Hi @richgalloway thanks for your response, I tried narrowing it to 2 minutes by adding 'earliest=-2m latest=now()' to my search, i have set it to run every 1 minute and if the result is 0 the alert should trigger, but sometimes the alert is triggering even if the results is > 0, is this a problem on timing? note: the keyword is generated every 1 minute ... View more

It really depends on your timechart statement. Assuming that you measure instance1 and instance2 counts you can force both metrics to appear by adding | fillnull value=0 instance1 instance2 after your timechart statement. ... View more

Thanks @dwaddle, exactly what i needed :), had to set the normal SLA > 100, anything below that is abnormal and is show in the chart ... View more

I used WMI inputs to query performance counters (including the NSB ones) successfully. Example from http://blogs.splunk.com/2008/04/29/wmi-comes-to-splunk/ [WMI:LocalAllProcesses] namespace = \.\root\cimv2 interval = 30 wql = select * from Win32_PerfFormattedData_PerfProc_Process disabled = 0 I used the following steps: Discover the appropriate counter using 'CIM Studio' http://www.microsoft.com/en-us/download/details.aspx?id=24045 Test in a PowerShell prompt Get-WmiObject -Query "select * from Win32_PerfFormattedData_PerfProc_Process" Take exactly that query into your WMI input in Splunk. Sorry, I don't have the NSB specific example handy. ... View more

Yes. Like I said, you can set TIME_FORMAT . More information on this is available here: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Configuretimestamprecognition In your case the time format would be something like: TIME_FORMAT = %Y-%m-%d %H:%M:%S ... View more

I think the transaction command is what you are looking for. For example: "your_search_here" | transaction guid | table _time guid duration Will group the the search results based on guid and add a field called duration to every grouping of events. You will probably want to explore some of the options for tuning the transaction because it can be an expensive command on large datasets. You may also run into issues if guid is reused so you may want to limit how long you allow the transaction to stay open. http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Transaction ... View more