Thanks so much. This 10 year old post helped me resolve my issue! ... View more

@drippler Your search is worked for me as well.. Its pretty much straight and simple one. Thanks Note: Its deletes only 10k events only you have to run the search for multiple times    index="Indexname" sourcetype="sourcetype" | eval eid=_cd | search [search index="Indexname" sourcetype="sourcetype" | streamstats count by _raw | search count>1 | eval eid=_cd | fields eid] |delete   ... View more

Hi @Anonymous  Did you get your question answered?  If you need to get mainframe data (security, database, CICS, FTP, TCPIP, master console messages and much more), please see dgtechllc.com/meas. Our Mainframe Event Acquisition System (MEAS) product will allow you to monitor, filter and forward - in real time - any/all events from the mainframe that you would like to see in Splunk. It takes roughly 1/2 day to install and no IPL necessary. Please give us a call if you need anymore information.   Thanks!   ... View more

Hi thanks for your comments. It's just as I thought then.. I'll use your recommendations for your setup 🙂 ... View more

a change was made in 5.0.5 and later versions to improve security and prevent clickjacking issues, this is what you're running into. to implement this change, we set X-FRAME-OPTIONS=SAMEORIGIN in the header for all cherrypy served pages. this means that you can only iframe in pages coming from the same site. we added a new web.conf setting: x_frame_options_sameorigin = [True | False] which defaults to True. if you set this to False, your iframing will work again. ... View more

Just to add this, you can refresh the entitities without explicitly hitting the endpoint, you can do so by CLI from the below command: curl -u admin: -X POST http://:8089/servicesNS/-/-/admin/transforms-reload/_reload above is an example of reloading the transforms entity, but in a similar way, you can do reload for other entities as well. ... View more

You could try extracting all three in one expression: (?m)(?<PolicyNumber>(?<Prefix>[A-Z0-9]{3})(?<Suffix>\d{9})) But I don't know if it will help with the slow search issue (luckily, I have yet to run into it). Are you running the latest and greatest version of Splunk? ... View more

New link to fillnull doc: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Fillnull ... View more

Thanks guys! The debug/refresh has worked. No longer will I have to restart 😄 I love Splunk Base! ... View more

We will miss your splank ... View more

I had to reinstall splunk as there was a server OS issue. I copied the splunk directory and saved it. After the reinstall of splunk, I just copied the splunk directory and all of my settings were saved. I maybe only had to do one or two setting changes. Our data is kept on a SQL database on another server, and it was all accessible. ... View more

Here is my search: sourcetype="production_env" | chart eval(round(((count(eval(Status="Error"))/count)*100),2)) as "FailureRate", values(Threshold) as "Threshold", values(AlertStatus) as "AlertStatus", values(FailCount) as "Total Alerts" by ServiceNameLookup | eval AlertStatus = if(FailureRate>Threshold, "Failure rate over ".Threshold."% for the last 15 mins","OK") | rename ServiceNameLookup as "Service Name", FailureRate as "Failure Rate" It invokes the lookup table with a list of service names and thresholds, then compares the failure rate against the threshold. How would adapt your method? ... View more

You're now handling MV fields? when did they slip into the equation? You might want to start another question... Also, I second Ayn's question about why you use so many usernames on here... every so often I get an email that one user has commented, then you delete it and post as another user? ... View more

@Loscil: Given that this error can be very generic, I would recommend that you open a support case and indicate under which circumstances exactly you witnessed this error: Which UI page were you accessing? Did the error appear immediately or did it appear after ~30s? Is the error reproducible at will? If yes, what are the steps to follow? It will also be useful to attach a diag of the instance where that happened right away. ... View more

Hi @nages, This post is a few years old so it may not garner the type of activity that you're seeking. If you need some help, I would suggest posting a new question. Or, if you want to try to get some immediate help for your question, you should join the 1300+ Splunk users in our public Slack chat. People ask each other for immediate help on there daily. You can share your question there to see if anyone can take a stab at it. You first have to request access through www.splunk402.com/chat. Fill out the form, and once you receive the approval email from our Community Manager (usually the approval process takes a couple days), you can access Slack.com and ask for help in the #general channel. ... View more

You're probably better off using the rendering or even the embedding features of the Table module, rather than trying to go the other way and use the HTML module to make a table. However, speaking just in the context of using the HTML module to generate Javascript and CSS, a) it could possibly be a XML syntax problem - are you escaping the "html" param's contents correctly, preferably by putting it in a CDATA block? If nothing loads properly it sounds like a wrench has been thrown into a relatively low level like this. b) are there any Javascript errors evident in Tools > Error Console, or the equivalent in your browser? If so can you add them to your question above? c) be aware that whenever a push hits an HTML module, the HTML module re-renders it's HTML. This can have unwanted effects when the HTML module is embedding javascript, as runtime values can be unexpectedly clobbered as they get reinitialized. Sometimes a simple solution is to put the script safely upstream at a point that will never receive any "push", and keep the dynamic html parts in another HTML module further downstream. ... View more

getting error message like "This app is currently not available..." Any suggestions please... ... View more

@kristian.kolb - how do I remove this column row1 row2 row3 and just have this: clientip 12.23.34.45 12.13.14.15 12.33.44.55 Success Ratio 87% 79% 82% Total 1243 5564 32331 ... View more

Actually - if you are using the integrated- check out /lib/python2.7/site-packages/splunk/pdf/pdfrenderer.py I changed the margins, and font size there, and you can probably do other things as well. ... View more

Thankyou so much!! 🙂 ... View more

Splunk can still "not find the view." Your XML looks perfectly valid to me. 😕 Thanks for your continued assistance! ... View more

The trick is to concatenate the data series values into your pie slice label, as follows: Example 1 for count | stats count by op_eTOM | eval op_eTOM_Slice=op_eTOM+ ": " + count + " Transactions" | fields op_eTOM_Slice, count Example 2 for total durations | stats sum(Duration) as sum_Duration_Seconds by op_eTOM | eval total_Minutes=round(sum_Duration_Seconds/60) | eval op_eTOM_Slice=op_eTOM+ ": " + total_Minutes + " Minutes" | fields op_eTOM_Slice, sum_Duration_Seconds ... View more

We've converted the inline searches to saved searches and that's freed up a lot of resource and our offshore guys can have access to that dashboard at the same time. thanks for your advice 😄 ... View more