Hey great rex, but the eval does not workwith a period, atleast it didnt for me. I replaced the period (pun) with a comma and it is now working   | eval src=replace(src,"\"","")  happy splunkin' pard 😁 ... View more

HI, Great write up...  One suggestion, one of your stats commands references the fields that are not available after your prestats command.    | tstats prestats=t max(object.field1) max(object.field2) from datamodel=foo | tstats prestats=t append=t max(object.field2) from datamodel=foo | stats max(field1) as maxField1 max(field2) as maxField2 Can you replace with this | tstats prestats=t max(object.field1) max(object.field2) from datamodel=foo | tstats prestats=t append=t max(object.field2) from datamodel=foo | stats max(object.field1) as maxField1 max(object.field2) as maxField2     Thanks,    ... View more

@Jishnukn10 -  Search macros in Splunk are reusable chunks of Search Processing Language (SPL) that you can insert into other searches. It's enclosed within acute/back quotes `macro_name` on your search like  `drop_dm_object_name(field)`. You can see these macros in Splunk and define them under Settings > Advanced Search > Search Macros. All about macros here :  Use search macros in searches - Splunk Documentation Hope this helps.  ... View more

You can drill down into the search, and just remove the last rename.  delete this  -  search_props.type as "Type" If you take that off it will work without error.  ... View more

@kristian_kolb  LOL this comment made my day 8 years later -Marco ... View more

@Keysofsandiego Hey, let me know if you can help me with the query please. ... View more

The Last 2 fields should be lowercase rank's (not camelcase Rank). as the eval is creating a new field called "rank" | sort WHS, rank | fields - rank That being said DUDE ThAnKs! YoU ToTaLlY gOt Me WhAt I nEeDeD! =) UPVOTE HIS ANSWER PLZ! ... View more

Can you do this from SplunkWeb? The homies I am workin for went with SplunkCloud and no SSH access. I can put in a ticket, yadda yadda yadda - but asking if its possible. Seems the default setting should be "This apps" unless you are looking at "All configurations" page. Thanks in advance, ... View more

Marklar Marklar!! ... View more

FYI ... I was also having some trouble with the 24 hour fixed time. I am editing the source code form a dashboard so I hope this helps I chose to go another route and it worked well for me. I made a timechart that would grab data for a specific 24 hour period (previous day hardcoded by earliest/latest time), and would bucket results in 5 minute buckets, fill the value null with "zero", do a fixed range (this is the command that makes the range fixed in that 24 hour period)... then the rest is just some fun custom stuff. color etc... You just need to replace the search, earliest/latest time, and max(XXX) to the custom field you are wanting to chart. <row> <panel> <title>TITLE OF CHART</title> <chart> <searchString> YOURSEARCH FOR SERVER/USER/FOO/BAR etc... earliest=3/12/2015:00:00:00 latest=3/13/2015:00:00:00 | bucket _time span="5m" | fillnull value=NoVal | timechart fixedrange=t span="5m" max(YOURFIELD) </searchString> <option name="rowNumbers">undefined</option> <option name="charting.chart">line</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.legend.placement">none</option> <option name="charting.seriesColors">[0x000000]</option> <option name="charting.drilldown">all</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">false</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.style">shiny</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> </chart> </panel> </row> For the same code just in a New search you can try this and click on visiualizations... YOUR SERVER/FOO earliest=3/12/2015:00:00:00 latest=3/13/2015:00:00:00 | YOUR CUSTOM FIELD ... | bucket _time span="5m" | fillnull value=NoVal | timechart fixedrange=t span="5m" max(YOURFIELD) Good luck ... View more

I found out why this is happening - though I do not have a good answer on how to fix. <-------basically the IIS log Starts at midnight (or your time setting)-------> ' #Software: Microsoft Internet Information Services 7.5 ' #Version: 1.0 ' #Date: 2015-06-03 00:00:00 ' #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken ' then log data occurs LOGS LOGS LOGS DATA HOST LATENCY YADDA YADDA ETC <-------later in the day the headers appear again-------> ' continued from above log data occurs LOGS LOGS LOGS DATA HOST LATENCY YADDA YADDA ETC Software: Microsoft Internet Information Services 7.5 Version: 1.0 <------- this is where the splunk forwarder parses the log and creates "Source type iis-# -------> Date: 2015-06-03 00:00:00 Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken ' continued from above log data occurs LOGS LOGS LOGS DATA HOST LATENCY YADDA YADDA ETC this will be the standard until a new IIS log is created - VICIOUS CYCLE REPEATS UNTIL ADMIN GOES CRAZY AND MOVES TO MEXICO ... View more

Please do not change files in the system/default location. use system/local instead. ... View more