I have created a form with a time selector dropdown box. When I print the results the dropdown box does not display. I need to have the dates and times selected displayed on the report. How can I do that? This is also useful for other dropdown boxes that are not time selectors. <input type="time" searchWhenChanged="true"> <default>Last 7 days</default> </input> Thank you, Don ... View more

I am creating a table and simply reordering the fields from events. When I view the table there are random blank rows. How can I eliminate those rows? index=mainframe sourcetype=dalystat INTVCICS | eval _time = strptime(time,"%m/%d/%y ;%H:%M") | table System TranName APPLID TranCount AvgRespTm AvgCPUtm DB2Requests AvgDB2waitTime MQRequests AvgMQwaitTime AdabasRequests AvgADABASwaitTime ... View more

I have a data source I am trying to ingest into Splunk. It is a txt file that is written to by multiple systems. My problem is that each system writing to the file has it's own date format. I have worked out two of the three data sources which have a two digit year The third data source has a four digit year. Below is what we are currently using in props.conf and a sample of the data. TIME_FORMAT =%m/%d/%y TIME_PREFIX=NODE\w{2}\s+; INTVCICS;08/29/2014 ;23:30 ;1B90;T100 ;1 ;0 ;0 ;0 ;0.608 ;2.659 ;0.000 ;0.000 ;0.000 ;VENDORS ;XXXXX NODEPR ;08/27/14 ;1D81;ECM_storeDocumentToCI_MF ;Extract Message-Code/Decode ;0.002 ;0.001 ;103 ;XXXXXXXX ;ComputeNode ;XXXXXXX NODENP ;08/29/14 ;1B90;5:58 ;CM_retrieveClaimHistoryDtlCMS_MF ;SOAP Reply ;0.001 ;0.001 ;25 ;XXXXXXXX ;SOAPReplyNode ;XXXXXXX Thank you, Don ... View more

I am trying to use fschange to monitor some SharePoint directories. As a user on my remote forwarder box I can access the directories. I am logged onto the server using the same domain account that splunkd uses. When I enable the fschange monitoring I get the following message in the splunkd.log. 08-08-2014 09:17:41.259 -0400 WARN FSChangeMonitor - Monitoring file or directory that doesn't exist at startup time any help you could provide would be greatly appreciated. Thank you Don ... View more

My problem is that in my data source, when a user logs on there can be a single entry or multiple entries. I need to eliminate the duplicates for each time interval but allow for future events by that User ID. I have tried dedup and distinct count. Does anyone have any suggestions? index=* prdwfcs*/88 WFCSUID=UserID | stats count dc(WFCSUID) index=* prdwfcs*/88 WFCSUID=UserID | dedup WFCSUID ... View more

When I look at license usage no split I am well below my license limit. When I split by index there is an index called pool size that starts at our license limit every day. So, as soon as we consume any data we get a license violation. ... View more

I am stuck on creating a search. I need to sort my results by Agency and I need to list a count of all events as well as a count of all events broken down by the values in the Cause field. The search below accomplishes everything except showing the count of the Cause values. index=dspro sourcetype=bootlogmaster force=*| stats values(Cause) count by Agency AgencyName Any help would be greatly appreciated. Thank you, Don ... View more

I am having problems formatting the date/time for a new data source. I have posted an example with six lines. The first three lines are only getting the time captured and the second three lines are working properly. I have tried regex, specified the time format and using a preface. Any help you can give would be greatly appreciated. Thank you, Don -rw-r--r-- 1 t9266 Domain Users 52210 Jun 14 05:38 EAI_CGIRespToADHOC_MF_ReqId_Q565701528.eml -rw-r--r-- 1 t9266 Domain Users 193537 Jun 14 05:41 EAI_CGIRespToADHOC_MF_ReqId_Q567401787.eml -rw-r--r-- 1 t9266 Domain Users 184729 Jun 14 05:44 EAI_CGIRespToADHOC_MF_ReqId_Q567802243.eml -rw-r--r-- 1 t9266 Domain Users 6596 Jun 16 11:07 CHM_retrieveIntmdDtlMDMPrntInqry_MFNA 2239.eml -rw-r--r-- 1 t9266 Domain Users 6620 Jun 16 14:40 CHM_retrieveIntmdDtlMDMPrntInqry_MFNA 8359.eml -rw-r--r-- 1 t9266 Domain Users 186290 Jun 16 20:55 EAI_CGIRespToADHOC_MF_ReqId_Q538004157.eml ... View more

I have been working on a search for a while and I am stumped. I am searching two different source types. One value I am extracting is a stats count and the other is the sum of values from the other source type. I need to combine the results from the two based on a single field. The field exists in both source types but each has it's own name. If I do not rename it one of the two values is present. If I rename it then the other shows. I really need to get both of these values in and be able to run an eval on them to determine percentage to understand who is having the most problems using our software. The two fields that match are Agency and Agent. index=dspro (sourcetype=telemetry(Version=PROD OR Version=BETA OR Version=ALPH)) OR (sourcetype=bootlogmaster (DSproSystem=Prod OR DSproSystem=Beta OR DSproSystem=Alph)) | rename Agent as Agency | stats sum(TotalTransactions) as transaction_count count(eval(sourcetype="bootlogmaster")) as error_count by Agency | eval percent=(error_count/transaction_count)*100 | sort by Agency ... View more