I have a search between two data sets using join, let's say sourcetype A and B. My search looks like this: sourcetype=A fieldA |eval fieldB=fieldA|join fieldB [search sourcetype=B fieldB] The results i am receiving is the list of all the events where fieldA in A is the same as fieldB in B. What I am trying to receive is the list of fieldA that doesn't exist in B. Can someone please help me with this ? Regards, Jonathann ... View more

Hi Can we create a tagcloud dashboard ? I saw an example in the app called "Splunk 6 Dashboard Examples" , but there it only shows the final result, not how to reproduce it, very poorly documented. Thanks. ... View more

Hi I have a list of words in a lookup table and i would like to return the events of a search that match any of the values in the lookup. So far, nothing really hard to implement in Splunk. The problem is that some of the values in the lookup are partially to the one in the search (e.g :the value in my lookup is foo and the one in my search is foobar). I read this : http://answers.splunk.com/answers/718/how-are-values-in-lookups-matched and tried that : (from transforms.conf) [sourcetype i am querying] filename = "lookup table file name" case_sensitive_match = false match_type = WILDCARD(field that contains "foobar") But the entry "foo*" in my lookup did not find it. Can someone please help me solving this ? Thanks ... View more

is there a way in Splunk to index only the event of a log files that contains a specific expression or doesn't contains it. By example, if I index a very big logfile, i don't want to index in it the INFO event but only the ERROR events. thanks ... View more