Hello, I am trying to do an outer join of two searches. I have 2 server groups (Gateway="opaxvgw1" OR Gateway="opaxvgw2") and (Gateway="opaxvgw3" OR Gateway="opaxvgw4") For each group, I list the customers by the term "Penta_source". Then I want to extract the customers that are only present in one of the groups (and eliminate all the customers that are present in both) Here is my search job, but it doesn't work : index="axwaydb-prd" sourcetype=AXWAY-Stats Direction=I Gateway="opaxvgw1" OR Gateway="opaxvgw2" | stats count by Penta_source | join type=outer Penta_source [search index="axwaydb-prd" sourcetype=AXWAY-Stats Direction=I Gateway="opaxvgw3" OR Gateway="opaxvgw4" | stats count by Penta_source] Any idea ? ... View more

Hello, I am using a table type search with visualisation with multiple fields to render. The purpose of this search is to match two events in a transaction (incoming file and outgoing file) and calculate some infos (bandwidth, duration...) My search is : index="" sourcetype= | transaction file_component maxpause=5m |eval debit=Size/duration | table file_component,Size,duration,debit This give me a multi series visualisation in which "file_component" (the transaction id) is the x-axis, so events are sorted with transaction id but not with time. I tried to add: index="" sourcetype= | transaction file_component maxpause=5m |eval debit=Size/duration | table file_component,Size,duration,debit,_time | sort by _time This worked for sorting the results by time, but X-axis is still based on transaction id and I can't find the date and time of a transfer by just hovering the mouse on the graphs. Any idea? Thanks ... View more

Hello, My log files looks like this : "1","I","R","140406 233102","E","0","1341874",[...] I want Splunk to recognize the date and time from this log. The date uses the following format : "YYMMDD HHMMSS" ("140406 233102" ==> 2014 June 6th, 23h31m02s) Can someone help me to find the regex ? Thanks ... View more