| sort - _time | head 2 ... View more

you can use like: index="index" [search index="index" earliest=X | top keyX | table keyX] is like index="index" (keyX=1 OR keyX=2 OR keyX=N) ... View more

if you want to export the data, you will need to click on that export button, but if you want to save in a csv file inside splunk, you can aways use outputlookup or outputcsv. Unfortunately, there is no Export with the post search drilldown, so you will need to change the table if you want to exporte those values only, like: | table TIME_STAMP TIME_SPENT SERVICE_NAME SUCCESS_STATE DOCUMENT_ID SERVICE_INPUT SERVICE_OUTPUT TRANSACTION_TYPE MACHINE_NAME ... View more

As Kmaron has written, you can use the *, for the second reply, can you post your input xml source? ... View more

You can try: index="my_events" | makemv delim="," status | eval matching=if(status!="not found" AND status="$status_tok$", 1, 0) | timechart count as "All events" sum(matching) as "Matching events" ... View more

Oh, is one of the ES, ok, maybe some scheduled search is missing. But maybe is a bug in the dash. Check the search to see what token is missing. ... View more

Most of the time, the search is waiting for a token. Maybe some input that wasn't selected or maybe some search didn´t return the data to be used in this search. If you want to copy and paste the XML from the source here, I can have a look. ... View more

yes, there was an empty search near the end, but the point is. Create a schedule search to run by the hour with the -1h@h and save the result using: | outputlookup append=t some_name.csv And if you want to search in this csv, just use: | inputlookup some_name.csv | where _time> relative_time(now(),"-1d@d") or other search. ... View more

Try this one, is set to get the last hour, see if its fast enough. | tstats summariesonly=true max(MXTIMING.Elapsed) AS Elapsed max(MXTIMING.CPU) AS CPU max(MXTIMING.CPU_PER) AS CPU_PER values(MXTIMING.RDB_COM1) AS RDB_COM values(MXTIMING.RDB_COM_PER1) AS RDB_COM_PER max(MXTIMING.Memory_V2) AS Memory max(MXTIMING.Elapsed_C) AS Elapsed_C values(source) AS source_MXTIMING avg(MXTIMING.Elapsed) AS average count(MXTIMING.Elapsed) AS count stdev(MXTIMING.Elapsed) AS stdev median(MXTIMING.Elapsed) AS median exactperc95(MXTIMING.Elapsed) AS perc95 exactperc99.5(MXTIMING.Elapsed) AS perc99.5 min(MXTIMING.Elapsed) AS min,earliest(_time) as start latest(_time) as stop FROM datamodel=MXTIMING_V9 WHERE host=QCST_RSAT_V41 AND (MXTIMING.Elapsed > 0 OR 1=1) AND earliest=-1h@h GROUPBY _time MXTIMING.Machine_Name MXTIMING.Context+Command MXTIMING.NPID MXTIMING.Date MXTIMING.Time MXTIMING.MXTIMING_TYPE_DM source MXTIMING.UserName2 MXTIMING.source_path MXTIMING.Command3 MXTIMING.Context3 span=1s | rename MXTIMING.Context+Command as Context+Command | rename MXTIMING.NPID as NPID | rename MXTIMING.MXTIMING_TYPE_DM as TYPE | rename MXTIMING.Date as Date | rename MXTIMING.Time as Time | rename MXTIMING.Machine_Name as Machine_Name | rename MXTIMING.UserName2 as UserName | rename MXTIMING.source_path as source_path | eval Date=strftime(strptime(Date,"%Y%m%d"),"%d/%m/%Y") | eval Time = Date." ".Time | eval FULL_EVENT=Elapsed_C | eval FULL_EVENT=replace(FULL_EVENT,"\d+.\d+","FULL_EVENT") | join Machine_Name NPID type=left [| tstats summariesonly=true count(SERVICE.NPID) AS count2 values(source) AS source_SERVICES FROM datamodel=SERVICE_V6 WHERE ( host=QCST_RSAT_V41 earliest=1539054000 latest=1539212400) AND SERVICE.NICKNAME IN (*) GROUPBY SERVICE.Machine_Name SERVICE.NICKNAME SERVICE.NPID | rename SERVICE.NPID AS NPID | rename SERVICE.NICKNAME AS NICKNAME | rename SERVICE.Machine_Name as Machine_Name | table NICKNAME NPID source_SERVICES Machine_Name ] | lookup MXTIMING_BASE.csv Context_Command AS "Context+Command" Type as "TYPE" OUTPUT Tags CC_Description Threshold Alert | appendpipe [| where isnull(Threshold) | rename TYPE AS BACKUP_TYPE | eval TYPE="*" | lookup MXTIMING_BASE.csv Context_Command AS "Context+Command" Type as "TYPE" OUTPUT Tags CC_Description Threshold Alert | rename BACKUP_TYPE AS TYPE] | sort Threshold | dedup Time, NPID,Context+Command | where Elapsed > Threshold OR isnull('Threshold') | fillnull Tags | eval Tags=if(Tags=0,"PLEASE_ADD_TAG",Tags) | makemv Tags delim="," | eval Tags=split(Tags,",") | search Tags IN (*) | eval source_SERVICES_count=mvcount(split(source_SERVICES, " ")) | eval NICKNAME=if(source_SERVICES_count > 1, "MULTIPLE_OPTIONS_FOUND",NICKNAME) | timechart bins=1000 max(Elapsed) by Tags limit=20 ... View more

Hi Robert, now I understand the reason you want more peers (machine indexers) and is a bad idea. You have a search that is very slow and someone told you that having another peer will result in a better performance. But will only work if that peer is another machine, so you will have double the power from getting those events (log lines), but not for computing power. After gathering all those events, it will be the search head that will process your SPL query. What I recommend is to take a look at your query, what about Summary your information. Example: Instead of looking for 30 days, how about you looking for only 1 day every day, like earliest=-1d@d latest=@d, always saving the returned value in a summary index or a CSV. You can schedule this search to run every day in the morning, or in the range of time that fits you well. And then you can use this summary index or CSV in your dashboard, search or alarm. If you want, I can show you more examples, give me more information about your query. ... View more

What you want is more indexes, and not peers, correct? You just need to create those indexes, there is no reason to install more then 1 instance of Splunk on the same machine. ... View more

Almost, you dont need to copy all the app folder, only thoses apps that have info. The default app is called search. ... View more

From my search head. What I recommend is to create a new app folder, copy the folder structure from /opt/splunk/apps/, then all you need is to keep the files with the searchs and reports (savedsearch.conf), dashboards (data/ui/views folder), and others that you want to move. ... View more

I didn't understand that part either. But can you give an example o a critical criteria? ... View more

Can you please post the search? ... View more

This is my 'All Time(real-time) minutes of fame' ... View more

Splunk FTW ... View more

Is easy, just copy those xml from views and the savedsearch file to another app, or create a new one and copy. ... View more

Have you try the untable command? ... View more

check this answer: https://answers.splunk.com/answers/12027/single-multi-threading-cpu.html ... View more

Timewrap will do the trick. ... View more