For example: I have a abc.csv with fields UpdateDate, Name, Employee No, Description. When i index the data I want to set the condition on UpdateDate > Currentdate(system date). So if the UpdateDate less than Currentdate should be ignored while indexing it into splunk. Need to index the data in csv that satisfies the given above condition instead of indexing the whole data in the csv. ... View more

Need help to color my donut chart with specific color. I'm getting default color as blue is there any option like how we specify in bar chart? ... View more

My XML code and I tried series color but it is not working <search> <query>index="optus_exec_view" sourcetype="health_check" | eval latest_file=strftime(_time,"%d/%m/%Y %H:%M") | JOIN Application latest_file [search index="optus_exec_view" sourcetype="health_check" | eval latest_file=strftime(_time,"%d/%m/%Y %H:%M")| stats max(latest_file) as latest_file by Application | table Application latest_file ] | stats count(eval(Status="AMBER")) as AMBER_count count(eval(Status="GREEN")) as GREEN_count count(eval(Status="RED")) as RED_count by Application latest_file | eval last_file_epoch = strptime(latest_file, "%d/%m/%Y %H:%M") | eval Timefstamp=strptime(strftime(now(),"%d-%m-%Y %H:%M:%S") ,"%d-%m-%Y %H:%M:%S") | eval no_data_calc=round((Timefstamp-last_file_epoch)/60) | lookup application_frequency Application OUTPUT Frequency | eval HEALTH_STATUS=if(no_data_calc>Frequency,"NO DATA",if(RED_count > 0,RED_count ,if(AMBER_count > 0,AMBER_count ,GREEN_count))) | eval APPLICATION=upper(Application) | lookup tower APPLICATION OUTPUT Tower Application| where Tower="OSS" | stats sum(GREEN_count) as GREEN sum(RED_count) as RED sum(AMBER_count) as Amber | transpose</query> <earliest></earliest> <latest></latest> </search> <option name="aplura_viz_donut.donut.chartPadding">5</option> <option name="aplura_viz_donut.donut.chartSize">100</option> <option name="aplura_viz_donut.donut.chartType">3D</option> <option name="aplura_viz_donut.donut.donutWidth">50</option> <option name="aplura_viz_donut.donut.drilldown">1</option> <option name="aplura_viz_donut.donut.height">20</option> <option name="aplura_viz_donut.donut.iradius">0.4</option> <option name="aplura_viz_donut.donut.legend_height">12</option> <option name="aplura_viz_donut.donut.legend_left_fudge">10</option> <option name="aplura_viz_donut.donut.legend_position">right</option> <option name="aplura_viz_donut.donut.legend_top_fudge">-30</option> <option name="aplura_viz_donut.donut.log">1</option> <option name="aplura_viz_donut.donut.seriesColors">[0xFF0000,0xFFFF00,0x00FF00]</option> <option name="aplura_viz_donut.donut.radius">80</option> <option name="aplura_viz_donut.donut.show_legend">1</option> <option name="aplura_viz_donut.donut.svg_height">1000</option> <option name="aplura_viz_donut.donut.svg_width">1024</option> <option name="aplura_viz_donut.donut.xcenter">80</option> <option name="aplura_viz_donut.donut.xradius">60</option> <option name="aplura_viz_donut.donut.ycenter">80</option> <option name="aplura_viz_donut.donut.yradius">30</option> </viz> ... View more

Say I have a column with 5 records in it 88 22 67 44 55 I want to compare the last record 55 with that of second last value and want to write whether the value was 'greater' or 'smaller' in the output. In above case 55 was greater so my output should say GREATER. Do we have any command to accomplish this? ... View more

Using the query to send email to my ID which I have configured in email settings. If i trigger the Alert I'm getting the email but if using "sendemail to" command in search it's not sending the email and throwing below error. Query: index="_internal" | top 5 host | sendemail to="****@gmail.com" Error: command="sendemail", [Errno 10061] No connection could be made because the target machine actively refused it while sending mail ... View more

I have multiple search queries and when it gets executed the results are stored in csv file using the command "| inputlookup append=true xyz_lookup | outputlookup xyz_lookup". But once in 15 minutes I want to reset this xyz_lookup file as I will schedule to run the mutiple query every 15 mins, if I don't reset then it will display the previous run data along with the current run data which is wrong in my scenario. If I remove the append=true from my search then it won't append all the other application data in as it will overwrite. Could you please let me know how to get the current data alone in my lookup file? Example: Run 1 the xyz_lookup will be Application Status App1 Green App2 Amber App3 Red App4 Amber App5 Red Run 2 after minutes the xyz_lookup will have the old data appended along with new one but I need only the current run data Application Status App1 Red App2 Green App3 Amber App4 Green App5 Amber App1 Green App2 Amber App3 Red App4 Amber App5 Red ... View more