About paulf

melting · ‎09-20-2012

Issue 1: jscharts like Ayn said has limitations both around browser performance as well as pixel density. This page in our docs tries to explain more about this. There are a few ways to customize this, but I would try using a smaller timerange if you want the small spans. Issue 2: I answered a similar question here: Essentially you can use eval in the timechart cmd. ie: ... | timechart span=3s eval( 1000 * avg(Value)) as field

jonuwz · ‎08-29-2012

I've not seen an option that allows you to do that from the search bar

ahall_splunk · ‎08-15-2012

There is no support for Exchange 2003 in the Splunk App for Microsoft Exchange. If you want to bring in the Message Tracking logs, then be aware that the message tracking logs are incomplete. Specifically, messages that originate and end on the same message store are never recorded. However, they are in the same general format as the message tracking logs for Exchange 2007 and 2010 - just different positions for the fields. Take a look in the props.conf / transforms.conf of the Splunk App for Microsoft Exchange to see an example of how to do it, then look at the first 5-6 lines of a typical message tracking log and match up the field names. This will provide you with an extraction.

kristian_kolb · ‎08-09-2012

This should do something like what you want; ... | timechart span=1m c(eval(HasError=1)) AS err c AS tot | eval err_ratio_perc = round(err/tot*100,0) the round() and multiplication by 100 are not necessary, but produces '16' instead of '0.16000' Hope this helps, Kristian

paulf · ‎07-11-2012

Hi, Thanks! that has resolved my issue...

Posts	8
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎05-16-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Timechart & Span

Weekdays on Timechart

Splunk App for Microsoft Exchange "2003"

Percentage Timechart

Multiple Lookups from Sourcetype

Re: Timechart & Span

Re: Weekdays on Timechart

Re: Splunk App for Microsoft Exchange "2003"

Re: Percentage Timechart

Re: Multiple Lookups from Sourcetype

Are you a member of the Splunk Community?