i have 5 search queries as above, i would like to have filtering option on A, B,C, D,E. which are on same chart. is it possible? ... View more

index=y host=x source="abc.log" sourcetype=xyz (tab="x" OR tab="y") |timechart span=1mon first(p) by tab |addtotals |fields _time, Total |rename Total as "A" |appendcols [search index=y host=x source="abc.log" sourcetype=xyz (tab="d" OR tab="l") |timechart span=1mon first(p) by tab |addtotals |fields _time, Total |rename Total as "B"] |appendcols [search index=y host=x source="abc.log" sourcetype=xyz (tab="m" OR tab="n") |timechart span=1mon first(p) by tab |addtotals |fields _time, Total |rename Total as "C"] |appendcols [search index=y host=x source="abc.log" sourcetype=xyz (tab="p" OR tab="q") |timechart span=1mon first(p) by tab |addtotals |fields _time, Total |rename Total as "D"] |appendcols [search index=y host=x source="abc.log" sourcetype=xyz (tab="r") |timechart span=1mon first(p) by tab |addtotals |fields _time, Total |rename Total as "E"] ... View more

Thanks Ehud, this was helpful! ... View more

Thanks morley, this query works for events starting with uptime 0 to some value, if server restarts, uptime starts from 0. for this scenario, the uptime calculation doesn't workout! [2017-02-09 04:53:27,006]: host="infor-gtnalpq-msa1-1" , uptime="327" [2017-02-09 04:53:28,006]: host="infor-gtnalpq-msa1-1" , uptime="328" [2017-02-09 04:53:29,006]: host="infor-gtnalpq-msa1-1" , uptime="329" [2017-02-09 04:53:30,006]: host="infor-gtnalpq-msa1-1" , uptime="330" [2017-02-09 04:53:34,006]: host="infor-gtnalpq-msa1-1" , uptime="0" [2017-02-09 04:53:35,006]: host="infor-gtnalpq-msa1-1" , uptime="1" [2017-02-09 04:53:36,006]: host="infor-gtnalpq-msa1-1" , uptime="2" [2017-02-09 04:53:37,006]: host="infor-gtnalpq-msa1-1" , uptime="3" [2017-02-09 04:53:38,006]: host="infor-gtnalpq-msa1-1" , uptime="4" ... View more

example splunk events below: timestamp=15-01-2016 02:05:34.00, uptime=1231 timestamp=15-01-2016 04:07:22.00, uptime=2398 timestamp=16-01-2016 06:03:15.00, uptime=198792 if the servecr is restarted the uptime counter starts from 0. Based on these events, i need to calculate the % uptime , % downtime for the server. Could you please assist. ... View more

Thanks, I have edited the XML source as which will refresh my dashboard every 5 minutes. Does this mean the query behind dashboard will be executed only once in 5 minutes? Please let me know how do I schedule a dashboard (suppose I want to run DMV query at specific time), I can scheduling only for Alerts, when I save a search string as an alert, I get option to schedule it. But not for a Dashboard panel. ... View more

Thanks ryanconnor. I have a sql query which gives me list of long running queries. Below is the query. Can I represent this output in line graph, if yes, how can I do it? Please help me SELECT TOP 100 qs.total_elapsed_time / qs.execution_count / 1000000.0 AS average_seconds, qs.total_elapsed_time / 1000000.0 AS total_seconds, qs.execution_count, SUBSTRING (qt.text,qs.statement_start_offset/2, (CASE WHEN qs.statement_end_offset = -1 THEN LEN(CONVERT(NVARCHAR(MAX), qt.text)) * 2 ELSE qs.statement_end_offset END - qs.statement_start_offset)/2) AS individual_query, o.name AS object_name, DB_NAME(qt.dbid) AS database_name FROM sys.dm_exec_query_stats qs CROSS APPLY sys.dm_exec_sql_text(qs.sql_handle) as qt LEFT OUTER JOIN sys.objects o ON qt.objectid = o.object_id where qt.dbid = DB_ID() ORDER BY average_seconds DESC; ... View more

Thanks muebel, Our test environment meets all these requirements. Thing is test env still has splunk 6.1 version. I'm not sure if this issue has anything to do with the version. ... View more

Thanks sanders, the issue is not with the permissions. dbconnect permission was already enabled. ... View more

I'm able to create an identity and a connection, the connection is validated. But the JRE status is still red. What does this mean? The Health monitor in the DB Connect app redirects me to the error page: XML Syntax Error: Cannot find object mapper for panel type. I'm using splunk 6.1 in one of the test environment. In my local machine I am using 6.4 with which I don't see these issues. Is there a fix for JRE status in the latest version? ... View more