Yes write, we are getting result FOO2 if you use eventstats only running at limited period [every 5min or 15min]. But if you run that same query more than 30 min period, FOO2 is NULL . Because Eventstats taking more memory usage, its crossed the limit. But I need 2nd event result when put "index="*" | eval foo=coalesce(F1,F2) | eventstats values(P1) as Foo2 by foo | where isnull(P1)...." foo P1 F1 F2 Foo2 2 result1 NULL NULL result1 X2 Do you have any other query to use instead of using eventstats to get same result? ... View more

Here's what I generally do for that, assuming the Success or Failure field is called Field1. | streamstats current=f last(Field1) as priorField1 | eval newgroup=case(Field1="Failure",null(), isnull(priorField1),1, priorField1!=Field1,1) | streamstats sum(newgroup) as groupno by Field1 | Table Field1 groupno ... View more

Splunk 6.6v ... View more

@karthikeyan_k14, you would also need to convert to HTML Dashboard have you tried that. Once you created HTML dashboard you would need to make changes as suggested in Option 1. ... View more

@sbbadri - Order of the first two is reversed. You need to test 3600 before you test 86400. ... View more

The HFs would be needed depending on the size of the environment, for example having 1000 servers all sending directly to the Indexer would not be a great idea as this would impact on performance, especially if the Indexer is also being used as a Search Head / Deployment Server / License Master and so on. In a smaller setup yes that would be best practice. Having a HF installed on a system for example to split up sites so maybe a London site and a Birmingham site, in that situation you would have HFs installed and I could then see a requirement for HA, I guess in this situation you would configure the UF to send logs to both HFs for that one site and if one goes down the logs still are being routed via the other. if that site went down then you would have no logging. The problem you then have is that you would potentially be doubling up on the logs being sent so some duplication would then take your license up, I don't know so much about that side of things but i'm sure there is a way of dropping duplicate logs. ... View more

In props.conf EXTRACT-allfields= \(THREAD-(?<thread>\S+?)\) \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d+? - (?<server_name)\S+) (?<flow>\S+) (?<step>\S+) (?<millis>\S+) (?<numField>\d+) \('(?<message>\S+?)'\) Be sure to put it all on one line in your props.conf ... View more

Check out the working example from the Dashboards app: https://splunkbase.splunk.com/app/1603/ ... View more

You might want to play around with the sizing tool at http://splunk-sizing.appspot.com/ This is not published by Splunk, but it will give you an estimate. The replication factor and search factor should be chosen based on the business case: how much risk can the business take vs. how much money can be spent on disk? The more copies, the less risk but larger storage costs. The Splunk defaults are a good starting point. ... View more

eval field=ltrim(field) ... View more

The values are already there in the label. If the fieldnames are service_foo, host_name and count, and the values are service1, host1 and 23, then the label is showing service_foo: service1 host1: 23 As far as _time, it doesn't exist in the query at that point. So, for purposes of discussion, here's a query that generates random counts of events across a time period for 4 hosts in 3 different "services" | gentimes start="01/25/2017:23:00:00" end="01/27/2017:01:00:00" increment=23m | streamstats count as baseEvent | eval series="A" | append[| gentimes start="01/26/2017:03:00:00" end="01/26/2017:21:00:00" increment=47m | streamstats count as baseEvent | eval series="B"] | append[| gentimes start="01/26/2017:01:17:00" end="01/26/2017:23:18:00" increment=21m | streamstats count as baseEvent | eval series="C"] | eval rand1 = random() | eval adder1 = tonumber(substr(tostring(rand1),1,4)) | eval adder2 = tonumber(substr(tostring(rand1),max(len(rand1)-4,3),4)) | eval sometimes=mvappend(tostring(starttime),tostring(starttime+adder1),tostring(starttime+adder2)) | mvexpand sometimes | eval _time=sometimes | eval rand2 = random() | eval value=substr(rand2,len(rand2)-2,2) | eval rand3 = random() | eval host = case(rand3>1800000000,"Host1",rand3>1200000000,"Host2",rand3>600000000,"Host3",true(),"Host4") | bin _time span=15m | stats count as eventcount, sum(value) as sumvalue by _time host series | rename series as service_foo, host as host_name, sumvalue as count | table _time, service_foo, host_name, count Everyone can drop that into your current xyseries command like so: | xyseries service_foo, host_name, count ... View more