Create a summary index which you add to every month then query that index for longer periods ... View more

I assume you're wanting to create a custom table and not the Inline Table. The Splunk sendemail.py script will escape any html you write in the Message form, so it will all appear as text in the email body. There have been threads on this topic before, but I don't remember ever seeing a simple solution. ... View more

this only deltes my values() command. But i want the values.. should look like something like this src | src_host | dest | domain 10.0.0.2 | hostxy1 | 8.8.8.8 | google.com 10.0.0.7 | N/A | | 10.0.0.11 |N/A | 8.8.8.8 | example.com 10.0.0.21 | hostxy21 | 9.9.9.9 | ... View more

Hi @igschloessl, Check this https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/DashboardPDFs#Schedule_PDF_delivery_of_a_dashboard ... View more

Hi @igschloessl, let me understand, you scheduled your report fo tomorrow and you would see it today? if this is your need, schedule it not so far, e.g. in the next 5 minutes, so after completion, give it the correct scheduling. So you have it today and you'll have a new run every day. Ciao. Giuseppe ... View more

I had to to the following step Click chart overlay and Click the text box and select Total field. There was the wrong field selected. Thank you very much. ... View more

The core answer is solid, so do the standard debugging. Remove pipelines from the bottom, one at a time, until you get results that make sense. Then start adding back in the pipelines, fixing the obvious mistakes. ... View more

Thank you. I tried to do a summary with appendcols index=_internal sourcetype=scheduler earliest=-7d@d latest=-0d@d | eval period="-7d" | stats count min(result_count) as min_result_count max(result_count) as max_result_count avg(result_count) as avg_result_count by savedsearch_name app period | eval avg_result_count= round(avg_result_count,2) | table savedsearch_name app period min_result_count max_result_count avg_result_count count | appendcols [search index=_internal sourcetype=scheduler earliest=-14d@d latest=-7@d | eval period= "-14d" | stats count min(result_count) as min_result_count max(result_count) as max_result_count avg(result_count) as avg_result_count by savedsearch_name app period | eval avg_result_count= round(avg_result_count,2) | table savedsearch_name app period min_result_count max_result_count avg_result_count count ] | appendcols [search index=_internal sourcetype=scheduler earliest=-21d@d latest=-14@d | eval period= "-21d" | stats count min(result_count) as min_result_count max(result_count) as max_result_count avg(result_count) as avg_result_count by savedsearch_name app period | eval avg_result_count= round(avg_result_count,2) | table savedsearch_name app period min_result_count max_result_count avg_result_count count ] But this does not work. And I dont know how to alarm if the counts are highly different from the weeks before. ... View more

You are combining things. If you are using $global_pckr.earliest$ and $global_pcker.latest$ then you do not need | addinfo because it is redundant. As far as, "How can you get this to work", you have not explained what exactly this is so there is no way that we can help you further. ... View more

Does this do what you need? index=proxy | eventstats dc(user) as unique_users by url | top url | sort 5 - count | table url, unique_users, count, percent ... View more

Where are you getting the numbers 150 and 100? Did you look at the original search and export it to csv to see how many results you really got, or are you relying on the "nnn" events display on the search screen? Here's one possibility - the verb sort will limit the output to 100 results unless you specifically tell it otherwise by specifying | sort 0 . If you have a sort in your initial search, or in the search with the loadjob, then that is your problem. Other ways you can get exactly 100 is if you do a stats with the values aggregate function. That has a limit of 100 as well. If that is not the problem, then the limit should have been either 10K or 50K, so those are your most likely culprits. ... View more