Hi Bhunavana, take this example: index=_internal [| gentimes start=-1 | eval source="foo.boo-" + strftime(now(), "%Y-%m-%d") | return source] this will translate to this Splunk litsearch: litsearch index=_internal source="foo.boo-2015-02-03" So using your provided search try something like this: index=test [| gentimes start=-1 | eval source="/env/transactionlog/aaa_Logs/TL_aaa_WUCARD_LOOKUP_" + strftime(now(), "%Y-%m-%d") + ".xml" | return source ] | rex field=_raw "(?P[^<]+)" | stats count by Tran Hope this helps ... cheers, MuS ... View more

As long as you've properly setup internal log forwarding as per best practices... this search will show the python logs. index=_internal sourcetype=splunk_python ... View more

The problem is about ": : : ". How to fix it???? ... View more

Hi @Bhuavana Looks like someone answered that question in your other post. http://answers.splunk.com/answers/200608/what-are-the-differences-between-splunk-db-connect.html Seems like that had experience with the jdbc scripted input app when it still existed, but as of now, there is only Splunk DB Connect which is more all encompassing. ... View more

The splunk db connect lets you enrish and combine your machine with database data While jdbc scripted input app it is app use to querying database (Sql server logs) ... View more

Correct me if I am wrong but tcph is mentioned as a database name in the above link. right? Apart from that did you follow the instructions and restatred splunk after making those changes stated in the above document?? ... View more

hi Bhuavana, ClientIp=\d{12}\s\:\s\-\s(?P<msg>(.|\r)+?)\(No\ssuch\sfile\sor\sdirectory\) please try this... Thanks, Venkat ... View more

I need to extract message like [for ex: Exception while getting fileApolloWhitelistedCredentials.properties ResourceHandler:getConfirationProperties() java.io.FileNotFoundException: /apps/mobiliser5.1.0/02/money/conf/ApolloWhitelistedCredentials.properties (No such file or directory] from above logs. Similar to above text, from above logs text which starts next to : - and ends at [at] ... View more

Hi Bhuavana, In the below code I have performed the dynamic drilldown by passing the exceptiontype as token. You just need to include the stanza .. <chart> <searchString>index=test exception_type=* | timechart count by exception_type</searchString> <earliestTime>0</earliestTime> <latestTime>now</latestTime> ..... <drilldown> <link>/app/your_app_name/your_next_dashboard?form.exceptiontype=$click.name2$</link> </drilldown> </chart> ... View more

Thanks a lot.. above solution is worked... ... View more

thnx for your reply ... View more

You can find it out by copying that section in regex101.com and playing around. I found this: During searchtime: | rex "name:\s(?<DBname>\S+)" Or in the field-extractor (?m)name:\s(?<FIELDNAME>\S+) ... View more

By hiding do you mean hide chart untill drilldowm event occurs?? In that case you can use the depends-rejects while setting tokens. Documentaion : http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/PanelreferenceforSimplifiedXML#set You alsa have a similiar example in Splunk 6 Dashboard Examples App. ... View more

I need to hide 2nd chart based on the stats count value of one chart[the charts are placed up and down]. In Splunk 6.0 i have used html code to achieve this. But in 5.0.2 i dont have option to do. ... View more

Hi Martin, Thanks for the update. I have applied the logic based on above code and it worked out. Thanks again! ... View more

Try the following: search1.startSearch(); var revisionlabel= search1.data('results'); revisionlabel.on("data", function() { var findrevisionlabel = revisionlabel.data().rows; var output=findrevisionlabel [0][0]; }); ... View more

Im using Splunk 6.0 ... View more

Have a look at this. (advanced xml with sideview util 2.0 or above) http://answers.splunk.com/answers/54481/can-i-hide-and-show-the-modules?page=1&focusedAnswerId=67916#67916 ... View more

Take a look at the outputlookup command: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/outputlookup ... View more

Hi could you please share me your above sample code? ... View more