You cas specify and increase job lifetime period https://docs.splunk.com/Documentation/Splunk/latest/Search/Extendjoblifetimes ... View more

Try to use rename [your_search] | rename "A:*" as "*:A", "B:*" as "*:B" ... View more

you can change lookup manually but better on my mind create a scheduled search which will populate your lookup using outputlookup command ... View more

You can create a lookup with banned words named stop_words.csv and use it as condition for your search somethink like this your_search [| inputlookup stop_words.csv | return 10 $banned_words] ... View more

Sure it is best practice to send data to undexer layer please look at the docs http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/Forwardsearchheaddata ... View more

[base of your search ] earliest=[ search ...search_to_restrict_session_start_date| eval date=strptime(Session_Start_Date, "%m/%d/%Y") | eval date=relative_time(date, "+1mon@mon") | return $date]... So you will get events starting from the beginning of next month after selected Session_Start_Date ... View more

You can do it using drop-down menu clicking Event Actions=>Extract fields with Regex generator to generate regexp. ... View more

try this command | eval n=mvcount(myfield) ... View more

Try to use Splunk Machine Learning Toolkit App especially built-in TFIDF(term frequency–inverse document frequency) numerical statistic after that you can use word cloud viz. ... View more

Try to use standard color options for table: Color>Ranges http://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsFormatting ... View more

to clarify we done it with transforms.conf and props.conf as we used automatic lookups and did not tested it with transforms.conf only. So our configs was same as in example: props.conf [yoursourcetype] LOOKUP-user = userlookup user OUTPUT username transforms.conf [userlookup] filename = userlookup.csv match_type = WILDCARD(user) ... View more

We used it only with props.conf ... View more

I have done it according this answer and it works https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html ... View more

I think you should start from reading the docs https://docs.splunk.com/Documentation/Splunk/6.5.3/Installation/HowtoupgradeSplunk And here you can find info about downgrading for Unix for example(rollback) Splunk Enterprise does not provide a means of downgrading to previous versions. If you need to revert to an older Splunk release, uninstall the upgraded version and reinstall the version you want. ... View more

Sure, you are right "index=abc sourcetype=abc OR index=abc sourcetype=pqr" should be changed to something like "index=abc (sourcetype=abc OR sourcetype=pqr )" ... View more

Looks that "if" has no sense because "fields" command deleted sourcetype field and mycount is always equals to "1" ... View more

Maybe this would helpful index=abc sourcetype=abc OR index=abc sourcetype=pqr | stats count as Count by ID | join type=left ID [search index=abc sourcetype=abc | stats latest(userName) as userName by ID] | table userName ID Count ... View more

Sure, thanks to dineshraj9 "abc" should be deleted in base search Also about report speed, for example you can filter excess events and accelerate your search http://docs.splunk.com/Documentation/Splunk/6.6.0/Report/Acceleratereports#How_reports_qualify_for_report_acceleration ... View more

| sort - limit=10 realDate_status ... View more

Looks that you should stats by united field realDate_status try to change | chart count(eval(realDate==dateCreated)) as Opened count(eval(dv_state=="Closed")) as Closed over realDate by priority to something like | eval status=case(realDate==dateCreated, "opened", dv_state=="Closed", "closed") | eval realDate_status=realDate."_".status | eval priority_high=if(priority=="High","1",NULL) | eval priority_normal=if(priority=="Normal","1",NULL) | stats sum(priority_high) as High sum(priority_normal) as Normal by realDate_status | sort - limit=10 which will give you result similar to your expectations ... View more