I need to make a report/alert on the permissions granted to the views in SPLUNK. I am in particular interested in those situations where permission = read is granted to 'everyone' Is it possible to make such a report? ... View more

Hi, I need to make a report which need to calculate with two different prices. Price 3,33 USD for the first 10000 trx within a month Price 2,22 for 10001 - 20001 trx within same month Price 1,11 for 20001 + trx within the same month I have tried following: |accum Trx as Accum_trx |EVAL Charge=if(Accum_trx <10000,3.33, if(Accum_trx>10001 AND Accum_trx<20001,2.22, 1.11)) If Accum_trx are 3444 7000 9500 10500 the search will calculate 9500*3.33 and 10500 minus 9500 = 1000*2.22 I need to calculate 500 * 3.33 and 500 * 2.22 instead. How do I accomplish this? ... View more

I have created APPx. In APPx I have created a number of Dashboards which use the result of scheduled saved searches in APPy. or so I thought! When I log onto APPx Dashbords SPLUNK starts to run all saved searches in the dashboard. Why can't APPx read/get the result from the saved scheduled searches in APPy? Do you have any solution? ... View more

My customer want me to provide a change log on saved searches/dashboards/macros etc. I.e.: Change date, changed by user, old search content, new search content. The same apply to dashboards, macros etc. Where can I find this log? ... View more

host y contain name tag: ELT (Value: milliseconds) host x contain name tag: ELT (Value: seconds) Common identifier in the two hosts are F5I How do I calculate the difference between ELT in host Y and ELT in host X? I have tried this search: host=x | JOIN F5I [ search host=y ]|EVAL yELT=ELT/1000 |TABLE host SVC ELT yELT But the value of 'ELT' above is the value of ELT in host Y - and I want the value of ELT in host X - in order to calculate the difference - how do I do that? Thanks in advance for any help. ... View more

All my Dashboards are based on results of scheduled saved searches, so why does it look as if the user is performing a search just by logging on to the Dashboard? - ref below from audit log. Audit:[timestamp=02-13-2012 12:49:02.848, user=testsearch, action=search, info=granted , search_id='testsearch_testsearch_xxxxxDKXP_UFM2UFNES1hQIFBTX1RJTUUgQ2hlY2tvdXRTdGFydFNlc3Npb24_1329137342.204', search='search = bla bla bla', autojoin='1', buckets=0, ttl=600, max_count=10000, maxtime=0, enable_lookups='1', extra_fields='', apiStartTime='Mon Feb 13 11:49:00 2012', apiEndTime='Mon Feb 13 12:49:02 2012', savedsearch_name="xxxxxxDKXP"][n/a] ... View more

Hi I have created following search to measure availability per day (24 hours) host=xxxxxp* | delta _time AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval timeDelta=tostring(timeDeltaS,"duration")|where timeDeltaS >15 |RENAME timeDeltaS as Sec_unavailable |APPEND [SEARCH host=xxxxxp* PRJ=PRJABC| eval Sec_unavailable=0 ]|bucket _time span=1d |stats sum(Sec_unavailable) by _time| RENAME sum(Sec_unavailable) as sec_unavail |eval avail=86400-sec_unavail|eval AvailPct = round((avail/86400)*100,2)|timechart span=1d sum(AvailPct)|RENAME sum(AvailPct) as "Avail.Pct" This calculates availabilty % per day round((avail/86400)*100,2) Now I want to calculate the availability within the service hours (07 to 19 GMT) per day. I know how to select the service hours (date_hour >07 AND date_hour <19) - and I have changed the 86400 (24 hours) seconds to 46800 (=13 hours) - but I am getting negative availabilty... I believe this is due to the *bucket _time span=1d* - but I am very most lost as to which bucket command I should use? ... View more

User role get following error message when trying to give read/write permission on look-up table: Splunk could not update permissions for resource data/lookup-table-files Client is not authorized to perform requested action User has created the lookup file in an app where permission = read and write to everyone. So why can't the user give permission on look-up table? ... View more

I am lost! I get this errormessage in the Dashboard. The saved search has been running for a couple of days - Was added to Dashboard1, and worked beautifully. Then I deleted the saved search from Dashboard1 and added the same saved search to another dashboard - and THEN I got the above error message. Why? - anybody got any good ideas? Thanks in advance for your help ... View more