we have a dashboard that checks endpoint health and creates a message, "Endpoint XYZ is available" The source is a path to a script /u01/splunk/etc/apps/<app_name>/bin/ping.sh Is there a way for me to read the contents of the script from the search bar? Is it possible to overwrite or append the script from the search bar if I am an app owner? I do not have Splunk server command line access. ... View more

I am trying to create a report that will show month over month reporting for web service average response time as a percentage against a threshold sourcetype="web_logs" `web_resp_index` * | bucket _time span=month | stats count as total_count count(eval(resp_time>=500)) as fail_count count(eval(resp_time<500)) as success_count count(eval(resp_time=="")) as null_count by source _time | eval success_percent=round((resp_count/total_count)*100,2) | eval _time=strftime(_time, "%b") | Fields - total_count fail_count success_count null_count I now have : source _time success_percent www1 Jan 94.6 www1 Feb 93.2 www1 Mar 94.3 www2 Jan 98.5 www2 Feb 92.4 www2 Mar 84   I am looking to transpose and group so that I have 1 row per source and monthly columns Source Jan Feb Mar www1 94.6 93.2 94.3 www2 98.5 92.4 84 ... View more

I am trying to produce a table that can display 5xx status code counts per host over a timeframe (this will eventually be month, but for the purpose of this example will be by day). I downloaded the tutorial data  with apache logs and can see the data spans 8 days: source="access.log" host="www*" sourcetype="access_combined_wcookie" status=500 |timechart span=1d count by host I want to take this and analyze web server log files at work and increase span to 1 month. Is there a way for me to pivot /transform this data to get a breakdown that would provide the following table: Daily 500 status code dashboard host 02-25-22 02-26-22 02-27-22 etc 03-03-22 www1 13 39 35 etc 28 www2 24 31 45 etc 35 www3 18 51 34 etc 36   As stated above, I would like this by MONTH: Jan, Feb Mar etc so teams can glance at this table and see which hosts are improving/degrading or meeting SLOs etc. I do not want to create a bar chart, but rather keep the above format.   ... View more