I have a home grown ticket system (relational database). It includes a "DateClosed" field that gets updated (obviously) when the ticket is closed. I am trying to identify how many closed tickets per day and run it as a timechart - how do you query for database entries with an entry in the "DateClosed" per day? I have been thinking of trying to get the number of tickets where DateClosed is not null per day - not per wday..., but can't seem to get the query right. In other words, how many tickets are closed each day... One table entry holds all created tickets (and includes the DateClosed field). A separate table holds all activity on the ticket - so the query will only have to deal with TableA (the ticket entity) not TableB (The ticket activity). Thanks ... View more

I am trying to create an XML form in a dashboard that takes shows all tickets in a ticket system that fall between two dates. First problem is there doesn't seem to be a simple date picker, so I put a date time selector on the form. The second problem is that when I try to use the Between function of the Date Time custom selection it always fails with an error stating "Earliest time cannot be greater than latest time. " So my question is, how do I create two date input fields (begindate and enddate) that I can use as parameters in a query such as ... | WHERE DateOpened > begindate AND DateOpened < enddate I have tried using the and parameters under the , but they don't seem to function properly when I have a date picker... Any help would be appreciated. ... View more

I have pulled in a bunch of records from my database. By looking at many posts and going over the docs I figured out how to get the timestamp (date create) of each record to be recognized. Now that I have 50,000 records in, there are several other date columns (they are DateTime's in MSSQL) but they show up in Epoch time format. How can I get them to show up in real DateTime format so I (and others) can query on them? Here is an example of one record: SRID=237218 CreatedBy=first.last@xyz.com UpdatedDate=1404771267.153 UpdatedBy=first.last@xyz.com DateOpened=1404771267.123 DateClosed=1404771267.153 IntakeSource=Phone The SRID is the rising field, I got the CreatedDate properly set so Splunk recognizes it, but now I need UpdatedDate, DateClosed and several other dates converted... My question is - do I have to blow it all away and try to do this as the data is originally pulled in or can I write this in a transform.conf or a props.conf file to convert it for me? It will not always be at an exact offset... Thanks, George ... View more

I am trying to tail an MSSql Database that contains trouble tickets. I pull everything in Key/Value pairs. The DateCreated field is a datetime in MSSql, but when the data shows up in Splunk it shows up as a decimal number "1834239.3423" - how can I get Splunk to properly recognize this as a datetime without writing my own polling script? Thanks ... View more

I am trying to extract a field from the following lines but the field extraction does not result in a Field. The sample data is a CSV download from a credit card site: 02/14/2013 Thu,,"PIZZA HUT # 023603 0MC LEAN VA ","GEORGE T JOHNSON","XXXX-XXXXXX-82003",,,28.75,,,,,,, 02/15/2013 Fri,,"BONSAI GRILL 1234560ARLINGTON VA ","GEORGE T JOHNSON","XXXX-XXXXXX-82003",,,32.21,,,,,,, 02/15/2013 Fri,,"EXXONMOBIL MCLEAN VA ","GEORGE T JOHNSON","XXXX-XXXXXX-82003",,,57.28,,,,,,, The field I am looking for has the values of "28.75, 32.21, 57.28" values. I did an automated field extract by copying out the value, putting it in the sample and generating a regex - it successfully identifies the information I want (it is highlighted). I hit save then go back to searching, but the field doesn't extract. I then tried copying the rex pattern that successfully identified the fields in the auto-generator (see the rex below) and I ran it right on the search bar - but it brought back a sparse return (there wasn't a price field for every line like there should be). running this yields inconsistent results ... | rex "(?i)^(?:[^\-]*\-){3}\d+\",,,(?P [^,]+)" Can anyone help me with the right regex for a field extraction that yields a "price" for every line in the file? ... View more

Forgive me if this has been asked before, but I am trying to do a lookup using geoip (maxmind database) to resolve IP's to countries, which works great. This is what I have so far sourcetype="fsisac-2" | lookup geoip clientip as IP In my field list I now have a "client_country" field. I now want to add "client_country=germany" to the query, but whether I add this at the end, or before the Pipe. How do I construct the query to now only show me IP's that are coming from Germany? TIA ... View more

I have been trying to wipe out an eval instance of splunk to start again, but I keep getting errors. I then upgraded to the latest version of splunk and tried again. I tried stopping all splunk services and issuing the clean command while splunk was stopped and continue to get an error. I used to get a failure to wipe out the dirty_database, now I am getting an error: could not delete "d:\program files\splunk\var\log\splunk" there are no more files... Short of completely uninstalling - any ideas? ... View more