worked for me too! thanks! ... View more

I suspect you are right, but you probably should post a separate question about that. ... View more

in my dashboard there is no "edit....." in "Update profile details" i can not change my email address! ... View more

Even I had similar issue when I was working with nodeJs... But in a different environment.. CLient Browser + Server NodeJs(web component).. In my issue the problem was not with node js... It was with the client browser.. Maximum concurrent session for a domain is 6... May be your issue is also in the consumer part.. nodejs mostly works fine.. Try investigate on your consumer side as well... It may queue your requests... ... View more

Okay and have you already tried setting the TTL (time to live) of your search job? See http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.0/splunkjs.Service.Job.html under setTTL for an example. ... View more

Give this a try index="myindex" | spath | table Id, Start, Nodes* | rename Nodes{}{} as Nodes | rex field=Nodes max_match=0 "(?<Nodes_Res>\S+)\s+(?<Nodes_Rank>\d+)" | table Id, Start, Nodes_Res Nodes_Rank ... View more

Glad it works now. Please mark my answer as accepted for posterity. Thanks! ... View more

No, there is no other documentation available for the details of the data collected by the unix and linux add-on. Meaning of each field for the sourcetype protocol is as below IPdropped - Outgoing packets dropped TCPrexmits - Segments retransmitted TCPreorder - Detected reordering TCPpktRecv - Segments received TCPpktSent - Segments send out UDPpktLost - UDP Packet receive errors UDPunkPort - UDP Packets to unknown port received UDPpktRecv - UDP Packets received UDPpktSent - UDP Packets Sent If you want to understand the meaning of fields for other sourcetypes, like SloshBurch said you will have to understand the script of that sourcetype. And for the data collection of the packets re-transmitted, as per my knowledge only TCPrexmits field of sourcetype protocol contains that data. ... View more

Sounds like there is something going wrong with the KV store (mongo) during this operation. First place I would look is in mongod.log. ($splunk_home/var/log/splunk/mongod.log) Second thing I would do is make sure your KVstore is loading ok normally. I would start by checking stuff like certs which KV store uses to self-validate: https://answers.splunk.com/answers/404979/trying-to-run-the-distributed-management-console-g.html Third thing I would do is confirm you actually use KVstore here, and that this message is not a red herring. ... View more

Now that I turned that off, I don't get the fields for the Nix search. I suspect that's because change the permissions to app only kills the field extractions. ... View more

I know this is an answered ticket but shouldn't it be fixed in the add-on so that it's automatically available to anyone without doing any manual configuration changes? ... View more

You are awesome!!!!!!!!! It worked!!!! Thanks ... View more

That is what is referred to as a token filter. That would means wrap the token value in double quotes. Here is the documentation on token filters: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters ... View more

you are right it worked. ... View more

Perfect. It worked. I used: <script src="/static/app/<YOUR_APP_NAME>/home.js"></script> ... View more

Feel free to elaborate what you did to fix and mark as accepted. ... View more

The general approach is something like this: (search identifying data set 1) OR (search identifying data set 2) | stats values(field1) as field1 ... by common_field The general assumption here is to have one event per "GCDn" on the left and one event per "id n" on the right, the stats stitches them together. In your case you may need to do a bit of preprocessing, for example your first data set seems to have values like "GCD1" while the second data set appears to have values like "id 1" - those field values need to be harmonized before the stats, e.g. like this: () OR () | eval common_field = case(expression identifying data set 1, replace(field_from_data_set_1, "GCD", ""), expression identifying data set 2, replace(field_from_data_set_1, "id ", ""), true(), "unknown id") | stats ... More background: https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html Even more background: https://wiki.splunk.com/Virtual_.conf March 2016 talk "Best practices around grouping and aggregating data from different search results" ... View more

Well that's not what your original question said so my solution won't work for the updated version of your question. They were broke into different fields because of the comma delimiter. It was my understanding that you just needed to remove square brackets. Happy you found your solution either way! ... View more