Timechart has a command option call partial. By default this is set to true, so set this to false. Only the first and last buckets can be partials. http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Timechart ...| timechart partial=False count by foo ... View more

Looking at http://www.phon.ox.ac.uk/jcoleman/old_SLP/Lecture_5/DTW_explanation.html this looks relatively simple by using lookup table, subsearch, and a join statement. If you only need to update this every 15 to 30 days you could store your reference signal in the lookup table. Then with the subsearch join on time and with an eval do the simple math. | inputlookup reference.csv | eval t=strftime(_time, "%d") | join t [search ... | timechart span=1d count as test_signal | eval t=strftime(_time, "%d") ] | eval o= pow((test_signal-ref_signal),2) | chart values(o) over t your lookup would hopefully look something like: _time, refer_signal 1499985432, 10 ...., .... ...., .... ...., .... ...., .... 1499989383, 4 you can play round with the _time field to get time to line up and hope this is what you are looking for. ... View more

Okay peps. I've figured out how do this for capabilities but not items such as quotas, filters, etc. Though this meet an auditors requirement which also show last login date. earliest=-365d index=_audit action="login attempt" info=succeeded | stats first(_time) as etime by user | eval DateTime=strftime(etime, "%m/%d/%Y %H:%M:%S %Z") | join user [ rest splunk_server=local /servicesNS/-/-/authentication/users | stats values(capabilities) as capabilities values(roles) as roles by realname title email | rename title as user ] | append [ rest splunk_server=local /servicesNS/-/-/authentication/users | stats values(capabilities) as capabilities values(roles) as roles by realname title email | rename title as user] | dedup user realname ... View more

The is not real good way of doing this but you can make some assumptions. You can assume that every character in _raw is one byte (some unicode characters are four bytes). You then pick a time period you want to sample. index=network source="/opt/syslog-ng/log/hsm*.log" sourcetype=hsm:file earliest=-8h@h | eval length=len(_raw) | stats avg(length) as bytesPerMessage I don't know the size of your message but lets say every message on average 481 bytes. Now that you've done that you can use tstats find the count of those messages per day. Then we can use some eval statements with Math. |tstats count WHERE index=network source="/opt/syslog-ng/log/hsm*.log" sourcetype=hsm:file by _time span=1d | eval bytesPerDay=(481*count) | eval MB=(bytesPerDay/1024/1024) This will get you close be is only an approximation. ... View more

You can combine roles. I've combine the following rollows Server: DMC, SHC Deployer, LM, Deployment Server Server: CM, DMC, LM I would never combine SHC Deployer and CM on a single server. ... View more