This was the right answer.  This will work for most data sets.  You just need to sort by your aggregates first, then _time.  Be sure to put the 0 in the sort so you don't hit the sort limit. Did this with a massive query and it solved my reset issue. ... View more

This worked for me - gives change and the total in a single panel   |tstats count where index=office365 by _time span=15m | streamstats sum(count) AS TOTAL | fields TOTAL     ... View more

In Splunk Cloud we get this and the capability does not appear to be able to be added to any role.  I get this while logged in as sc-admin and specifying splunk_server=local.  It's aggravating my C level to see the stupid error. ... View more

Thanks for pointing this out! Especially 4. is a no-go for uns. @Splunk: Any news on this? Support for named capture groups in transforms should also work for metric dimensions. ... View more

Thanks @niketnilay, using earliest & latest in the search query actually did the trick! ... View more

That's what i thought too at first, but the error is only reported for emtpy data files. I'm pretty sure splunk can access the conf files because it applies the various settings specified in the files just fine. ... View more

PERFECT. Please upvote my answer and have a nice day. ... View more

See https://answers.splunk.com/answers/616340/is-it-possible-to-use-base-search-in-append-sub-se.html Simply append multiple loadjobs for multiple base searches. Also see: https://answers.splunk.com/answers/738095/dashboard-search-optimization-only-run-searches-wh.html ... View more

Hi gmahe, We opened a support ticket for this and encountered something strange while doing a remote session: The dashboard actually works when used via a Remote Desktop Connection. I opened a RDP connection to my workstation, refreshed the dashboard which has already been loaded by the browser and everything worked as expected. I disconnected and tried using the dashboard directly on the workstation and the faulted behavior could be observed again. No that we've upgraded to 6.4.3 we can't observe the faulty behavior anymore. ... View more

It seems like the documentation explaining how splunk handles precision has been removed; http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Eval is the last version containing the section Significant figures and precision which is pretty important IMHO. ... View more

I have documented a workaround to use an independent search to set tokens based on option/s selected in the checkbox. It uses only Simple XML Dashboard, NO JAVASCRIPT CHANGES REQUIRED 🙂 https://answers.splunk.com/answers/681330/can-i-hideunhide-specific-text-boxes-using-a-singl.html?childToView=682360#answer-682360 Please try out and confirm! ... View more

nope, sorry but it didn't matter because it was only playing around with my netatmo and the test splunk at home. ... View more

Seconding this question above-- is there a parameter we can get rid of, to get rid of these messages? ... View more

We now use two separate indexes (A and B). Events with sensitive data are re-routed to index B while all others go to index A. A saved search uses summary indexing to select all events from index B, removes fields with sensitive data and adds them to index A. A configuration stanza in props.conf ensures all fields are set to their original values, this way users can search for events as usual. Obviously summary indexing adds a slight delay (WCET 2 minutes in hour case). Thanks for pointing me in the right direction! ... View more

I found a workaround: * | search (date_hour!=13 OR date_minute<50 OR date_minute>55) But to be honest, I have no idea why this works... ... View more

Thanks a lot - that's exactly what I was looking for. ... View more

Note: Splunk_TA_windows v4.8.0 was released. The same issue still exist. ... View more

I've created a custom search command xpath2 based on the xpath command which supports XML namespaces and also allows me to extract multiple fields. I'm able to extract all the required fields, properly unescaped. But now I'm facing another problem: How to invoke my custom search command from props.conf or transforms.conf ? ... View more

Adding [my_sourcetype] # ... EVAL-ip = null EVAL-uri-query = null # ... will also hide the original fields. ... View more

I know this a (very) old question/answer, but: I see that our Splunk indexer spends most cpu_seconds for the parsing sendout processor. What exactly does it do? The amount of cpu_seconds for all other processors is magnitudes lower. May this indicate a resource problem? ... View more