What do u mean by unique ID . I can say each job names are different . Can I consider that as unique id ? and what does transaction do in splunk? And also I ant the real time transactions, suppose the log I have appends each run for a job . In that case a job will generate a log having all the transaction status : eg. started, running, success or failure. Ur search is giving me results for all the jobs that has one time went into running status which is not what I need. I need only those jobs which are at present in running status and has not succeeded or failed. ... View more

I am not sure how to include a name in the title, but there probably is a way... However, if you are creating a scheduled dashboard, you could have a panel in your dashboard like this: | makeresults | eval previous_month_begin = relative_time(now(),"-1mon@mon")  | eval "Previous Month Start" = strftime(previous_month_begin, "%B %d, %Y") | eval previous_month_end = relative_time(now(),"@mon-1m")  | eval "Previous Month End" = strftime(previous_month_end, "%B %d, %Y")  | eval heading = 'Previous Month Start' " to " 'Previous Month End' | fields heading which makes a beautiful heading. You might want to show it as a single value panel at the top of the dashboard. ... View more

@loveforsplunk, You are either looking for $job.resultCount$ which will list number or rows returned by the Search or $result.count$ where count is the field name generated by the search stats count (only first row or search query with single results. Refer to the following documentation for complete list of tokens available during an email notification: http://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens ... View more

@loveforsplunk - in the later search, after you run this command... | stats count(something) as k0 ... field k1 does not exist. ... View more

Yes I did reward him for his help as well . He did a great help to me . Also thank you . The only change I made was to remove the fillnull command as I wanted to trigger my alert for results >0 . So in this case it was assigning 0 to my values and was creating a row in the stats for which I was getting false alerts. Hopefully and finally I think my query and alert got completed and mission is successful 😉 . Thank you both @DalJeanis and @yuanliu. ... View more

You can change your time zone in the settings of your spunk account with the current time zone wherever you are. This change will display your _time with the correct time zone . I believe your time zone settings in your user account is in CST at present for which u see _time as CST ... View more

Hi @loveforsplunk, The best way to monitor server CPU usage with Splunk is to use the technology add-ons (TAs) from Splunkbase appropriate for your server - Splunk TA for Windows and Splunk TA for *nix (most flavors of Linux). Follow the documentation provided with the TAs to install and configure your inputs. In addition to CPU you can also monitor disk usage, processes, and RAM among many other things. Hope that helps get you started! ... View more

Great! Please do post the adjusted search here in the comments so we can all learn. ... View more

Okay,, so my requirement is , the line should break in this way: A B C G D E F G H I J If I have two G(which is the search keyword in splunk) in the log , then there should be two events generated. ... View more

oh ok. I will work on this. Thank you so much Dinesh. ... View more

oh .. I get it now .. Thanks a lot for instant reply. And also thanks to Dinesh .. I did not get what he wanted to express 😉 Sorry Dinesh but Thanks to both of you. 🙂 I am very new to Splunk so asking silly questions . Hope you didn't mind 🙂 ... View more

Thank You!! ... View more

I'm not aware of any way to force the lookup command to use more than one field on the input side but you could do two lookups to get 2 new columns: index=abc |lookup lookupfile col1 OUTPUTNEW col3 AS Match_col1 |lookup lookupfile col2 OUTPUTNEW col3 AS Match_col2 Then use the eval command to compare those 2 new columns: | eval combined=if(isnull(Match_col1,"null",Match_col2) This will create a new column called "combined" where if the value of Match_col1 is blank (ie: col1 did NOT produce an output of col3) it will display "null" otherwise (for those lookups where col1 DID match), it'll carry forward the value Match_col2, which is where looking up col2 also resulted in an output of col3 This is particular option has been tested on a dataset where both the "col1" and "col2" will always have at least one matching entry to "col3".... I'm not certain how it'll behave if you have entries where both "col1" and "col2" don't have any corresponding value on your table. I'd assume it will result in a null entry, but you should probably validate that rather than assume. ... View more

Unfortunately, all my numerous tests show that the query in the test case will run regardless of the tests results. ... View more