I am using REST API search endpoints to invoke a search. When the search completes, I get a SID from the json response. I then create an email with the search result. In additional, I want to include a hyperlink in the email that will take me to splunk displaying the same result (with the same criteria including the time window). Can I use the SID to do this (as long as the SID hasn't expired)? ... View more

I have a stats command that correctly formats the count field. stats count by method client | fieldformat count=tostring(count,"commas") However, when I add | xyseries method client count , I lose the nice formatting. I try to rearrange the fieldformat clause to the end, but that didn't help. I get no formatting at all with the numbers. I might as well just use chart count over . The reason I use stats with xyseries is that I thought I can format the numbers this way. ... View more

I want to get a list of ip and then feed that list into 3 subsequent searches that will each produce a count by column and end up with a table like: ip countA countB countC 1st search: index=test source=ip-log ip | table ip | sort ip 2nd search: index=test source=logA *ip-list-from-1st-search* patternA | stats count as countA by ip 3rd search: index=test source=logB *ip-list-from-1st-search* patternB | stats count as countB by ip 4th search: index=test source=logC *ip-list-from-1st-search* patternC | stats count as countC by ip I can combine the 1st and 2nd search with subsearch and produce a table ip, countA. But I don't know how to chain in the 3rd and 4th searches since their events only have ip but not countA. I've also played with appendcols but the problem there is I have to re-execute the 1st search for every appendcols subsearch. So how do I pass the result of the 1st search into 3 subsequent independent searches and stitch the columns into one table? ... View more

I have a list of IPs that I'd like to use as input to a saved search. Instead of manually typing (ip=x OR ip=y OR ip=z), if I have a csv file on my local drive with a single column of IPs, is there a way for the saved search to dynamically import the IPs? I've look at inputcsv but that seems to expect the csv to reside on the server. I want to pull the csv from my local disk, or write a form that prompts for the location of the csv on my local disk. ... View more

I have a saved search that uses "stats count by xyz" which produces a simple table search result. Is there any way I can add a legend or text block to the search result to clarify the column names? I want to add text that says "response time is in milliseconds and throughput is requests/second". ... View more

I have stats output some numbers like min, max, avg. The numbers are left justifed and make it really hard to read. Is there a simple way to make the numbers right justified without using CSS? Less desirable would be pad with leading zeros. Is that possible? ... View more

I have a timechart that plots response time by source: index=myidx duration | timechart avg(duration) by source Because the name of the source are long, the legend on the right hand side of the plot takes over half the panel, squishing the chart to the left. Is there anyway I can do a "basename" of the source path, using just the file name, omitting the directory path? I suppose I could assign a specific sourcetype for each file but I'm hoping I can just somehow regex basename of source. ... View more

Does drilldown work with IE 6? I have a lot of trouble with drill down in IE which does not happen in FF. Problems include no matching event (when FF found them) and can't do show source when an event is found. I’ve capture the URLs in this example. IE returns nothing when FF found 1 event. Event: 2011-04-05 16:30:34,971 WARN [status.driver:ajp-0.0.0.0-8009-92] - filer=***5284 authCode= year=2009 app=null test=false. Using 'NA' for authCode Splunk Query: index=myindex host="myhost*" " WARN [" | rex "(?i)[\d\s\w]+\[(?P[^\]:]+)" | search LOG_SOURCE="status.driver" IE: https://mySplunkServer/en-US/app/search/flashtimeline?q=search%20index%3Dmyindex%20host%3D%22myhost*%22%20%22%20WARN%20%20%5B%22%20%7C%20rex%20%22(%3Fi)%5B%5C%5Cd%5C%5Cs%5C%5Cw%5D%2B%5C%5C%5B(%3FP%3CLOG_SOURCE%3E%5B%5E%5C%5C%5D%3A%5D%2B)%22%20%7C%20search%20LOG_SOURCE%3D%22status.driver%22&earliest=1302045780&latest=1302049433 Firefox: https://mySplunkServer/en-US/app/search/flashtimeline?q=search%20index%3Dmyindex%20host%3D%22myhost*%22%20%22%20WARN%20%20[%22%20|%20rex%20%22%28%3Fi%29[\d\s\w]%2B\[%28%3FP%3CLOG_SOURCE%3E[^\]%3A]%2B%29%22%20|%20search%20LOG_SOURCE%3D%22status.driver%22&earliest=1302045780&latest=1302049433 ... View more

I have two related saved searches, both configured with email alert, so I get two separate emails. Is there anyway to consolidate into one email? In other words, I'll like to get one email that will include the search results for both searches. ... View more

I think I am running a regular forwarder but I see these in the metrics.log: 01-12-2011 01:29:21.021 INFO Metrics - group=pipeline, name=parsing, processor=send-out-light-forwarder, cpu_seconds=0.000000, executes=36, cumulative_hits=221543 01-12-2011 01:29:21.021 INFO Metrics - group=pipeline, name=parsing, processor=tcp-output-light-forwarder, cpu_seconds=0.000000, executes=36, cumulative_hits=221543 Where are the configurations for processor=send-out-light-forwarder or tcp-output-light-forwarder? I think this is why my event data filtering is not working. I start splunk by: ./splunk enable app SplunkForwarder That should start the regular, not light, forwarder, right? ... View more

I need to filter out certain unwanted events and send them to the nullQueue. I added this in props.conf: [access_logs] TRANSFORMS-proj = Filter_ping and this in transforms.conf [Filter_ping] REGEX = Request\:ping DEST_KEY = queue FORMAT = nullQueue This is working perfectly in one env (splunk client+server) but not working in another env. Since the conf files are the same as are the versions of the splunk forwarder and servers. I'm at a lost as to why this filtering fails on the 2nd env. Any suggestion as to how to debug this? splunkd.log looks normal. I verified that sourcetype access_logs is correct. Anywhere I can look to see what filtering the forwarder has loaded? TIA ... View more