Use Batch stanza instead of monitor: http://docs.splunk.com/Documentation/Splunk/6.0/admin/inputsconf Regards ... View more

Something like: index="commonindex" (source="source1" field1="value1") OR (source="source2" field1="value2") ??? ... View more

Hello If you are getting durations like this: "1+06:29:32" You can use rex after getting the duration to extract the day. Like: ...| rex field="yourdurationfield" "(?<durationdays>^\d+)\+" | ... But, for durations of less than one day you won't get any value. You will need to use fillnull after the rex command. Regards ... View more

Hello I found that it uses alphabetical order regardless of any sorting of fields, or the use of the fields commands in the query. What we do is use eval to format the output fields in a way, that we consistently know whats on the csv file. Using this: your search ... | eval 1=host | eval 2=5 | eval 3 = description | table 1,2,3 So we are sure that we are receiving this information in the csv file: host, severity, alert description And using this format on every alert we create, we can be sure that the script will work as expected Regards ... View more

Hello Wouln it be as easy as: ...| stats dc(userID) by sourcetype Regards ... View more

Hello As you are not providing any examples of the data or querys, I just can guess that you need to use the streamstats command: http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Streamstats Regards ... View more

You can download it from here: http://apps.splunk.com/app/1602/ Regards ... View more