This is my data from with html tags. This is just single line. 03/<tr class="mtx" style="text-align:right;"><td style="white-space:nowrap"><div class="a_print"><a href="hourly_s1.php?prec_no=44&block_no=47662&year=1980&month=03&day=1&view=p1">1</a></div></td><td class="data_0_0">997.3</td><td class="data_0_0">1001.6</td><td class="data_0_0">13.5</td><td class="data_0_0">5.5</td><td class="data_0_0">1.5</td><td class="data_0_0">9.1</td><td class="data_0_0">14.2</td><td class="data_0_0">4.5</td><td class="data_0_0"> 59</td><td class="data_0_0"> 40</td><td class="data_0_0">6.5</td><td class="data_0_0">13.6</td><td class="data_0_0" style="text-align:center">–k–k¼</td><td class="data_0_0">24.6</td><td class="data_0_0" style="text-align:center">–k</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0" style="text-align:left">‰J</td><td class="data_0_0" style="text-align:left">~ ‚È‚µ</td></tr> The time of this data consists of three pieces of information: year=, month=, and date=. So, I just use custom DATETIME_CONFIG to ingest the data but it doesn't work. This is my created .xml file. <datetime> <define name="test" extract="year, month, day"> <text><![CDATA[(?year\=(\d{4})&month\=(\d{2})&day\=(\d{1,2})]]></text> </define> <timePatterns> <use name="test"/> </timePatterns> <datePatterns> <use name="test"/> </datePatterns> </datetime> I think there is no grammatical error because there was no error at splunk restarted. How do I index one _time field from three separated time data at index time? Thank you, ... View more

The date are all number field, such as cluster, field_1, field_2, field_3, field_4, field_5 1 3 56 6 767 8 1 56 6 5432 5 7 2 6 65 987 356 6767 2 65 56 4321 4 56 3 3 5656 65 56456 56 I'd like to calculate min/max/avg/stdev of each line. I understand that can stats min() max() avg() stdev() by xxxx, but stats returned like min(field_1) max(field_2) avg(field_3) ..... as new column. But, I want display min/max/avg/stdev on each line just like tableau or excel pivot table function. For example, new_field, field_1, field_2, field_3, field_4, field_5, min 3 6 6 5 7 max 30 31 2,719 386 8 avg 30 31 2,719 386 8 stdev 37.47 35.35 3836.76 538.81 0.707 I mean, stats can calculate in parallel but I want to calculate it vertically. Anyone have any idea? If I could, I'd like to group by cluster number with min/max/avg. Thanks, ... View more

Webアクセスのデータの中にURL Link情報（例えばreferer)データの中に、例えば、www.splunk.comという文字があったとします。 ダッシュボード内に、table refererというデータを表示することで、このURL一覧が表示できますが、このrefererをクリックすることで、splunkの検索ではなく、実際の外部リンクに直接アクセスすることは可能でしょうか？ 補足：workflowアクションでは、$!referer$で実現できることはできましたが、ダッシュボードから直接リンクをクリックしてアクセスしたいと考えております。 よろしくお願いいたします。 ... View more