@cmerriman works great. Thanks ... View more

ya still the output is same: try this: index=si | timechart count | appendcols [search index=_internal | dedup log_level | table log_level ] The main search will give you no results as there is no si index. ... View more

Which is the visualization you are using in your Panel. How many panels are there in one row where you need to change the height? ... View more

i would suggest doing them one at a time, especially if you have any tails - checkpoints are in a different place and in a different format, and specifying the rising column in the query is different as well. We went through this earlier in the year with around 150 inputs and did them manually. If they're all snapshot/batch jobs, you could try to script something yourself to create the new format but it may be worth just powering through manually. We also ingested all of the migrated inputs in our test index initially before actually replacing the v1 version with the v3 version just to be sure the data looked ok. You may be able to migrate from v1 to v2 and then from v2 to v3, but that seemed a little too adventurous for us...and i'm relatively distrusting of automatic migrations in general, so definitely didn't want to trust 2 of them working correctly. A couple other things we noticed....if a query has duplicate column names, it may fail in v3. Also, if doing live queries (not inputs), timestamps will be converted to strings when the results are returned - in v1, they were returned as epoch. Good luck! ... View more

Have you tried just doing a plain | timechart span=1h dc(clientip) by hosts or something like that? date_hour is a field that represents the hour value as splunk read it from the raw event. Not the best to use in searches really as it is not normalized. ... View more

I have created a saved search which execute at 4 hours interval. Based on it i have a dashboard panel which uses its result( I am using loadjob for that in post process query). The thing is that sometime i need to re-execute the saved search before its scheduled time so that i have fresh result. Loadjob fetches the latest run result. If somehow, the saved search can be executed before four hour interval also, then change in schedule is not required. That is why i am asking, is it possible. If so, how? ... View more

Two possible options spring to mind 1) Create a second panel next to the value panel with the rangemap information using HTML - http://docs.splunk.com/Documentation/Splunk/7.1.3/Viz/BuildandeditdashboardswithSimplifiedXML#Use_the_HTML_panel_to_display_static_text 2) Use ( or build ) a custom visualization to tackle this. For example use "Scalable Vector Graphics - Custom Visualization" https://splunkbase.splunk.com/app/3815/ allows you to build visualizations with a bit of SVG know-how ( https://www.w3schools.com/graphics/svg_intro.asp ) Or build http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial ... View more

https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPractices.pdf ... View more

@niketnilay, Would you please advise on above details provided. ... View more

Thanks renjith. ... View more