Or you can directly use the below app from Splunk Base https://splunkbase.splunk.com/app/4776/ ... View more

Hi All, I am using the below mentioned query in cluster maps visualization index=abc sourcetype=xyz:log| iplocation src| geostats count by src globallimit=0 Link to search drilldown is actually working for all the values not for the clicked value. Let me know if you need any additional details... ... View more

If you could give an example of what is in your lookup table for each one of the use cases, it would make it significantly easier to write a query that accomplishes your requirements. I believe I understand what you are asking for, but I need that example to create a query that accomplishes what you need. Thank you! ... View more

@manish_singh_777 Yes, You can use Splunk REST Api in python script to change dashboard permissions. ... View more

The code that you posted is broken. It has an unterminated case statement and mis-matched square brackets. It is hopelessly broken so we cannot help until you fix it. ... View more

Both solutions worked for me in the end - but this is a crazy amount of effort you put in to the answer so thanks for that, and exactly what I needed. ... View more

@lakshman239 We have installed "Qualys TA" in our HF instance, configured the credentials and data inputs for "fim events" but when we search the events in our search head it doesn't show up. We get this error message : [idx-123-abc.splunkcloud.com] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info. ... View more

@ Niketnilay Yes, am trying to show a single result in html , it could be Red, Amber or Green as per the current status that we would fetch from the query. ... View more

Hi Manish, there's currently no way to rename services or KPIs in bulk. ... View more

seems, something is missing in xyseries,, it is expecting one more field. Not sure what to enter there apart from _time and requests_per_sec ... View more

Use relative time to see the events for last 3 months and then use date_month to sort the events by month. Let me know if it works for you. ... View more

Even though, it is a good approach, there will be a lot of duplicated code anywere; furthermore you'll be getting rid of splunk's web functionalities as .pdf generators and alerting. So I would take a look at simple_xml_examples Splunk App sourcecodeviewer implementation. You could implement a simple template in a custom dashboards.js for a custom appnav bar, when still using default.xml appnav definition. ... View more

Actually its a query that is being sent as an alert. The query actually has some conditions that brings out those people whose booked hours is less than estimated for a particular month. It also has a supervisor column which is matched with their respective employee. Then i am trying to run this as an email alert. say like if my booked hours is less than the allocated then an email should be triggered to my supervisor saying that i have booked less hours.The email will not send any number related to hours. And this will not go as a pdf ... View more

Hi , We write "log file monitoring" path in "inputs.conf" stanzas only. ... View more

Oh I see.... ... View more

See docs on match() , it only takes two parameters: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/ConditionalFunctions#match.28SUBJECT.2C_.22REGEX.22.29 ... View more

I tried the same thing but it did not work for me. I was trying to play around with the splunk instance provided for trial. Can that be the cause of the issue? ... View more

hi 2 curves because I have 2 hosts: host="$field1$ and host="$field2$ i wrote this : index="windows-wmi" sourcetype="WMI:CPUload" host="$field1$" (Name="mfetp/" OR Name="mcshield/") Name=$Service$ | rex field=Name "^(?[^\/]+)[\/]" | eval key=Service."-".host | timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG, avg(PercentProcessorTime) as PercentProcessorTime_AVG by key | eval PercentProcessorTime_AVG =round(PercentProcessorTime_AVG,1) Is it correct?? Is someone could give me another solution with eval(avg(if.... please?? ... View more

Pls use append, if you want to pass the results of the subsearch to the main search. index=index1 type="example" | append [ search index=index2 type="other" | eval nowtime=_time | eval maxtime=_time+30 | fields user] | table user, nowtime, maxtime let me know if it works.. ... View more

Not the same scenario but I got the similar error / issue so below is how i got it and then how I resolved it. I was using a timestamp table coulmn in a calculation and using that calculation to create new column for rising column as follows (b was timestamp table coulmn): select a,b,extract(hour from b) as c from myTable where c > ? order by c asc Issue here was I cannot use an alias c in where clause, so db connect was giving me the error mentioned in question. This is how I resolved it by writing expression twice: select a,b,c from ( select a,b, extract(hour from b) as c from myTable ) where c > ? order by c asc ... View more

your answer solved my problem , except one mistake , "| where date_hourmin>=2200 OR date_hourmin<=400" ... View more

You should use a custom response handler. There are many examples that ship with the app in rest_ta/bin/responsehandlers.py Use these examples to create your own handler for your JSON format. You then declare this custom handler to be applied in your REST stanza setup. ie: ... View more

@jip31 My name is Anam and I am the Community Content Specialist for Splunk Answers. As @niketnilay mentioned earlier to you, refrain from accepting your own answers and please accept the answer that has worked for you in this question. You also accepted another one of your own answers in this question as well: https://answers.splunk.com/answers/669860/plus-and-minus-in-a-trend-calcul.html which was fixed. We have awesome contributors in this community and their effort should be appreciated and encouraged! ... View more

I'm sorry if my question is not very descriptive. Let me attempt to elaborate. I have a datamodel named MyDataModel. This datamodel includes the fields _value, time, _key, location. I would like to create a search that allows me to see all the fields in that particular data model (fields, _value, _key, location) vs all the fields in a specific data set (index=logix_logs) to see if there are any matches. The goal is to see if there are any fields in the datamodel that do not exist in the index=log_logs data set so that they can be created if need be. Hope that helps. ... View more

Are you trying to integrate any third party tool with Splunk? If yes then we have Splunk Add on Apps for Adddynamics , Solarwinds and could be more also.. ... View more