Hey great rex, but the eval does not workwith a period, atleast it didnt for me. I replaced the period (pun) with a comma and it is now working   | eval src=replace(src,"\"","")  happy splunkin' pard 😁 ... View more

HI, Great write up...  One suggestion, one of your stats commands references the fields that are not available after your prestats command.    | tstats prestats=t max(object.field1) max(object.field2) from datamodel=foo | tstats prestats=t append=t max(object.field2) from datamodel=foo | stats max(field1) as maxField1 max(field2) as maxField2 Can you replace with this | tstats prestats=t max(object.field1) max(object.field2) from datamodel=foo | tstats prestats=t append=t max(object.field2) from datamodel=foo | stats max(object.field1) as maxField1 max(object.field2) as maxField2     Thanks,    ... View more

A macro is a rule that shows how a certain input should be mapped to a replacement output To expand a macro in splunk - use CTRL + SHIFT + e And to OP - drop_dm_object_name removes the leading stuff from a data model. DM fields (not index, host, sourcetype etc) but the ones you create as custom all have leading words infront of the field. In a typical authentication DM for example all the fields have a leading "Authentication." prefix. Authentication.user, Authentication.tag, Authentication.app etc. drop_dm_object just drops the "Authentication." part. Cheers     ... View more

You can drill down into the search, and just remove the last rename.  delete this  -  search_props.type as "Type" If you take that off it will work without error.  ... View more

Hi Shashank_87, I am not 100% sure if this is what you are looking for but check this run anywhere example... might get you started Its basically your search just adding the max value (of the hourly count) for that day next to the count per hour. I think this is what you are looking for. index=_* sourcetype=splunkd_ui_access uri="/en-US/app/search/ops_dc_status/_current" | stats count as TotalHitsPerHour by date_hour, date_mday, uri | eventstats max(TotalHitsPerHour) as maxDailyCt by date_mday, uri | table date_hour, date_mday, uri, TotalHitsPerHour, maxDailyCt Or try this example filled out for your usecase. index=test sourcetype=access_combined requested_content="/*" NOT (images OR js OR css OR png OR gif OR json OR jpg OR woff OR eot OR ico OR ttf OR svg OR pdf OR php OR jpeg OR txt) status=200 | stats count as Totalcount by date_hour, date_mday, req_content | eventstats maxTotalcount as PeakHourCount by date_mday, req_content | table date_hour, date_mday, req_content, Totalcount, PeakHourCount | sort - count limit=100 happy splunking! =) ... View more

The Last 2 fields should be lowercase rank's (not camelcase Rank). as the eval is creating a new field called "rank" | sort WHS, rank | fields - rank That being said DUDE ThAnKs! YoU ToTaLlY gOt Me WhAt I nEeDeD! =) UPVOTE HIS ANSWER PLZ! ... View more

Can you do this from SplunkWeb? The homies I am workin for went with SplunkCloud and no SSH access. I can put in a ticket, yadda yadda yadda - but asking if its possible. Seems the default setting should be "This apps" unless you are looking at "All configurations" page. Thanks in advance, ... View more

I found out why this is happening - though I do not have a good answer on how to fix. <-------basically the IIS log Starts at midnight (or your time setting)-------> ' #Software: Microsoft Internet Information Services 7.5 ' #Version: 1.0 ' #Date: 2015-06-03 00:00:00 ' #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken ' then log data occurs LOGS LOGS LOGS DATA HOST LATENCY YADDA YADDA ETC <-------later in the day the headers appear again-------> ' continued from above log data occurs LOGS LOGS LOGS DATA HOST LATENCY YADDA YADDA ETC Software: Microsoft Internet Information Services 7.5 Version: 1.0 <------- this is where the splunk forwarder parses the log and creates "Source type iis-# -------> Date: 2015-06-03 00:00:00 Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken ' continued from above log data occurs LOGS LOGS LOGS DATA HOST LATENCY YADDA YADDA ETC this will be the standard until a new IIS log is created - VICIOUS CYCLE REPEATS UNTIL ADMIN GOES CRAZY AND MOVES TO MEXICO ... View more

Im still a newb myself but try adding the disabled switch to your inputs.conf. [WinEventLog://Security] disabled = 0 index = windows [WinEventLog://Application] disabled = 0 index = windows [WinEventLog://System] disabled = 0 index = windows Also, you might want to make sure the outputs.conf is also configured too... example below. [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = YOURSPLUNKSERVER:PORT [tcpout-server://YOURSPLUNKSERVER:PORT] Hope this helps. Happy Splunking! =) ... View more

FYI ... I was also having some trouble with the 24 hour fixed time. I am editing the source code form a dashboard so I hope this helps I chose to go another route and it worked well for me. I made a timechart that would grab data for a specific 24 hour period (previous day hardcoded by earliest/latest time), and would bucket results in 5 minute buckets, fill the value null with "zero", do a fixed range (this is the command that makes the range fixed in that 24 hour period)... then the rest is just some fun custom stuff. color etc... You just need to replace the search, earliest/latest time, and max(XXX) to the custom field you are wanting to chart. <row> <panel> <title>TITLE OF CHART</title> <chart> <searchString> YOURSEARCH FOR SERVER/USER/FOO/BAR etc... earliest=3/12/2015:00:00:00 latest=3/13/2015:00:00:00 | bucket _time span="5m" | fillnull value=NoVal | timechart fixedrange=t span="5m" max(YOURFIELD) </searchString> <option name="rowNumbers">undefined</option> <option name="charting.chart">line</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.legend.placement">none</option> <option name="charting.seriesColors">[0x000000]</option> <option name="charting.drilldown">all</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.style">shiny</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> </chart> </panel> </row> For the same code just in a New search you can try this and click on visiualizations... YOUR SERVER/FOO earliest=3/12/2015:00:00:00 latest=3/13/2015:00:00:00 | YOUR CUSTOM FIELD ... | bucket _time span="5m" | fillnull value=NoVal | timechart fixedrange=t span="5m" max(YOURFIELD) Good luck ... View more

another example foo search ... source=WinEventLog:Security | yadda yadda yadda or the opposite foo search ... source!=WinEventLog:Security | yadda yadda yadda Its not easy to understand what people are saying when you are a newb as I am. ... View more

For the free version of Splunk the webconf is located here. $SPLUNK_HOME/etc/system/local/web.conf The setting below is the same. [settings] modify this updateCheckerBaseURL = http://quickdraw.splunk.com/js/ to updateCheckerBaseURL = 0 If this file does not exist just create a file called "web.conf" in the directory $SPLUNK_HOME/etc/system/local/web.conf Thanks for the correction to edit local (not default files). This is because when splunk upgreades the default files are overwritten. =) ... View more

Thanks Sideview, I appreciate the feedback. I am not new to Splunk, but I am new to the Splunk Development. Just a n00b getting to know the file system. =) Thanks again! ... View more