index="*" | eval foo=coalesce(F1,F2) | eventstats values(P1) as Foo2 by foo| .... output search foo P1 F1 F2 Foo2 result1 X2 result1 NULL X2 result1 NULL NULL result1 X2 ( 1 and 2 are different log events.) The above output is getting used by eventstats.... when event count increase, the some of the fields are not getting result. Please provide me the solution instead of using event stats, is there any other way to match the two fields to get other field output result.? ... View more

My output is Success Success Success Failure Failure Faliure Success Success Success Failure Success Success Success Success Success Success I need count should be Field1 count Success 1 Success 1 Success 1 Failure 0 Failure 0 Faliure 0 Success 2 Success 2 Success 2 Failure 0 Success 3 Success 3 Success 3 Success 3 Success 3 Success 3 ... ... ... .. Success 15 Success 15 Failure 0 Success 16 Success 16 ....... like wise currently my query is .............streamstats count(eval (Field1="Success")) as count by Field1 rest_on_change=true | table Field count ... View more

My fields contains " search | eval status=if(value>10,Success,failure) | table Name message status Name Message Status blah...blah.......Success Blah...blah........Success Blah..Bhalh......failure blah...blah.......Success Blah...blah........Success Blah..Bhalh......failure Blah..Bhalh......failure Blah..Bhalh......failure blah...blah.......Success Blah...blah........Success blah...blah.......Success Blah...blah........Success Output should be Name Message Status count blah ...blah .......Success 1 Blah...blah........Success 2 Blah..Bhalh......failure 0 blah...blah.......Success 1 Blah...blah........Success 2 Blah..Bhalh......failure 0 Blah..Bhalh......failure 0 Blah..Bhalh......failure 0 blah...blah.......Success 1 Blah...blah........Success 2 blah...blah.......Success 3 Blah...blah........Success 4 like that can anyone provide the query for this? ... View more

I have two separate panel, one is speedometer panel and another one is single value in dashboard. I want to merge both panel in single panel visualization side by side. Currently I merged both panel, but its coming down. Not coming side by side. ... View more

I have a search like this: index=* source=*|....| bucket Time span=(1d/1h/5m)...| if I select last one month from time picker, span would auto change as 1d ..bucket Time span=1d in query if I select last one day from time picker, span would auto change as 1h ..bucket Time span=1h in query. if I select last one hour from time picker, span would auto change as 5m ..bucket Time span=5m in query. A condition is that I can't use drop down for span....but timepicker for selecting for date and time. can anyone help me on this query ... View more

Current setup of Splunk Instance is 10 UF---->2HF---->3IDX, In HF for load balance we go with config of autoLB with frequency. has anyone can help for failover or HA mode at HF configuration?..how it will be work with BCP if one of the HF hardware or path fails? UF------>}HF1 UF1------->} HF1 UF--------}HF2 UF1----->HF2 ... View more

Event Flow (THREAD-XXXX) YYYY-MM-DD 15:53:38.486 - Server_Name flow step millis 32 ('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX') (THREAD-XXXX) YYYY-MM-DD 15:53:38.508 - Server_Name flow step millis 22 ('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX') (Server_Name,) (THREAD-XXXX) YYYY-MM-DD 15:53:38.517 - flow step millis 64 ('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX') (THREAD-XXXX) YYYY-MM-DD 15:53:38.758 - flow step millis 2 ('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX') (THREAD-XXXX) YYYY-MM-DD 15:53:38.773 - Server_Name flow step millis 15 ('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX') (THREAD-XXXX) YYYY-MM-DD 15:53:38.789 - Server_Name start flow ('IP reverse posting') (status: XXXX@XXX_004) (XXXXXXXXXXXXXXX) (THREAD-XXXX) YYYY-MM-DD 15:53:38.791 - Server_Name flow step millis 1 ('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX') (THREAD-XXXX) YYYY-MM-DD 15:53:38.793 - Server_Name flow step millis 2 ('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX') - flow stops here (THREAD-XXXX) YYYY-MM-DD 15:53:38.794 - Server_Name flow step millis 1 ('XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX') can anyone, extract all fields at search time and would also like to extract a couple of fields? may use Props.conf or Transforms.conf. ... View more

I am using SPlunk 6.5.1, I am unable to change the color of value when using rangemap in Single value virtualization. Query : index=.........| stats count | rangemap field=count, low=0-0, high=1-1,severe>1, default=severe | table count... changes had done in XML too, rangemap count provide me the solution . ... View more

Hi All, Could any one guide us on the below requirement, as we need to finalize the infra setup for splunk. Currently we have t*wo site located in two places with 3 nodes on each site*, so before going for the implementation we had question from Infra (storage team) for storage sizing. As it is multi site clustering could you please let us know what type of search factor and replication factor value should be suggested, so that based on that we can recommend the storage size to the infra team. As per splunk document by default the site search factor is 2 and replication factor is 3, in the sense there were be two copies in one site and one copy at another site. In this case what will be storage sizing of each index node at each site. Currently we have 60 GB of data being injected in index. http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Sitesearchfactor ... View more

In my field value are unstructured, few of the strings having space at beginning. Do anyone help, how to eliminate those white space? ... View more

in my chart I am showing three variable values using xyseries command. But looking at bar chart we can see only two values in label, other value in legend. I need to show three values in Label, not in legend or variation in colors. Please provide solution. ... View more