Hello there, I'm struggling a little bit with the search language, booleans, eventtypes and stuff ... I can't find a good way to create a very simple report. What i'm trying to do is to identify users that have connected to server A and have not connected to server B over a selected time period. The logs would be like : sourcetype=server_a username=johndoe "New connection to server A" sourcetype=server_b username=johndoe "New connection to server B" I'd like to have the list of users for wich Splunk can find at least one "New connection to server A" but zero "New connection to server B" over the selected time period. It looks very simple but ... i guess i'm not using the search language efficiently. Of course, the selected time period could be somethig like 3 month and there are lots of events so "transaction" doesn't look like a good option. Thanks a lot in advance for your help. Mat ... View more

Hi everyone, I'm seeing strange results using stdev. I'm using the following command : sourcetype=whatever | stats avg(timetaken) as average, stdev(timetaken) as deviation by uri | where deviation > average And I have results that are actually showing a standard deviation that is superior to the average ... which is not mathematically possible according to me unless we have negative "timetaken" values (and that's not the case). I tried stdevp too but it's not better. Has anyone got a clue ? Thanks in advance for your help. Regards, Mat ... View more

Hello Splunkers, I'd like to configure Block Signing in an environment where I have two indexers in a cluster and a search head for distributed search on these two indexers. From http://answers.splunk.com/answers/105289/difference-between-event-hashing-and-it-block-signing it looks like IT block signing is not available when distributed search is running. I'm quite confused as it's an important feature in some tricky environments. Is there a way to go around ? Is there any roadmap regarding this feature ? I've seen that it's deprecated too so it doesn't look to good but ... Thanks in advance for your help. M. ... View more

Hey guys, I've built a very basic dashboard that has one panel. That panel is showing the results of a basic "top" command in a pie format. Let's say i have a search that looks like : xxx | top myfield I'd like to be able to click on a piece of the pie (myfield=sample_value) and be redirected to another dashboard with the myfield=sample_value" parameter in the url. Of course, i've checked that the dashboard at http://mysplunk/app/search/second_dashboard?myfield=sample_value works just fine. Still, i can't find a way to post this to the dashboard. I've created the intention with the following : <module name="ConvertToIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="series">$click.value$</param> </param> </param> This seems to work, i've checked by adding : <module name="ConvertToDrilldownSearch"> <module name="JobProgressIndicator"/> <module name="SimpleResultsHeader"> <param name="headerFormat">You havec clicked on $click.value$</param> <param name="entityName">events</param> </module> And the new line shows up just fine saying : "You have clicked on sample_value" A link to the second dashboard (without the ConverttoIntention part) works just fine like this : <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">second_dashboard</param> </module> </module> If I'm using this ConvertToDrilldownSearch and the ConvertToIntention at the same time, Splunk takes me to : http://mysplunk/en-US/app/search/second_dashboard?q=search%20xxxxx%22%20myfield%3D%22sample_value%22&earliest=1374278587&latest=1374279487 I've tried with second_dashboard?myfield=sample_value but it won't solve the problem I'm nearly there but ... something's missing. Has anyone got a clue on what i'm doing wrong ? Thanks a lot in advance for your help. Mat ... View more