names in a column and in the next column it had a number that represented something. Could I manually create a third column and insert values that I need? If so what would the script look like to do this? Thanks in advance! ... View more

So I'm trying to build a report that shows how many projects were created in the past week per customer and also in the same chart have the average number of projects that are created per customer (year to date). My query for finding out how many projects created in the past week is: host="web01.inno-360.com" AND source="/var/log/apache2/pg_ssl_access.log" OR source="/var/log/apache2/disney_ssl_access.log" OR source="/var/log/apache2/afrl_ssl_access.log" OR source="/var/log/apache2/genmills_ssl_access.log" OR source="/var/log/apache2/mwv_ssl_access.log" OR source="/var/log/apache2/lmco_ssl_access.log" OR source="/var/log/apache2/givaudan_ssl_access.log" AND /projects/create | stats count by source And my query for finding the average number of projects (per customer) created per week is: host="web01.inno-360.com" AND source="/var/log/apache2/pg_ssl_access.log" AND /projects/create earliest=@y@w | timechart span=1w count as "Projects Created" | eventstats avg("Projects Created") as "Average Projects per Week" My issue is that when I add other clients to the second query, it just gives me the average of all of them added together, and not individually. How would I get each client individually? And also once that is done how would I add that into the first query so I would have a report showing me each client's number of projects created per week along side the average amount for the year? Or if what I asked above isn't possible would it be possible to take the first query (which is the number of projects created per week) and then manually add the average number of projects created per week to the chart? Thanks in advance on any insight into this matter. ... View more