I'm aggregating some values via 'chart list(value) as jobs by something' and then later on I want to produce a table that puts every value of 'jobs' into a single row. For example my query is index=main | fields counter, job | dedup job, counter | chart list(job) as jobs by counter and my output is something like --------------------- | counter | job | |-------------------| | counter1 | job11 | | | job12 | | | job13 | | ------------------| | counter2 | job21 | | | job22 | --------------------- and later on I do the following postprocess: search counter="counter2" | table jobs And I get the following response --------- | job | | ------| | job21 | (row1) | job22 | --------- I would like to get this response: --------- | job | |-------| | job21 | (row1) |-------| | job22 | (row2) --------- I.e. I would like the resulting table to print every value of the 'jobs' list into a separate row of the table but the above command just gives me one row with all the list's values in it. Is there a way to do something like this? ... View more

I'm trying (without much success) to get the HiddenChartFormatter to get charting.axisY.minimumNumber to set itself based on a sideview variable that is determined in a pulldown. My code looks like this: <module name="Pulldown"> <param name="postProcess">chart min(value) as min by valuebuck</param> <param name="name">minnum</param> <param name="label">minnum</param> <param name="staticFieldsToDisplay"></param> <param name="searchFieldsToDisplay"> <list> <param name="label">min</param> <param name="value">min</param> </list> </param> <module name="Search" layoutPanel="panel_row2_col1"> <param name="search">counter="Active Items" | timechart span=2h max(value)</param> <module name="HiddenChartFormatter"> <param name="charting.chart">line</param> <param name="charting.axisY.minimumNumber">$minnum$</param> <module name="FlashChart"> <param name="width">100%</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> Is this possible? What am I doing wrong? ... View more

I am charting a range of 30 values (let's call them R) staring around 689511876 ending 690635036. The timechart report gives me a y-axis-min=0 y-axis-max=700,000,000. I want the y-axis min and max to be data dependent, i.e. y-axis-min=min(R) and the y-axis-max=max(R) is there a way to easily do this? If not, how do I get more a more reasonable y-axis range? ... View more

I have a simple script that returns some fields in TSV form that looks like this: Date\tJobName\tCounterName\tValue for example: Apr 14 13:00:00 2011 AlignmentMetrics SpliCounter 0 I want the splunk indexing/search to pick up these fields (i.e. date, job, counter, value) so I added this to splunk/etc/system/local/props.conf: [imd-log] TRANSFORMS = imd-header-fields And I added this to splunk/etc/system/local/transforms.conf: [imd-header-fields] DELIMS = "\t" FIELDS = "date","job","counter","value" I then restarted splunk, went to manager/data-inputs remove the job, and added it again with sourcetype=imd-logs. Trouble is in the search app I don't see any of the new fields anywhere. What am I doing wrong? ... View more

We're getting this error when clicking on one of the jobs in "job management": 500 Internal Server Error KeyError: 'vsid' This page was linked to from http://splunkserver:8000/en-US/app/launcher/job_management. Here's the detail of the error in web_service.log: 2010-03-15 09:53:26,508 WARNING util:48 - Exception in resurrectSearch when trying to parse the following search - search 0xC0000072 AND shost!=FSCAN AND shost != someipaddress AN D shost !=somehostname duser!=*$ hoursago=62 | stats count(duser) by duser, shost, suser 2010-03-15 09:53:26,543 ERROR customlogmanager:22 - [15/Mar/2010:09:53:26] HTTP Request Headers: REFERER: http://mparcprd201.uboc.com:8000/en-US/app/search/job_management HOST: mparcprd201.uboc.com:8000 ACCEPT: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,/;q=0.5 ACCEPT-CHARSET: ISO-8859-1,utf-8;q=0.7,*;q=0.3 USER-AGENT: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.89 Safari/532.5 CONNECTION: keep-alive COOKIE: session_id_8000=b279d0119ee1bd6c60066a6701908238db897e12 Remote-Addr: 10.150.28.71 ACCEPT-LANGUAGE: en-US,en;q=0.8 ACCEPT-ENCODING: gzip,deflate,sdch 2010-03-15 09:53:26,544 ERROR customlogmanager:22 - [15/Mar/2010:09:53:26] HTTP Traceback (most recent call last): File "/opt/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 606, in respond cherrypy.response.body = self.handler() File "/opt/splunk/lib/python2.6/site-packages/cherrypy/_cpdispatch.py", line 25, in call return self.callable(*self.args, **self.kwargs) File "/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/routes.py", line 307, in default return route.target(self, **kw) File "", line 1, in File "/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 28, in rundecs return fn(*a, **kw) File "", line 1, in File "/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 76, in check return fn(self, *a, **kw) File "", line 1, in File "/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 116, in check_login return fn(self, *a, **kw) File "", line 1, in File "/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 137, in handle_exceptions return fn(self, *a, **kw) File "/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 1099, in render templateArgs = self.buildViewTemplate(app, view_id, action, q, sid, s, earliest, latest, remote_server_list) File "/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 1016, in buildViewTemplate if len(savedSearchObject['vsid']) > 0: File "/opt/splunk/lib/python2.6/site-packages/splunk/entity.py", line 449, in getitem return self.properties[key] KeyError: 'vsid' ... View more