SPLUNK NINJAS! I NEED YOUR HELP! I have a firewall issue where any IP outside of our intranet, Splunk throws errors saying "Could not create search".... and i tracked it down to these compound count-eval-like statements. For whatever reason its getting blocked by the netscaler and network people are no help, so as a work around, rewrite the queries. I have been trying different things but no such luck. obviously there is more to this search but the basics is all i need... Maybe a dumb question, but How would I do this without using compound count-eval-like search: index=someindex sourcetype=somesourcetype | stats count as total, count(eval(like('somefield',"A"))) as accepted | eval rate=(accepted/total)*100 | fields rate THANKS! ... View more

I have a custom drop-down list that I made using HTML and CSS and want to update time tokens based on the selection. See below: Don't worry about refactoring, going for functionality first. Now the searches all run on the dashboard when loading up, but if I change the tokens, the searches don't update. What is the missing piece to make this work? Is what I am trying to do possible or do I need to use a proper time range input all the time with the searchWhenChanged=true set? require([ "jquery", "splunkjs/mvc", "splunkjs/mvc/simplexml/ready!" ], function($,mvc) { $(document).ready(function(){ var tokens = mvc.Components.get("default"); tokens.set("earlyTime", "-60m@m"); tokens.set("latestTime", "now"); $(".time").click(function( event ) { $("#showBut").html(event.currentTarget.innerHTML); var tokens = mvc.Components.get("default"); if (event.currentTarget.innerHTML == "Last Hour") { tokens.set("earlyTime", "-60m"); tokens.set("latestTime", "now"); } else if (event.currentTarget.innerHTML == "Last 4 Hours") { tokens.set("earlyTime", "-4h"); tokens.set("latestTime", "now"); } else if (event.currentTarget.innerHTML == "Last 24 Hours") { tokens.set("earlyTime", "-24h"); tokens.set("latestTime", "now"); } else if (event.currentTarget.innerHTML == "RT - Last Minute") { tokens.set("earlyTime", "rt-1m"); tokens.set("latestTime", "rtnow"); } else if (event.currentTarget.innerHTML == "RT - Last Hour") { tokens.set("earlyTime", "rt-60m"); tokens.set("latestTime", "rtnow"); } else if (event.currentTarget.innerHTML == "RT - 24 From Midnight") { tokens.set("earlyTime", "rt-24h@d"); tokens.set("latestTime", "rtnow"); } var timeEarly = tokens.get("earlyTime"); var timeLate = tokens.get("latestTime"); $("#tester").html(timeEarly + " : " + timeLate); }); }); }); ... View more

I am trying to speed up a panel on a dashboard that is using geostats, as it is the slowest thing on the dashboard. I want to use a non streaming command and then use geostats from there. index=someindex sourcetype=somesource | stats count by longitude,latitude,bloodType | geostats latfield=longitude longfield=longitude count by bloodType The problem is the "count by bloodType" part. I really want to count by bloodType but count the count not the individual event. Say I had this as a result after the stats command: lat: -100 long: 10 type:O count:10 lat: -100 long: 10 type:B count:5 lat: -100 long: 10 type: AB count:1 Using geostats, I want the pie chart for that location to show 10/5/1, instead it shows 1/1/1. Does that make sense? Everything I want for the stats output is good. Geostats doesn't take into account the count it just takes the row as one event. SO if I have 700k events I end up with 70k events in my piecharts because it is not counting the individual events in bloodType. Don't know if my example helped. I just want to know if what I am trying to do is even possible. I have tried multiple things just haven't been able to accomplish what I want to achieve. I will expand later... just wanted to get the initial question up. Thanks! ... View more