Hello Community,  I am looking to Plot a line chart to compare against 2 time ranges by a specific field. This is for JIRA metrics. For example I have 3 fields Created_time  2020-10-29T03:49:09.000-0700 resolved_time 2021-01-06T15:26:23.000-0800 Ticket: ABC123 Show a line chart with 2 legends created_time, resolved_time by ticket.  This will help me compare against when a ticket opened vs closed. ... View more

F5 Networks - Analytics(New) App failed cloud vetting and revoked the certification mentioning about performance issues on indexers due to scheduled searches and accelerated data models being run. Posting it here as I didn't see developer details any where for contacting. Questions I have is: Is there any plan of fixing existing issues mentioned by Splunk and getting this app Certified? Any alternatives we could better use this app? Thanks ... View more

Hi, We have 2 inputs 1 .Input has some base search and it gives some time value(consider peak time) Ex: time value is as 03/21/2016 09:00:00 2nd Input is time picker, We need to pass peaktime on to time picker as earliest time and latest time should be 1min greater than earliest time. Ex: earliesttime = 03/21/2016 09:00:00 and latesttime = earliesttime + 1min(03/21/2016 09:01:00) All dashboard panels will take 2nd input as time value. Can someone please help us with this customization? Thanks ... View more

Hi, We are looking to have my file name more readable and that being said FIlename looks like below and need to trim last 8 spaces. Below is format my file name looks like and needs to display as data_20130701105312.txt and data_list2 data_20130701105312.txt a s o r team_1 ssh 0 * data_list2 b s o r team_2 ssh 0 * Thanks ... View more

Hi We need to extract file name from a URL. But URL in the log files have different formats or it has multiple spaces for few as below. Can someone please help us with extraction. In the below format 1.it has space after /log(here file name should be data.csv) /home/data/var/log/ data.csv 2.It doesn't have space after log /home/data/var/log/data.csv 3.It has space with after log but file extension is different.(here file name is (data2015067987.dat) /home/data/var/log/ data2015067987.dat /home/data/var/log/ 201608587data.csv 4.It has multiple spaces after/log (here file name is data data2 data3) /home/data/var/log/ data data2 data3 Thanks ... View more

Hi , We need fields to be extracted from below log events, tried but facing some trouble as some of the log events are different from others. All of these are logs from single access_log file,tried using CIM but this doesn't worked for us. ^(?:[^\]\n]*\])\s+(?P<host_apache>[^\s]+)\s+(?P<clientip>[^\s]+)\s+(?P<remoteaddr>[^\s]+)\s+(?P<forwardedfor>(\-|\d+\.\d+\.\d+\.\d+\,?\s?)+)\s(?P<trueip>[^\"]+)\"(?P<request>[^\"]+)\"\s(?P<status_new>\d+)\s(?P<bytes>[^\s]+)\s(?P<time_taken>\d+)\s\"(?P<referer>[^\"]+)\"\s\"(?P<cache_control>[^\"]+)\"\s\"(?P<user_agent>[^\"]+)\" Below is the events and we need to extract : trueip,Method,URI,status fields from below. Can you please help us? Highlighted and Emphasis are the fields required to change. [2/Jun/2009:07:36:19 -0600] secure.com 196.49.49.36 196.49.49.36 ***10.19.48.71***, 57.28.75.174 57.28.75.196 ***GET*** ***/api-dual/us*** HTTP/1.1 ***200*** 2013 0.764 https://secure.chas.com/ no-cache, max-age=0 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 Chrome/55.0.2883.8537 Safari/7.310.4031EB0C1D8BE068A9BD600440A5D792 jcXr-RtOQKZS804wxfPLCFZ3 - Web ---------------------------- [2/Jun/2009:07:36:19 -0600] api.co.us 196.49.49.36 ***196.49.49.36*** 10.19.48.71 - ***POST*** ***/api-dual/menu/Identity*** HTTP/1.1 *200* 47 0.659 - no-cache Apache CXF 3.1.0 - - - - ------------------------------------------------------------------------- [2/Jun/2009:07:36:19 -0600] 196.49.49.47 ***196.49.49.47*** - ***GET*** ***/**api-login/*** HTTP/1.1 ***200*** 163 0.002 - - - - - - - ------------------------------------------------------------------------------ [[2/Jun/2009:07:36:19 -0600] secure.com 196.49.49.47 ***196.49.49.47*** 10.19.48.71, 57.28.75.174 57.28.75.196 ***GET*** *****/api-dual/accounts/?status=Posted&toDate=2009-06-02&fromDate=2009-06-24&channelType=Mobile&action=next*** HTTP/1.1 ?status=Posted&toDate=2009-06-24&fromDate=2016-09-24&channelType=Mobile&action=next ***200*** 13898 0.194 https://secure.com max-age=0 Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_5 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Mobile/13G36 F72AEE043E08F5020E2F5A84F58774EE zKplRZORI+gYDxth6rxIj8rZ -chs26 Thanks ... View more

HI We need to create a new field for file name and this is to be extracted from path we have. We need to extract last segment from below path which is jst_cat_20170119164505.xfr from below path . Format of path is as below /home/ist/user/dealer/jst_cat_20170119164505.xfr /home/dlr/user/ist_cat_20116091456.xfr.pdt /home/dlr/user/ist_cat/dealer/files.20160910.txt /home/dlr/user/ist_cat/dealer/files.20160910.txt.pdt Thanks ... View more

Hi, We are looking transform fields from log events, can some one please help. we need to translate to below codes: I = Upload j = Errored k = Aborted o = Successful p =Errored q = Aborted In the below example "i" in bold is where we need to translate. sat dec 13 10:01:17 2017 0 10.01.42.1 42288 /home/cat/wat/g1/T24_94291_20170113_093008_20161213110014510.txt b s **i** r user 0 * Thanks ... View more

Hi, We need to ingest standard output that generated from script from one of the host and ingest that information to splunk ? Scripts located at below location: /logs/ibm/mqm/qmgrs.ksh . If we give below stanza to my inputs.conf will it gather information: [script://./logs/ibm/mqm/qmgrs.ksh] interval =500 sourcetype = qmgrs source = mqm index = mqm disabled = 0 KIndly help us. Thanks. ... View more

Hi, Can we upgrade SH version of 6.1.2 to 6.5 while we are planning to continue other components (Indexer,Deployer) still on 6.1.2 versions? I am looking at documentation, but didn't find a solution for this, can someone please suggest us? http://docs.splunk.com/Documentation/Splunk/6.5.1/installation/Upgradeto6.5onUNIX Thanks ... View more

Hi , We are looking to create an alert if for any reason a search head went down. This is for our Splunk Enterprise Security search head, since we have only one search head is available in our environment, we are looking to create an alert if the ES search head goes down. Thanks ... View more