As suggested in another thread, using eval in a count instead of 'by' clause worked for me: search msgType=*| timechart span=1h count(eval(msgType=="IN")) as IN, count(eval(msgType="OUT")) as OUT | eval ratio=OUT/IN ... View more

Here is something that can help you... First, generate dummy columns and single row of results: index=nothing_to_see_here |stats count| eval col1="beep" | eval col2="boop"|table col1 col2 ┌──────┬──────┐ │ col1 │ col2 │ ├──────┼──────┤ │ beep │ boop │ └──────┴──────┘ Append data from another dummy search: index=nothing_to_see_here |stats count | eval col1="beep" | eval col2="boop" | table col1 col2 | append [search index=nothing_to_see_here | stats count | eval col1="science" | eval col2="magic" | table col1 col2 ] ┌─────────┬───────┐ │ col1 │ col2 │ ├─────────┼───────┤ │ beep │ boop │ │ science │ magic │ └─────────┴───────┘ ... View more

The command resulted in "In handler 'clustermasterpeerindexes': master is not enabled on this node". ... View more

I was getting this error when my inputs and outputs conf had encrypted sslPassword but I've forgotten to include the $SPLUNK_HOME/etc/auth/splunk.secret. ... View more

On Splunk 6.4, _cd doesn't seem to be a field... Does anyone know how to identify which bucket an even is in on the newer versions? ... View more

This seems to work when trying to find unique values for a field, like 'host': * | chart count by host ... View more

I was getting the following error when loading LDAP configuration from system/local/authentication.conf file: Error binding to LDAP. reason="Invalid credentials" The problem was due to me having bindDNpassword in a form of a hash instead of plain text. It turns out you need Splunk do the hashing on it own. ... View more

I was having Splunk time out after 'writing RSA key' when I was accepting the license by removing the ftr file. Instead, having the following in my init's start function works: /opt/splunk/bin/splunk" start --accept-license --no-prompt --answer-yes ... View more

Here is a way to count events per minute if you search in hours: * | timechart count(_raw) span=1h ... View more