Looks like you're getting the timeline, not the results. Try switching out getTimeLine for getResults ... View more

Thx very much, it works. ... View more

I've met same problem so what did you do for this problem. can I ask about this problem ? ... View more

I'm running into the same problem when I run the sample from Visual Studio. Do you have any idea where shall I add similar settings when it comes to IIS? ... View more

Hi Laura, Login to your Splunk instance through a browser. Click on Manager > Access Controls > Roles > New, and you can create a role that limits access to indexes. You will find a list of all the available indexes, so you can pick what you want. ... View more

It will include the npm module but then you should have to run 'npm install' from the command line. There are instructions here: http://dev.splunk.com/view/SP-CAAAEFN ... View more

transaction is an answer but I don't know how can I apply this on my search because I have several subsearches. I want to calculate the taux for all the range time. Thx by advance, Laura ... View more

Thx very much for your answer. I look this and try to use that. ... View more

is it possible to pass the same through linkview? like along with the viewname foreg flashtimeline?source=$form.sources$ something like that please help ... View more

Well a single value is a statistical view, how can you present a singlevalue on several lines? Its a "single value" :). The idea is to perform a statistical report such as count, avg etc or to return only one event such as the head event with a head 1 and then output the contents of a field to your singlevalue ... View more

If I understand you correctly, like this: source=tcp:5544 STAT_VE="YES" OR STAT_VE="NO" |eval Transac=case(D_LAB_ERR="TIMEOUT_REACHED" OR D_LAB_ERR="TIMEOUT_REACHED_RECORD","PA Pb fin de session 3D Secure", SD_STAT_PA="NO" AND (NOT D_LAB_ERR="TIMEOUT_REACHED" OR NOT D_LAB_ERR="TIMEOUT_REACHED_RECORD"),"PA Pb Autres",STAT_VE="NO","VE No",STAT_VE="YES" AND SD_STAT_PA="YES","PA Yes",STAT_VE="YES" AND SD_STAT_PA="ATTEMPT","PA Attempt",STAT_VE="YES" AND SD_STAT_PA="NO", "PA No",STAT_VE="YES","VE sans PA") |stats count by PURCH_DATE Transac | eventstats sum(count) AS TransacSum BY PURCH_DATE ... View more

I don't understand your question, but I see a problem in your case statement: yoursearchhere | eval series=case(VE==7,"ok",VE==3,"ko",VE==2,"attempt") | chart count by series,day,hour I assume that day and hour are valid fields for all the events returned by the search? Are you sure that you want a chart and not a timechart? Here is a version that uses the timechart command instead: yoursearchhere | eval series=case(VE==7,"ok",VE==3,"ko",VE==2,"attempt") | timechart span=1h count by series ... View more

Thx for your answer. I have this following problem: source="tcp:5544" | eval Transac=case(D_LAB_ERR="TIMEOUT_REACHED" OR D_LAB_ERR="TIMEOUT_REACHED_RECORD","PA Pb fin de session 3D Secure",STAT_VE="NO","VE No",STAT_VE="YES" AND SD_STAT_PA="YES","PA Yes",STAT_VE="YES" AND SD_STAT_PA="ATTEMPT","PA Attempt",STAT_VE="YES" AND SD_STAT_PA="NO", "PA No")|stats count by PURCH_MONTH,PURCH_DATE,Transac In my search I want to have the Transac in column but with this I have them in line. How can I do to have PURCH_MONTH and PURCH_DATE in line and Transac in column??? Thx by advance, Laura ... View more

You will have to "trick" Splunk into doing this. Splunk assigns colors to a data series, not a data value. So split your search results into multiple series and used "stacked" charts. This answer has more detail: Change Bar Chart Color based on Data Value ... View more

Sorry Laura, how is it not working? Is the view not rendering or are your radio buttons not getting rendered correctly? ... View more

Please make sure you accept this as your answer in the event someone else has an issue similar to yours. Thank you. ... View more

Thanks, worked nicely. ... View more

Well, I'm not entirely sure of the details, but it seems to me like you're asking how you can take a StaticSelect module and incorporate it into the existing XML where you have a TextField and a HiddenSearch module. Here's my attempt at doing that, in just the core XML. Note that while ExtendedFieldSearch has its own weird syntax for specifying "intentions", with the "lister" modules as well as with the StaticSelect module, you have to use the ConvertToIntention module, which has its own weird, different syntax. <module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param> <module name="StaticSelect"> <param name="settingToCreate">Requester</param> <param name="label">field:</param> <param name="staticFieldsToDisplay"> <list> <param name="label">fr18126</param> <param name="value">fr18126</param> </list> <list> <param name="label">a187571</param> <param name="value">a187571</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">Requester</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="Requester"> <param name="value">$target$</param> </param> </param> </param> <module name="ExtendedFieldSearch"> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="st"> <param name="default">count</param> <param name="value"></param> </param> </param> </param> <!-- End param intention--> <param name="replacementMap"> <param name="arg"> <param name="st"> <param name="value"></param> </param> </param> </param> <!-- End param replacementMap --> <param name="field">Param</param> <module name="EventsViewer" layoutPanel="resultsAreaLeft"> <param name="segmentation">full</param> </module> </module> </module> </module> </module> For fun I also threw together an example showing the same functionality but built using the modules in Sideview Utils. Here you'll see a static Pulldown module and a simple TextField module, doing exactly the same thing as the above view, but using Sideview Utils. As you can see, things come out a lot shorter, easier and maybe even a bit more intuitively in Sideview Utils. In any event you wont have to think about 'intentions' anymore ever. <module name="SideviewUtils" layoutPanel="appHeader" /> <module name="Pulldown" layoutPanel="mainSearchControls"> <param name="name">Requester</param> <param name="label">field:</param> <param name="staticFieldsToDisplay"> <list> <param name="label">fr18126</param> <param name="value">fr18126</param> </list> <list> <param name="label">a187571</param> <param name="value">a187571</param> </list> </param> <module name="TextField"> <param name="name">st</param> <param name="label">Param</param> <module name="Search" layoutPanel="mainSearchControls"> <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param> <module name="EventsViewer" layoutPanel="resultsAreaLeft"> <param name="segmentation">full</param> </module> </module> </module> </module> </module> There are other strange things about this view, but for the sake of brevity I wont comment on them since they don't pertain to your actual question. ... View more

You have to download the Sideview Utils app. 1.3.X you can get from splunkbase ( http://splunk-base.splunk.com/apps/36405/sideview-utils ), and you can get a free trial of 2.0.X from Sideview ( http://sideviewapps.com/apps/sideview-utils/ ) ... View more

I would try this: Instead of stats, use timechart. That will retain the buckets with no results, which is the root of your problem. Then you can apply the rangemap, eval date_hour, and apply your final eval. Like the following: source="tcp:5543" Requester="uka*" hostname="L05236" earliest=@h latest=now | timechart span=1h count | rangemap field=count severe=0-0 elevated=1-50 default=low | eval date_hour=strftime(_time, "%H") | eval range=if(date_hour > 00 AND date_hour < 13 AND count > 11, "low",if(date_hour >= 14 AND date_hour < 24 AND count > 11, "severe", range)) ... View more

It's perfect thx very much. ... View more

You have to convert simple xml to advanced xml. ... View more

It's worked very well. I put count>11 because I change my criterias. I just put count because count allows to count the number of events returns by the search and it's exactly that I want to do. Thanks very much to your help. Laura ... View more