If you go to KPI base search , under metrics section you will find it or another way is go to services click on any KPI, on 3rd page you will that option.Thanks ... View more

I have two correlation search and two report , both correlation search are schedule to run windows of 1 minute, and both report are schedule to run 5 min, so need to know is this approach is right ... View more

yes it is set like that only , do I need to select scheduled window as well ? ... View more

no need of space ,I have to set report to run every 5 minutes of windows ... View more

Data will come in Index first then python script will check in app if any failure is there then it will create ticket in remedy, note we will not configure configure BMC remedy in Splunk, will send data from splunk to remedy through API ... View more

can I have your email address please I would send you screenshot ... View more

Yes its one panel in which I have add # of life in panel, shown in screenshot ... View more

Hi Giuseppe, Can you guide me what to add in xml Thanks ... View more

Thanks Gcusello , it worked for me rest I would create it Processing Initiated: (?\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.Date Range Processed:\s+yesterday\s+(\s+(?[^ ])\s+.\s+.\s+Detail Level of Output:(?[^ ])\s+Type of Output\/Format:\s+(?.)\s*Logfiles for Host: (?[^ ]*)\s+# ... View more

Unmatched Entries (Only first 100 out of 127 are printed) dispatch err (pipe full) event lost dispatch error reporting limit reached - ending report notification. ... View more

I have to prepare dashboard for each field as mentioned, hence need all values of fields. Kernel Audit Begin : Nee all values of field ... View more

Hi woodcock, I got solution thanks for all your effort index="_internal" component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count, count(eval(eventtype="splunkd-log")) as Splunkd_log_count, count(eval(eventtype="splunkd-access")) as Splunkd_access_count by INCIDENT,SEVERITY ... View more

given command did not worked but below command worked with one issue index=_internal component=Metrics OR component=root OR eventtype=splunkd-log OR eventtype=splunkd-access | stats count(eval(component="root")) as root_count,count(eval(component="Metrics")) as "metrics_count", count(eval(eventtype="splunkd-log")) as splunkd-log_count, count(eval(eventtype="splunkd-access")) as splunkd-access-count Not it should show incident related to component=root, eventtype=splunkd-log, eventtype=splunkd-access , but it is showing some extra Incident which is not related to above fields ... View more

I have removed Incident and severity from command and checked, but its giving all fields of component not specific one. index="_internal" AND (component IN("root", "Metrics") OR eventtype IN("splunkd-log", "splunkd-access")) | eval component=mvappend(component, eventtype) | stats count BY component ... View more

Incident and severity is required ( count is not imp ) ... View more