did you edit some files under the default folders ? ... View more

Can you share your search query here ? you can try to add limit =0 to show all the results ex. |chart count by sourcetype limit=0 Check this out: http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Chart#Chart_options ... View more

Hi @romoc, I tried to simulate your case, I index the sample data you gave since there are key pair value which splunk will auto extract for you in search time , i dont need to manually extract it. So I run my search index="test" sourcetype="test2" source="/home/Documents/test2.txt" |chart values(ROW_COUNT) over TABLE_NAME by DB_NAME |eval REC_DIFF=x-y|table TABLE_NAME x y REC_DIFF and it works 🙂 note: I use the "*" on my first answer inside the table so i twill show all the values under DB_NAME in order also values are not static. ... View more

try : index="your index name" |stats values(url) by source_ip ... View more

It seems that your searchhead cannot established connection to the search peer .Did you check the connectivity ? , is the search peer reachable? check also if the port 8089 is blocked or not. check the firewall or in linux iptables -f ... View more

Hi @jamesvz, I also need that function in my dashboard , currently im also using the framework . I would like ask if the search ex. {% savedsearchmanager id="search2" searchname="sample_search" app="search" %} shoul i also convert it to var search1 = new SearchManager({ "id": "search1", "cancelOnUnload": true, "earliest_time": "-24h@h", "search": "index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)", "latest_time": "now", "status_buckets": 0, "app": utils.getCurrentApp(), "auto_cancel": 90, "preview": true }, {tokens: true, tokenNamespace: "submitted"}); Thanks! ... View more

hi same situation here. Did you find a workaround or a solution in this ? ... View more

hahaha if only we could switch 🙂 ... View more

ok , i'll keep you updated thanks for helping me 🙂 ... View more

I tried searching this sourcetype="util" "DPwithFR:" , set the time to all time, it shows it but the time is "July 19,2013" I suspect that its not getting the right time so i tried to convert the boot time which is in epoch time to standard time and it shows July 19,2013. Theres no latest data that shows that part , i also checked the raw logs and its there. I dont know why splunk didnt index that part. 1342633324 boot time 565898104 forks DP: 2.13 : 34 3.9 : 33 DPwithFR: 2.2 : 37 2.3 : 35 2.4 : 36 2.5 : 36 2.6 : 35 2.7 : 35 2.8 : 38 ... View more

I already edit the props.conf and restart the indexer and the forwarder still it didnt show that part. ... View more

Hi @lukejadamec, should i change the props.conf inside the apps folder or the one inside the systems/local ? ... View more

one event per log,i set the sourcetype as "util" ... View more

hi , the path to specific log in input.conf is correct ... View more

Hi Here's the sample log 302051908 non-nice user cpu ticks 67022224 nice user cpu ticks 474810206 system cpu ticks 7723346493 idle cpu ticks 10254021 IO-wait cpu ticks 21190725 IRQ cpu ticks 135816356 softirq cpu ticks 2438955853 interrupts 378813755 CPU context switches 1342633324 boot time 559999898 forks it cuts here..it didnt index the data below: DP: 2.13 : 29 3.9 : 29 DPwithFR: 2.2 : 28 2.3 : 30 2.4 : 28 2.5 : 32 2.6 : 30 2.7 : 32 ... View more

they dont have that , also rows are not increasing , it will just find the name and update it , they also dont have lastupdate column ... View more

hi @damien ,its now working,your right the machines time are not sync , so i config it and test it again and its now working thanks!! 😉 ... View more