Ctrl+\ its perfectly working in Windows ... View more

(?[A-Z].*:) (? Assigned ==> Starting Char ==> [A-Z] Followed by any no char ==> .* End with : ==> : ) you get results like below Match 1 Status= TransactionRolledbackException: Match 2 Status= NoEntryAffectedException: ... View more

instead of source and business_service i used source and Time. you will change according to your fields ... View more

Why you go for trendline your search| stats count by source Time| trendline sma2(count) as trend http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Trendline ... View more

Use the search below: index=win_srv_perf host=host (source="Perfmon:FreeDiskSpace" OR source="Perfmon:LogicalDisk" OR source="Perfmon:LocalNetwork") |eval Time = strftime(_time,"%Y_%m_%B") | chart count by source Time | addtotals | sort -Total |eval Time = strftime(_time,"%Y_%m_%B") you get 2015_05_May 2015_06_June 2015_07_July now you get correct order ... View more

we need an empty value Using evaluation we can able to make an empty cell eval count = if(count<= 104307," ", count) but how should be dynamically checking for every repeated host except top host value, that we need to be analyzing actual Resulat host count aaa 111 aaa 100 aaa 090 bbb 102 bbb 100 bbb 102 bbb 099 ccc 120 ccc 110 Expected results host count aaa 111 aaa aaa bbb 102 bbb bbb bbb ccc 120 ccc ... View more

Macroname : DB_changes_by_org_grp macro Content : dbquery DB "SELECT * FROM [ARSystem].[dbo].[A_Reporting_CHG_Infrastructure_Change_Base_Datamart_AllOpen] " Description : fetches data form SQL macro name : group | eval so = "$source$" | eval X =replace(so, "group=", "(Assignment_Support_Group_Name LIKE \"") |eval X =replace(X, "org=", "(Assignment_Support_Organization LIKE \"") | eval Y =replace(X,",", "%\") OR ")|eval Y=Y."%\")" Description : evaluate where condition based on parameter (splunk where condition) Final Query | DB_changes_by_org_grp | where group("group=DBA,org=EAWS,group=Appl,org=PTG") Description : I wnat run final query like this dbquery DB "SELECT * FROM [ARSystem].[dbo].[A_Reporting_CHG_Infrastructure_Change_Base_Datamart_AllOpen] " |where (Assignment_Support_Group_Name LIKE "DBA%") OR (Assignment_Support_Organization LIKE "EAWS%") OR (Assignment_Support_Group_Name LIKE "Appl%") OR (Assignment_Support_Organization LIKE "PTG%") we formed a query but we cant able to run this guery and get the results ... View more