Hi, I have the same need, could you resolve this part: EVAL-HF_LVL1_TIME = now() ? Thanks, ... View more

Hi, Did you find how generate the cert? I have the same issue on windows. Thanks, ... View more

How are you planning to do the copy? I use volumes for the index cold / db directories. ... View more

Hi niketnilay, I need that the time can be used it in a kv store search: Something like this ( Im using the first search that you send to me to assign the values for the tperiodo1 token, I'm omitting that part in this part of code) : <panel> <input type="time" token="tperiodo2" searchWhenChanged="true"> <label>Periodo Analisis</label> <default> <earliest>-1month@month</earliest> <latest>@month</latest> </default> <change> <eval token="tperiodo2earliest">case(isnum('earliest'), earliest, earliest="now", Now(), 1=1, relative_time(Now(), 'earliest'))</eval> <eval token="tperiodo2latest">case(isnum('latest'), latest, latest="now", Now(), 1=1, relative_time(Now(), 'latest'))</eval> <eval token="tperiodo2earliestl">case(isnum('earliest'), strftime(earliest,"%d-%b-%Y %I:%M %p"), earliest="now", strftime(Now(),"%d-%b-%Y %I:%M %p"), 1=1, strftime(relative_time(Now(), 'earliest'),"%d-%b-%Y %I:%M %p"))</eval> <eval token="tperiodo2latestl">case(isnum('latest'), strftime(latest,"%d-%b-%Y %I:%M %p"), latest="now", strftime(Now(),"%d-%b-%Y %I:%M %p"), 1=1, strftime(relative_time(Now(), 'latest'),"%d-%b-%Y %I:%M %p"))</eval> </change> </input> </panel> <panel depends="$tiempo1$"> <input type="time" token="tperiodo1" searchWhenChanged="false"> <label>Periodo Comparacion</label> <default> <earliest>-13mon@mon</earliest> <latest>-1y@mon</latest> </default> <change> <condition match="$tperiodo2$!=0" > <set token="tperiodo1.earliest">$tperiodo1e$</set> <set token="tperiodo1.latest">$tperiodo1l$</set> </condition> </change> <change> <eval token="tperiodo1earliest">case(isnum('earliest'), earliest, earliest="now", Now(), 1=1, relative_time(Now(), 'earliest'))</eval> <eval token="tperiodo1latest">case(isnum('latest'), latest, latest="now", Now(), 1=1, relative_time(Now(), 'latest'))</eval> </change> </input> </panel> <panel> Or maybe something like this: <panel> <table> <search id="tiempoc"> <query>| makeresults | addinfo | eval earliestEpoch=relative_time(info_min_time,"-1y") | eval latestEpoch=relative_time(info_max_time,"-1y") | eval earliestString=strftime(earliestEpoch,"%d-%b-%Y %I:%M %p") | eval latestString=strftime(latestEpoch,"%d-%b-%Y %I:%M %p") </query> <done> <set token="tperiodo1e">$result.earliestEpoch$</set> <set token="tperiodo1l">$result.latestEpoch$</set> <set token="tperiodo1earliestl">$result.earliestString$</set> <set token="tperiodo1latestl">$result.latestString$</set> ----- Here is where Im Trying to give it the format to use it in the kvstore search: <eval token="tperiodo1earliest">case(isnum('$tperiodo1e$'), $tperiodo1e$, $tperiodo1e$="now", Now(), 1=1, relative_time(Now(), '$tperiodo1e$'))</eval> <eval token="tperiodo1latest">case(isnum('$tperiodo1l$'), $tperiodo1l$, $tperiodo1l$="now", Now(), 1=1, relative_time(Now(), '$tperiodo1l$')) </eval> ----- </done> <earliest>$tperiodo2.earliest$</earliest> <latest>$tperiodo2.latest$</latest> </search> <option name="count">10</option> <option name="refresh.display">progressbar</option> </table> </panel> ... View more

Hi @niketnilay thanks a lot for your help, but I have a question, how a pass the value for the tokLastYearEarliestEpoch and tokLastYearLatestEpoch to my input time? doesn't have to be the default value, is ther a way or I have to do the Splunk JS or html that you said to me?. Or the other way that Im'm trying is to format the time so I can search later in the kvstore, but it's not working, instead it is placing the current date. <panel> <table> <search id="tiepoc"> <query>| makeresults | addinfo | eval earliestEpoch=relative_time(info_min_time,"-1y") | eval latestEpoch=relative_time(info_max_time,"-1y") | eval earliestString=strftime(earliestEpoch,"%d-%b-%Y %I:%M %p") | eval latestString=strftime(latestEpoch,"%d-%b-%Y %I:%M %p") </query> <done> <set token="tperiodo1e">$result.earliestEpoch$</set> <set token="tperiodo1l">$result.latestEpoch$</set> <set token="tperiodo1earliestl">$result.earliestString$</set> <set token="tperiodo1latestl">$result.latestString$</set> <eval token="tperiodo1earliest">case(isnum('$tperiodo1e$'), $tperiodo1e$, $tperiodo1e$="now", Now(), 1=1, relative_time(Now(), '$tperiodo1e$'))</eval> <eval token="tperiodo1latest">case(isnum('$tperiodo1l$'), $tperiodo1l$, $tperiodo1l$="now", Now(), 1=1, relative_time(Now(), '$tperiodo1l$')) </eval> </done> <earliest>$tperiodo2.earliest$</earliest> <latest>$tperiodo2.latest$</latest> </search> <option name="count">10</option> <option name="refresh.display">progressbar</option> </table> </panel> Regards, Osmary PD: I don'n know what happend but in my xml is deleting the part of set token ... View more

Hi, Sorry I delete the first row. I have one input: <label>Periodo Analisis</label> <default> <earliest>-1month@month</earliest> <latest>@month</latest> </default> <change> <eval token="tperiodo2earliest">case(isnum('earliest'), earliest, earliest="now", Now(), 1=1, relative_time(Now(), 'earliest'))</eval> <eval token="tperiodo2latest">case(isnum('latest'), latest, latest="now", Now(), 1=1, relative_time(Now(), 'latest'))</eval> <eval token="tperiodo2earliestl">case(isnum('earliest'), strftime(earliest,"%d-%b-%Y %I:%M %p"), earliest="now", strftime(Now(),"%d-%b-%Y %I:%M %p"), 1=1, strftime(relative_time(Now(), 'earliest'),"%d-%b-%Y %I:%M %p"))</eval> <eval token="tperiodo2latestl">case(isnum('latest'), strftime(latest,"%d-%b-%Y %I:%M %p"), latest="now", strftime(Now(),"%d-%b-%Y %I:%M %p"), 1=1, strftime(relative_time(Now(), 'latest'),"%d-%b-%Y %I:%M %p"))</eval> And I want take that same time but with a year earlier and pass that to another input. So I think it should be something like this: <label>Periodo Analisis</label> <default> <earliest>-1month@month</earliest> <latest>@month</latest> </default> <change> <eval token="tperiodo1e">relative_time('earliest',"-1y")</eval> <eval token="tperiodo1l">relative_time('latest',"-1y")</eval> <eval token="tperiodo2earliest">case(isnum('earliest'), earliest, earliest="now", Now(), 1=1, relative_time(Now(), 'earliest'))</eval> <eval token="tperiodo2latest">case(isnum('latest'), latest, latest="now", Now(), 1=1, relative_time(Now(), 'latest'))</eval> <eval token="tperiodo2earliestl">case(isnum('earliest'), strftime(earliest,"%d-%b-%Y %I:%M %p"), earliest="now", strftime(Now(),"%d-%b-%Y %I:%M %p"), 1=1, strftime(relative_time(Now(), 'earliest'),"%d-%b-%Y %I:%M %p"))</eval> <eval token="tperiodo2latestl">case(isnum('latest'), strftime(latest,"%d-%b-%Y %I:%M %p"), latest="now", strftime(Now(),"%d-%b-%Y %I:%M %p"), 1=1, strftime(relative_time(Now(), 'latest'),"%d-%b-%Y %I:%M %p"))</eval> And then put it in the other selector: <label>Periodo Comparacion</label> <default> <earliest>$tperiodo1e$</earliest> <latest>$tperiodo1l$</latest> </default> <eval token="tperiodo1earliest">case(isnum('earliest'), earliest, earliest="now", Now(), 1=1, relative_time(Now(), 'earliest'))</eval> <eval token="tperiodo1latest">case(isnum('latest'), latest, latest="now", Now(), 1=1, relative_time(Now(), 'latest'))</eval> <eval token="tperiodo1earliestl">case(isnum('earliest'), strftime(earliest,"%d-%b-%Y %I:%M %p"), earliest="now", strftime(Now(),"%d-%b-%Y %I:%M %p"), 1=1, strftime(relative_time(Now(), 'earliest'),"%d-%b-%Y %I:%M %p"))</eval> <eval token="tperiodo1latestl">case(isnum('latest'), strftime(latest,"%d-%b-%Y %I:%M %p"), latest="now", strftime(Now(),"%d-%b-%Y %I:%M %p"), 1=1, strftime(relative_time(Now(), 'latest'),"%d-%b-%Y %I:%M %p"))</eval></change> But is not worwing good. And I have another peculiarity, that I have to give it the format so I can search later in a KVStore. Yes Im showing the time thats why I give it the format wiht strftime. ... View more

10/10/18 5:30:06.546 PM 2018-10-10 17:30:06.546 +0200 [QuartzScheduler_Worker-25] INFO org.easybatch.core.job.BatchJob - Job 'sccm_updates_info' finished with status: COMPLETED host = MOL11101 index = _internal linecount = 1 punct = --_::._+__[-]___...._-__''___:_ source = E:\Program Files\Splunk\var\log\splunk\splunk_app_db_connect_server.log sourcetype = dbx_server splunk_server = mol18119.enagas.eng splunk_server_group = dmc_group_indexer splunk_server_group = dmc_indexerclustergroup_ENAGAS CLUSTER 10/10/18 5:30:06.539 PM 2018-10-10 17:30:06.539 +0200 [QuartzScheduler_Worker-25] INFO org.easybatch.core.job.BatchJob - Job 'sccm_updates_info' stopping host = MOL11101 index = _internal linecount = 1 punct = --_::._+__[-]___...._-__''_ source = E:\Program Files\Splunk\var\log\splunk\splunk_app_db_connect_server.log sourcetype = dbx_server splunk_server = mol18119.enagas.eng splunk_server_group = dmc_group_indexer splunk_server_group = dmc_indexerclustergroup_ENAGAS CLUSTER 10/10/18 5:30:03.323 PM 2018-10-10 17:30:03.323 +0200 [QuartzScheduler_Worker-25] INFO org.easybatch.core.job.BatchJob - Job 'sccm_updates_info' started host = MOL11101 index = _internal linecount = 1 punct = --_::._+__[-]___...._-__''_ source = E:\Program Files\Splunk\var\log\splunk\splunk_app_db_connect_server.log sourcetype = dbx_server splunk_server = mol18119.enagas.eng splunk_server_group = dmc_group_indexer splunk_server_group = dmc_indexerclustergroup_ENAGAS CLUSTER 10/10/18 5:30:03.181 PM 2018-10-10 17:30:03.181 +0200 [QuartzScheduler_Worker-25] INFO com.splunk.dbx.connector.logger.AuditLogger - operation=dbinput connection_name=SCCM_Produccion stanza_name=sccm_updates_info state=success sql='SELECT v_UpdateInfo.ApplicabilityCondition, v_UpdateInfo.ApplicableAtUserLogon, v_UpdateInfo.ArticleID, v_UpdateInfo.BulletinID, v_UpdateInfo.CIType_ID, Show all 61 lines host = MOL11101 index = _internal linecount = 61 punct = --_::._+__[-]___....._-_=_=_=_=_='_.,_________.,__ source = E:\Program Files\Splunk\var\log\splunk\splunk_app_db_connect_audit_server.log sourcetype = dbx_audit splunk_server = mol18119.enagas.eng splunk_server_group = dmc_group_indexer splunk_server_group = dmc_indexerclustergroup_ENAGAS CLUSTER 10/10/18 5:30:00.008 PM 2018-10-10 17:30:00.008 +0200 [QuartzScheduler_Worker-25] INFO c.s.d.s.dbinput.recordreader.DbInputRecordReader - action=db_input_record_reader_is_opened input_task="sccm_updates_info" query=SELECT v_UpdateInfo.ApplicabilityCondition, v_UpdateInfo.ApplicableAtUserLogon, v_UpdateInfo.ArticleID, v_UpdateInfo.BulletinID, v_UpdateInfo.CIType_ID, v_UpdateInfo.CIVersion, v_UpdateInfo.CI_CRC, v_UpdateInfo.CI_ID, v_UpdateInfo.CI_UniqueID, v_UpdateInfo.ConfigurationFlags, v_UpdateInfo.ContentSourcePath, v_UpdateInfo.CreatedBy, v_UpdateInfo.CustomSeverity, v_UpdateInfo.DateCreated, v_UpdateInfo.DateLastModified, v_UpdateInfo.DatePosted, v_UpdateInfo.DateRevised, v_UpdateInfo.Description, v_UpdateInfo.EULAAccepted, v_UpdateInfo.EULAExists, v_UpdateInfo.EULASignoffDate, v_UpdateInfo.EULASignoffUser, v_UpdateInfo.EffectiveDate, v_UpdateInfo.InUse, v_UpdateInfo.InfoURL, v_UpdateInfo.IsBroken, v_UpdateInfo.IsBundle, v_UpdateInfo.IsChild, v_UpdateInfo.IsDeployed, v_UpdateInfo.IsEnabled, v_UpdateInfo.IsExpired, v_UpdateInfo.IsHidden, v_UpdateInfo.IsLatest, v_UpdateInfo.IsQuarantined, v_UpdateInfo.IsSignificantRevision, v_UpdateInfo.IsSuperseded, v_UpdateInfo.IsTombstoned, v_UpdateInfo.IsUserCI, v_UpdateInfo.IsUserDefined, v_UpdateInfo.LastModifiedBy, v_UpdateInfo.LocaleID, v_UpdateInfo.Locales, v_UpdateInfo.MaxExecutionTime, v_UpdateInfo.MinSourceVersion, v_UpdateInfo.ModelId, v_UpdateInfo.ModelName, v_UpdateInfo.ModifiedTime, v_UpdateInfo.PermittedUses, v_UpdateInfo.PlatformType, v_UpdateInfo.Precedence, v_UpdateInfo.RequiresExclusiveHandling, v_UpdateInfo.RevisionNumber, v_UpdateInfo.SDMPackageDigest, v_UpdateInfo.SDMPackageVersion, v_UpdateInfo.SedoObjectVersion, v_UpdateInfo.Severity, v_UpdateInfo.SourceSite, v_UpdateInfo.Title, v_UpdateInfo.UpdateSource_ID, v_UpdateInfo.UpdateType FROM v_UpdateInfo Collapse host = MOL11101 index = _internal linecount = 61 punct = --_::._+__[-]___......_-_=_=""_=_.,_________.,____ source = E:\Program Files\Splunk\var\log\splunk\splunk_app_db_connect_server.log sourcetype = dbx_server splunk_server = mol18119.enagas.eng splunk_server_group = dmc_group_indexer splunk_server_group = dmc_indexerclustergroup_ENAGAS CLUSTER 10/10/18 5:30:00.008 PM 10/10/18 5:30:00.008 PM 2018-10-10 17:30:00.008 +0200 [QuartzScheduler_Worker-25] INFO org.easybatch.core.job.BatchJob - Job 'sccm_updates_info' starting host = MOL11101 index = _internal linecount = 1 punct = --_::._+__[-]___...._-__''_ source = E:\Program Files\Splunk\var\log\splunk\splunk_app_db_connect_server.log sourcetype = dbx_server splunk_server = mol18119.enagas.eng splunk_server_group = dmc_group_indexer splunk_server_group = dmc_indexerclustergroup_ENAGAS CLUSTER This was after make a change in the query, because I found this mssg: 2018-10-10 16:20:03.470 +0200 [QuartzScheduler_Worker-10] WARN c.s.d.s.d.r.iterator.EventPayloadRecordIterator - input sccm_updates_info contains binary columns, will be discarded. column name:RevisionTag So I remove the RevisionTag. But it still not work ... View more

Hi Edward, I have the same problem. Maybe you find something and can tell us?.. Thank you, ... View more