Hello, We use Splunk Enterprise 6.5. We'd like to create a GPO inventory from AD Windows Infrastructure: current GPO used/set and changes. Do you know the best practices to build reports about GPO? We saw the Splunkbase "Splunk App for Windows Infrastructure" ( http://docs.splunk.com/Documentation/MSApp/1.4.0/ ) running with "Splunk Add-on for Microsoft Active Directory" ( https://splunkbase.splunk.com/app/3207/) . There are some pre-build reports about GPO Audit/Changes ( http://docs.splunk.com/Documentation/MSApp/1.4.0/Reference/GroupPolicyAudit ). Do one of you have already use it? Do you think that is the best way to run reports about GPO? Regards, Chris ... View more

Hello, I've built some reports about CPU, memory and disk usage, and I'd like to display these reports as sparkline to obtain a compact view (and include more reports in the same view). For example , my search is sourcetype=infra subtype=system | timechart span=60m avg(cpu) by devicename and the result is _time device1 device2 device3 device4 2016-10-12 14:00 1.666667 0.000000 5.000000 0.083333 2016-10-12 15:00 0.166667 0.000000 4.500000 0.000000 2016-10-12 16:00 0.000000 0.000000 2.916667 0.000000 2016-10-12 17:00 0.000000 0.083333 1.750000 0.000000 2016-10-12 18:00 0.000000 0.000000 1.000000 0.000000 I've tried: sourcetype=infra subtype=system | stats sparkline count, avg(cpu) by devicename or sourcetype=infra subtype=system | stats sparkline(avg(cpu)) by devicename But I don't think that displays the good line chart! I've also tried: sourcetype=infra subtype=system | stats sparkline(avg(cpu),1m) by devicename Could you tell me what is the variable "1m"? Does it mean "1 month"? Regards Chris ... View more