Scheduled report: index=_internal source="*scheduler.log" log_level=ERROR | eval user=mvindex(split(savedsearch_id, ";"), 0) | eval app=mvindex(split(savedsearch_id, ";"), 1) | eval search=mvindex(split(savedsearch_id, ";"), 2) | stats count by user, app , search, message Failed search: index=_audit action=search has_error_warn=true fully_completed_search=false   ... View more

where can I download i18n.js ... View more

Hi @rsathish47 , Did you find any solution for file upload functionality? ... View more

Could you please send me the final query.i am little bit confused. ... View more

not working ;( ... View more

we are running on Splunk 6.4.1. we run given rest call same out put yep it is for only one index server ... View more

This one was fun (mostly because I enjoyed the brain-teaser of figuring out what exactly you were doing to get the shown outcome): |makeresults | eval raw="1-Jan A::2-Jan B::2-Jan B::3-Jan C::2-Feb A::1-Mar V::2-Mar B::3-Mar C" | makemv delim="::" raw | mvexpand raw | rename raw AS _raw | rex "(?<Name>\S+)\s+(?<Value>.*)" | fields - _raw _time | rename COMMENT AS "Everything above is faking the data; Everthing below is your solution" | rex field=Name mode=sed "s/^\d+\-//" | eval Name=strftime(strptime(Name . " 1 2017", "%b %d %Y"), "%m") | sort 0 Name | stats values(Value) AS Value BY Name | streamstats values(Value) AS Value | stats dc(Value) AS Value BY Name | fieldformat Name=strftime(strptime(Name . " 1 2017", "%m %d %Y"), "%b") ... View more

See if this gets you started | rest /services/search/jobs count=0 splunk_server=local | table sid custom.search dispatchState ... View more

When you hit an assertion or other crash condition, and you are running on something that is not the latest patch level for the release you are on - update first, then seek help from the community and/or support. There have been 8 public releases of Splunk 6.3 over the last year since Splunk 6.3.0 originally dropped.. Currently Splunk 6.3.8 is the latest, and the change logs (http://docs.splunk.com/Documentation/Splunk/6.3.8/ReleaseNotes/6.3.8) show it has dozens of fixes put in cumulatively to solve issues found. The community is glad to help, but make sure you make the most of other people's time they contribute by attempting the easy fixes like upgrading first. ... View more

Thank You ... View more

Splunk roles are not indexed. That is why the REST command is there. ... View more

You need the concurrency command: http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Concurrency Probably like this (untested: may need to use %e instead of %d 😞 ... | eval Created_epoch=strptime(Created, "%b-%d) | eval Closed_epoch=strptime(Closed, "%b-%d) | duration = coalesce(Closed_epoch, 99999999999999999) - Created_epoch | concurrency start=Created_epoch duration=duration | stats max(concurrency) AS OpenTic BY Created | rename Created AS Month ... View more

Not sure what you mean by that. Multiple fields as in different field names or multiple values per field? Can you give me an example? If you post your XML and the result you are expecting it might be easier. Short answer anyway: yes you can extract multiple field names from your XML and also multivalue fields (see this) ... View more

can we use like this [monitor://d:\*ogs\TV_Engine.log] ... View more

It is unclear but maybe you can get what you need from the Data Summary : http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutthesearchapp#Data_summary ... View more

thank you sduff .. will try that. ... View more

I got the link http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Listofpretrainedsourcetypes ... View more

Like this: ... | eval now=now() | eval date_wday=strftime(now, "%a") | eval weekday=if(date_wday="Sat" OR date_wday="Sun","NO","YES") | eval date_mday=strftime(now, "%d") | eval tomorrow=now+86400 | date_mday_tomorrow=strftime(tomorrow, "%d") | eval monthend = if(date_mday>date_mdate_tomorrow,"YES","NO") | fields weekday monthend ... View more

Thank you laserval, ... View more