I have a DB Connect configured with a SQL database. The connections reference views (SQL query given = SELECT ASTERISK FROM DB.VIEW). Every once in a while it is required to change the name or add in a new variable to the SQL view (hence the SELECT ASTERISK format) but when these changes are made in SQL, the next set of indexed data reads in the correct values, but keeps the original list of field titles. Is there a way to ensure this does not occur or can someone explain why splunk does this? Thank You! ... View more

I've been working with the Splunk MLTK & the time series forecasting functions. I like the forecastviz command/visualization as it shows the most detailed data that is required. I was curious though if anyone knew of a way to edit the color scheme of this visual as the standard colors aren't quite what I'd like to display. Mostly want to be able to change the colors of the lines/areas shown on the chart, with the background/font colors as an added bonus. ... View more

I am currently working on creating a drill down search from a custom cluster map. I want a set of data associated between the Latitude & Longitudinal values depending on the zoom of the map & user click. I can get my xml subquery to work when I bound the upper limit of Latitude and Longitude, but if I try to bound by both the upper and lower limits, the page that appears has the about:blank webpage. The xml code for my drilldown is below. Can anyone help on how to limit these values and have the search window appear & work (note the below code works, just does not limit on all sides like required). Or is there a different approach that I may not know of? <drilldown> <link target="_blank"> <![CDATA[ search?q=index=my_index sourcetype="my_source" | eval PresentedCapacity_TB=(PresentedCapacity/1024) | dedup Array HOST | table Lat Long DataCenter Array HOST PresentedCapacity_TB | search (Lat>=$click.bounds.south$ ) AND (Long>=$click.bounds.west$ ) &earliest=-24h@h&latest=now ]]> </link> </drilldown> ... View more

I am attempting to create a search that returns data for a different time-range based on the current day of the week. Desired output would be returning the data from last sunday-saturday (last week) if today is a Sunday or a Monday, and if today is any day of the week other than Sun/Mon then return the data from the current week to date. I have tried a couple of searches so far and am not having success. Currently what I am working with is this: | eval weekday=strftime(now(),"%A") | eval early=case(weekday=Monday, -w@w+1d, NOT weekday=Monday, @w0+1d) | table early used as a sub-search for the "earliest=xx" command within the larger query. Can anyone assist? ... View more