If you setup your lookup table to do automatic lookups, then your Reference field will be a field in each event which has a domain_name . At that point, you can then write a search similar to this: _your_search_here_ | stats count(domain_name) as count by Reference ... View more

I am assuming you have a search with the fields 'first' and 'last'. The following search will create one result which will be the mean of the 'last' field. your_iniital_search ... | stats mean(last) There are also median(), mode(), avg() ... View more

You can do "real time" in simple HTML. (At least to the granularity you specified.) I have pasted the source for a panel I use, which uses a 10 minute refresh. If you want 1 minute refresh, use this in place of the line from my example: <option name="refresh.auto.interval">60</option> So, create the search you need and save it to a dashboard, then edit the source and add the "refresh.auto.interval" line to the chart. example: <panel> <chart> <title>CPU Utilization by Host</title> <search> <query>index=os sourcetype=cpu $hosts$ | timechart span=$span$ avg(pctCPUutil) by host</query> <earliest>$tpicker.earliest$</earliest> <latest>$tpicker.latest$</latest> </search> <option name="refresh.auto.interval">600</option> <option name="charting.legend.placement">bottom</option> ... snip ... <option name="charting.axisY.maximumNumber">100</option> </chart> </panel> ... View more

somesoni - your answer was great and has helped me tremendously. I've learned a new trick now, and the following search runs slightly faster. Beginning with the inputlookup and negating the hosts with matching events in the index produces the availability alert in a fashion easier to understand for newbies. I also threw in a ready-to-go message. | inputlookup unix_hosts.csv | search AppTeam="TeamA" | search NOT [search index=os sourcetype=ps USER=root AND COMMAND=cron earliest=-2m@m latest=-1m@m | fields host] | eval minus_1=tostring(strftime(relative_time(now(),"-1m@m"),"%+")) | eval message=replace("cron (root) not running at minus_1","minus_1",minus_1) | fields host message ... View more

In the current *Nix Add-On v 5.2.2, in vmstat.sh, this is how I've edited the command for Solaris: CMD='eval /usr/sbin/prtconf 2>/dev/null | grep Memory ; /usr/sbin/swap -s ; vmstat -q 1 2|tail -1 ; vmstat -s ; prstat -n 1 1 1; echo CPU_COUNT `psrinfo | grep -c "on-line"`; sar -gp 1 2' Basically, anywhere in the TA that uses 'vmstat' or any other command which returns the average stats since boot for the first iteration, run 2 iterations of the stats and pipe to tail -1. The Linux command does not use 'vmstat' to get the memory statistics which is why my example is for Solaris. I say basically, because it depends on how the output is parsed with the 'awk' script. Most of the time, the 2 iterations and pipe to tail -1 is correct, but some of the awk parsers are built to grab the data differently. One final bit of advice. If you do edit any of the scripts, you probably want to copy the entire TA to a newly named TA and push your custom TA and stop pushing the original *Nix TA. Do this for the same reason you edit files in the local directory, and not the default directory. ... View more

To answer the question, "show only values from a lookup that are not returned in a search?", the contents of the lookup table have to be appended to the search and the search results negated. index=abc sourcetype="eq" getLoginInfo User=* | eval User=lower(User) | stats count by User | append [ | inputlookup Users.csv | rename corp_id as User | dedup User | search functional_mgr_name = "doe, john" | eval count=0 ] | stats max(count) as count by User | where count = 0 Of course, my answer assumes that 'functional_mgr_name' is one of the fields in the lookup table. ... View more

I've tried using 'set token=' in each possible spot in the XML hierarchy and have come to the conclusion that it simply does not work, I have not witnessed a new token get created. Also, tokens do not work in the 'default' field. As far as I can tell the reason is that the 'default' value becomes part of the URL for the form, and tokens are not parsed yet. So, what I do to populate a default value is build it into the URL for the form. In your case it would be something like: http://your_search_head_host:8000/en-US/app/your_app_name/your_form_name?form.FY=2014 and remove the $foo$ stuff. ... View more

In it's simplest form, you use a comma separated list: <input type="checkbox" token="field1"> . . . <initialValue>a,b,c</initialValue> </input> In your case where you have a dynamically generated list, unless your host list does not change often, the only choice you have is to call the URL of the form with the checklist pre-populated, e.g. http://your_host:8000/en-US/app/your_app_name/your_dashboard_name?form.hosts=host1&form.hosts=host2&form.hosts=hostN I do this myself (with subsets of my entire host list), but I use multiselect instead of checkboxes - not sure if the URL syntax is the same or not. Here's how I build the URL dynamically: <panel> <html> <div> <a href="your_dashboard_name?form.hosts=$hosts$" target="_blank">Name of URL in First Dashboard</a> </div> </html> </panel> The $hosts$ token in this code block is the token name of the multiselect in the first dashboard. ... View more

2 searches, one division... check. I created an example doing the math: (ignore the fields I chose, replace with your own) index=os sourcetype=cpu CPU=ALL | stats avg(pctCPUutil) as CPU_pct | appendcols [search index=os sourcetype=who | stats dc(USERNAME) as NUM_user | fields NUM_user] | eval CPU_per_user=CPU_pct/NUM_user | table CPU_pct NUM_user CPU_per_user Edit: I tried submitting this yesterday, but Splunk's website refused to post it. It submitted today when I was cleaning up. ... View more

What exactly isn't working with the join? You are aware that even when choosing an outer/left join that only events in indexB which match events in indexA will be included in the join, correct? If you want both complete indexes in the results, then you should pick a different merge command. The 'dedup _raw' in your subsearch may be the problem. My experiments generated missing data when I did the same. Instead I ran a dedup on an extracted field, and all the values joined in the final results. This behavior may be related to the 'earlier' option to join. By default, 'join' matches the main search results only against earlier results from the subsearch. Set earlier=false if your indexB has newer timestamps than indexA. So maybe try the following: index=IndexA | where HIERARCHY="1" |rename CN AS Site | join Site type=left [search index="IndexB" | dedup "Serial Number"| rename "Certification object" AS Site|fields Site,"Expiry Date","CI Name","Serial Number",Environment,SupplierName] |dedup Hostname Site "Valid to" TIMESTAMPENTRADA2 | table Hostname Site "Expiry Date" ... View more

I haven't found a way to do it with the 'title' element the Splunk UI provides for their widgets. You need to drop down into HTML, for example (highlighted with '**'): <row> <panel> **<html> <div> <h1>Host Count</h1> </div> </html>** <single> <search id="HostsCount"> <query>| inputlookup host_info.csv | search AppTeam="$teams$" AND environment="$environment$" | stats count | rangemap field=count severe=0-0 default=guarded</query> </search> <option name="classField">range</option> . . . </single> </panel> </row> ... View more

When setting up your own Custom Alert Action, the payload should have an entry to the search results directly: <results_file>%your_splunk_path%/var/run/splunk/dispatch/scheduler__admin_%a_hash_value%/tmp_0.csv.gz</results_file> As ramabu already listed, here are the docs, http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro ... View more

Thank you. 'append' is a handy tool to have 🙂 ... View more