Hi, I have a kvstore defined based on a collection collections.conf [app2] transforms.conf [business_id2] collection = app2 external_type = kvstore fields_list = _key, LAST_UPD, MY_TIME, PROPERTY, ROW_ID, TYPE, VALUE max_matches = 1000 min_matches = 0 min_offset_secs = 0 time_field = MY_TIME I also have another lookup table that has the exact same results BUT IS NOT A KVSTORE (it is file-based): [Business_ID] filename = Business_ID.csv max_matches = 1000 min_matches = 0 min_offset_secs = 0 time_field = MY_TIME time_format = %Y-%m-%d %H:%M:%S When doing something like index=A | lookup business_id2 ROW_ID OUTPUT VALUE I get no VALUE column. When doing: index=A | lookup Business_ID ROW_ID OUTPUT VALUE I get the VALUE column.... SO it seems a KV Store doesn't have Time Based capability... it it true? Thanks ... View more

Hello, My problem is simple to explain: I have an app that generates logs that are written whenever a new action is performed. The problem is, when the session is over, the first line of that log is changed to include the close time of the session, which makes splunk REINDEX everything on the log. Any ideas? Thanks ... View more

I have splunk 6. I created an Index, and I have a conection to the database which is working as fine as I'm able to use dbquery and so. Still when I try to index files from the database, it does not index it. What could be the problem? Thank you ... View more

Hello. I need to calculate statistics like Avg, Count, from the past two weeks period. What I want to do next is to check if the same measure in the days AFTER those two weeks are above it or not. I Can't figure out if it is a join, append or something else to write... Here is what I've got: index="pt_app_siebel" SWEMethod="ReconfigureCXProd" starttime=8/25/2013:00:00:00 latest=-24h date_wday=friday date_hour=15 | eventstats perc25(executiontime) as Q1Tempo, perc75(executiontime) as Q3Tempo | eval lim1=Q3Tempo+3*(Q3Tempo-Q1Tempo) | eval lim2=Q3Tempo+6*(Q3Tempo-Q1Tempo) | eval lim3=Q3Tempo+10*(Q3Tempo-Q1Tempo) | eval Performance=case(executiontime>lim3,"High_Alert",executiontime>lim2,"Mid_Alert",executiontime>lim1,"Low_Alert",executiontime<lim1,"OK") | eval Low=if(executiontime>lim1 AND executiontime<lim2,1,0) | eval Mid=if(executiontime>lim2 AND executiontime<lim3,1,0) | eval High=if(executiontime>lim3,1,0) | eval OutQ=if(executiontime>lim1,1,0) | stats avg(OutQ) as AvgOut,avg(Low) as AvgLow, avg(Mid) as AvgMid,avg(High) as AvgHigh Now I want to get those Avg and see where executiontime in the period index="pt_app_siebel" SWEMethod="ReconfigureCXProd" starttime=9/6/2013:00:00:00 latest=now date_wday=friday date_hour=15 is going. Can you help please? Thank you ... View more