That is exactly what I needed. Thank you so much!! ... View more

I also had this issue, did the above, didn't work, was told to add the new role to etc/apps/search/metadata/local.meta where the user role is and it now works fine. It's just a permissions issues ... View more

If you want something dynamic, you could use timechart + delta + stream stats. Something along these lines: sourcetype=iis earliest=-6m@m latest=@m| timechart span=1m dc(cs_username) as DU | delta DU as Delta | streamstats window=5 current=f global=t avg(Delta) as AvgLast5Delta | eval PercentageChange=100*round((AvgLast5Delta-Delta)/AvgLast5Delta,4) | tail 1 Alert on (absolute?) PercentageChange being bigger than some number. EDIT: Made PercentageChange an actual percentage ... View more

Thank you Giuseppe!! I shall try this, I have a solution at the moment but it is a little messy Cheers, Lee ... View more

Yep do what @JMichaelis said - you should get the results you're after. See http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Timechart for more specifics ... View more

Thank you so much!! I remember doing this a while back but had totally forgotten. Thanks for reminding me ... View more

I have updated the search. Sorry for the typo. Pls check now ... View more

Thank you so much 🙂 I managed to get it to work. All the best!! ... View more

Thanks alot guys, I managed this 🙂 ... View more

If you want to do it with markers, you will have to create a dashboard panel for each host. Each panel would have the following search host=<your host> | stats count Then just choose the marker guage visualization. If you want to view all your hosts side by side to look at abnormalities try * | stats count by host and choose the line visualization. But that's wasting Splunk's potential. Splunk can determine for you whether the volume is abnormal. For example, you could have Splunk alert you if a particular count is more than 3 standard deviations from the average - you'll never have to login again! (Although I understand every good NOC needs a dashboard full of numbers going up and down). Have a look at http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/CommonStatsFunctions for a list of statistical functions that you can apply to your data. ... View more

With a bit more understanding, I achieved this Sir. Thank you so much!!! ... View more

You can use event log forwarding to send the events from all Windows devices to one server. Then you can install a Splunk forwarder on that server to collect the events. http://blogs.splunk.com/2014/02/03/forwarding-windows-event-logs-to-another-host/ ... View more