About jackyc

jackyc · ‎01-03-2011

Hi all, I have a month (2010-Nov) SAR reports (30 copies) for my host which I want to import them to the Splunk server. For testing purpose, I first import one SAR report to the Splunk and it can be successfully imported. But the event time is today not two months ago, can I change the index time back to the actual occurs time? Since I need to search for (2010-Nov)'s SAR report. I found maillog didn't have this issue.. Many thx! BR, Jacky.

jackyc · ‎01-03-2011

Thx, Ayn. You are exactly talking what I am going to do. The summary index is very interesting, I think I will look deep to it and see what else it can do. But I think if the splunk will create a new index and this approach would fit for more complicated series of searches. By the way, will the summary index consumes extra space and license volume? In compare of loadjob command, I think summary index would be some how more complicated.

jackyc · ‎01-03-2011

Thx, gkanapthy. In compare of the Summary Indexing, this approach seems much light weight. What it does is simply pipe the previously-run search result. If the search is not a saved search, I think the loadjob command would fire previous search on the fly, right?

jackyc · ‎12-30-2010

Hi there, I am constructing a series of searches for a dashboard for annual audit. Because it is necessary to parse out the un-used portion of the maillog, is it possible to use a search first does this and saved the result, then designed other searches based on this result? In this case, maybe call it base search. If the base search is scheduled, it can save the resources which the successor search need to run for the base search. Is that kind of search templates? Any idea for discussion. Many thanks. Br, Jacky.

jackyc · ‎12-30-2010

Hi there, I think I should get self-answered. Since the way I charted saved search is not correct, please follow this link if you need this.

jackyc · ‎12-29-2010

Hi nick, very much for your sharing. I got it worked. The main point is that, if you want the chart to be shown up exactly configured at report builder, you need to save the search in that report builder window. Many THX ^^

jackyc · ‎12-28-2010

Hi there, I have a saved search scheduled to be run once per day and which shows fine with result in a table panel in dashboard, but once I added a chart panel with the same saved search, nothing shows up in the chart panel (even doesn't have "No Result Found"). When I changed this save search with no schedule, the chart panel and the table panel shows result fine. May I ask for somebody's help? Best, Jacky

jackyc · ‎12-24-2010

Well thx .. I follow your intruction and the search result showed good. But I saved a report from the report builder, which built an area chart with stacked 100% and well fit, how can add import this saved charted to dashboard? Many thx ~~~

jackyc · ‎12-23-2010

Hi there, I have a saved search and built a chart from report builder, how can I get the this chart's XML to add to a dashboard? or let's say, how can I add the chart from report builder directly to a dashboard panel? Thank all and meery X'Mas ^^ Best, Jacky

Posts	9
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎12-23-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Index Time VS Actual Occurs Time

Successor Search Using Previous Saved Search Resul...

Why schedule save search result doesn't show up on...

How to get XML from Report Builder?

Index Time VS Actual Occurs Time

Re: Successor Search Using Previous Saved Search R...

Re: Successor Search Using Previous Saved Search R...

Successor Search Using Previous Saved Search Resul...

Re: Why schedule save search result doesn't show u...

Re: How to get XML from Report Builder?

Why schedule save search result doesn't show up on...

Re: How to get XML from Report Builder?

How to get XML from Report Builder?

Join the Conversation