Hi, Can you using syntax as mentioned below: sourcetype=access_* | stats count by status | lookup status_desc status OUTPUT description Here, the command usage is like lookup [local=<bool>] [update=<bool>] <lookup-table-name> ( <lookup-field> [AS <event-field>] ) [( OUTPUT | OUTPUTNEW <lookup-destfield> [AS <event-destfield>] )] You can get more details @ http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup Thanks!! ... View more

Lets take this example: Jul 1 08:00:00 ==> %b %d %H:%M:%S (refer to http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Commontimeformatvariables) 07-01 08:00:00 ==> %m-%d %H:%M:%S Your query should look like: ...... | eval customTime = strftime(_time, "%m-%d %H:%M:%S") Check the examples of strftime and strptime at http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonEvalFunctions ... View more

You can try using strptime and strftime commands for formating the time. More details @ http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Commontimeformatvariables http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonEvalFunctions Thanks!! ... View more

Try using Following code: new SearchManager({ id: "mysearch1", earliest_time: "-24h@h", latest_time: "now", search: "openstack::* node::* command=w |dedup node|eval critical = if( load2 > 1.25,load2,0)|table node load2 critical" }); Please note: Removed the last comma (just after search string). Thanks!! ... View more

Are you using simple xml dashboard? ... View more

You will have to write new function to create data in expected format. Something like: var parseSplunkData = function(rows){ var parsedData = []; for(var i in rows){ if(i && rows[i]){ var row = rows[i]; var data = { 'Option' : row.option, //Validate is row.option is available or not 'Count' : parseInt(row.count) //Validate is row.count is available or not } parsedData.push(data); } } //Use the parsedData and pass it to Google API. } ... View more

Not sure if your comment is trimmed. For the data type issues, you can create a parser module. Depending on the column name, it can return the number or string or boolean from the module (or function) itself. Again, this is just an approach and not a complete solution. Thanks!! ... View more

Hi, You can validate if the Google API visualization is working for a dummy data or not. This dummy data should be an array and should be passed externally. Once this is working, then simply replace the dummy array with Data1_Results.data().rows. Basically, pass this data to Google API as if you are passing a JSON object to API. Thanks!! ... View more

You can use lookup command. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Lookup Refer to examples section. Thanks!! ... View more

You can try IFX which is easy to use. Following tutorial can help you. http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX Thanks!! ... View more

For the custom visualization, you can use D3.js For fetching the data from splunk (programatically), you can use Splunk SDK's ... View more

See if this helps. Replace the update the render function to following. The varible isHighlight will be true if the highlight is required otherwise it will be false. render: function($td, cell) { // Add a class to the cell based on the returned value // Apply interpretation for number of historical searches var tdPosition = $td.parent().children().index($td[0]); var value = cell.value; var isHighlight = (value.search('NO_HIGHLIGHT_') == -1) if (isHighlight) { var value = parseInt(value); if ((value > 0) && (value <= 50)) { $td.addClass('range-cell').addClass('range-severe'); }else if ((value > 50) && (value <= 100)) { $td.addClass('range-cell').addClass('range-elevated'); }else if ((value > 100) && (value <= 150)) { $td.addClass('range-cell').addClass('range-low'); }else { $td.addClass('range-cell').addClass('range-empty'); } } value = value.replace('NO_HIGHLIGHT_',''); // Update the cell content $td.text(value).addClass('numeric'); } ... View more

Following are the change: 1. Change the splunk query. The columns which do not need highlighting, use the above eval statement. 2. In JS, you get the cell value using var value = cell.value;, using this value, identify if the column needs highlighting or not. e.g. If the cell value is NO_HIGHLIGHT_BBC Sport, then don't highlight. If not present, then highlight. Here, NO_HIGHLIGHT_ is the token we added (purposefully) in the search result (for column Channel). 3. Lastly, remove NO_HIGHLIGHT_ from the cell value (and show this value in dashboard). Thanks!! ... View more

Do you want to highlight all the cells except Channel cell? ... View more

Hi, Use Field extractor for extracting different fields for "Batch received successfully" & "could not be found" (http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX), use these fields in query. Lets say, "Batch received successfully"=SUCCESS and "could not be found" = FAILURE, then the query will look like: index="sc-kofax" sourcetype="sc-kofax-sv-acis" SUCCESS=* OR FAILURE=* | Stats count by host Thanks!! ... View more

You can specify fields command to avoid unnecessary field extraction. search="index=\"jennifer\" sourcetype=\"jennifer_perf_agent\" tag=\"$server$\" | fields hit_hour,hit_day,visit_day, visit_hour, agent, _time | table hit_hour,hit_day,visit_day, visit_hour, agent, _time"|token_safe Thanks!! ... View more

Use strptime command: http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Commontimeformatvariables Thanks!!! ... View more

You can try using multisearch command. e.g. | multisearch [| inputlookup workstations | rename fielda AS fieldb | dedup fieldb | eval LOOKUP_CHECK="YES"] [search index=index-name | dedup fieldb | fields fieldb | eval INDEX_CHECK="YES"] | stats values(LOOKUP_CHECK) as LOOKUP_CHECK, values(INDEX_CHECK) as INDEX_CHECK by fieldb | fillnull values="NULL" LOOKUP_CHECK | search LOOKUP_CHECK="NULL" Thanks!! ... View more