Hi, starting to explore what options are out there for setting up a "no brainer" type of kiosk solution to display Splunk dashboards, basically wall mounted big screen TV's throughout the office rotating through views. Any working solutions would be greatly appreciated. Thanks! ... View more

Hi, can't seem to figure out how to do this... I have the following table... Product Status Inventory Running Shipment catfood Red Yellow Green Red dogfood Green Red Yellow Green fishfood Red Green Yellow Red Essentially trying to get to a green yellow red colored chart, just the colors in the chart, of equal value, so they can be stacked - not the text. Thanks in advance.. Cheers. ... View more

Hi, multi value field called OverallStatus - states are On Track, Marginal, Critical. Another field ID, contains a unique value to count. | stats count(ID) AS Event count(eval(OverallStatus="On Track")) AS OnTrack count(eval(OverallStatus="Marginal")) AS Marginal count(eval(OverallStatus="Critical")) AS Red by Project ID Here is the metric: ( basically a Red - Yellow - Green ) Green = 80% or more projects are green and none are Red. Yellow = 70% - 79% projects are green or 1 – 20% are Red. Red = under 70% projects are green or over 20% are Red. I just can't get my head around the "IF" ... Really only need to show this back in a Red Yellow or Green. Any help or direction, would be greatly appreciated! Cheers... ... View more

Error in 'databasePartitionPolicy': Failed to read 1 event(s) from rawdata in bucket '_internal~235~8AD95516-6DE5-4CCF-82AA-19FD5902414E'. Rawdata may be corrupt, see search.log I poked around here, just want to be sure that whatever I do doesn't destroy my instance. Any direction/suggestions would be greatly appreciated. Cheers, ... View more

Hi, I have the following in a table that I'd like to do a rangemap on for each - same ranges, just want to do it all at once. 6/23 6/30 7/7 7/21 7/28 8/4 8/11 8/18 8/25 9/1 9/8 9/15 9/22 9/29 10/6 10/13 10/20 10/27 11/3 11/10 11/17 11/24 12/1 12/8 12/15 12/22 Green = between 32 and 44 Yellow = over 44 Red = less than 32 Any way to do this? Tried wildcarding the rangemap field= star/star "star/star" (asterisk does not work during the post) Any help would greatly appreciated. Cheers ... View more

Hi, for an up time report - currently stumped. A CSV log that contains a Time column - values formatted as: 1/01/2013 01:20 - three months worth of data, values typically every minute, a Status field contains - Success - Warning - Error, looking to do the following: Only interested in the time range of 08:00 to 17:00 Monday through Friday by the total number of hours in that particular month. Looking to sum out the Success - Warning - Error count by Month. Cheers, ... View more

I have a use case where a CSV in a shared location is being updated daily by project manager(s). I'm attempting to build a bar chart showing offset from today using the data (I've got the visual working). I'm only interested essentially in the absolute most recent state of what is in the CSV. If something is added, a field is manipulated, or deleted, I just want the current state of the CSV. Here's the current state of the search: [the indexed csv] | eval start=strptime(Start,"%m/%d/%Y") | eval from=now() | eval int=strptime(Initializing,"%m/%d/%Y") | eval plan=strptime(Planning,"%m/%d/%Y") | eval exec=strptime(Execution,"%m/%d/%Y") | eval close=strptime(Closing,"%m/%d/%Y") | eval S = start - from | eval I = int - from | eval P = plan - from | eval E = exec - from | eval C = close - from | eval iDays=I / 86400 | eval pDays=P / 86400 | eval eDays = E / 86400 | eval cDays=C / 86400| eval Now= start - from | eval today=Now / 86400 | rename today AS Now, iDays AS 1-Intializing, pDays AS 2-Planning, eDays AS 3-Execution cDays AS 4-Closing | table Project 4-Closing 3-Execution 2-Planning 1-Intializing | dedup Project Here is the format of the CSV: Project Start Initializing Planning Execution Closing 1 9/15/2012 10/1/2012 10/5/2012 6/30/2013 7/15/2013 2 11/20/2012 11/30/2012 12/31/2012 4/30/2013 5/15/2013 3 3/6/2013 3/15/2013 4/30/2013 6/30/2013 7/15/2013 4 3/6/2013 3/15/2013 4/30/2013 6/30/2013 7/15/2013 5 12/1/2012 12/3/2012 3/31/2013 5/31/2013 6/15/2013 6 3/1/2013 3/15/2013 4/30/2013 6/30/2013 7/15/2013 7 8/1/2011 8/15/2011 12/31/2012 5/31/2013 6/15/2013 8 3/1/2013 3/5/2013 6/30/2013 7/31/2013 8/15/2013 9 9/1/2012 10/1/2012 2/28/2013 4/7/2013 4/15/2013 10 10/1/2011 10/15/2011 9/1/2012 7/15/2013 8/30/2013 11 8/1/2011 8/15/2011 12/31/2012 5/31/2013 6/15/2013 12 3/1/2013 3/5/2013 6/30/2013 7/31/2013 8/15/2013 Thanks in advance... ... View more