Hi, I am using Hunk for Hadoop data. Is it mandatory to install a Hadoop instance/Hadoop on the Hunk Server? Can u please give me a clarification on this? Why does it require a Hadoop instance? Thanks in Advance ... View more

Hi, I am using the search below to display the events: index=a|table emp_id, emp_name, emp_sal but i am getting the space starting of the search output. ex: i am getting the output as emp_id = 1 How do I remove all the space in the string so it becomes "emp_id=1" ... View more

hi, i have to attach the current time in sendemail Below is my search: index=_internal| head 5|table source,sourcetype | sendemail [email protected] server=localhost subject="Report No 1 has been executed at"+""+now() message="This is an example message" sendresults=true inline=true format=raw sendpdf=false and also i have tried index=_internal| head 5|table source,sourcetype | sendemail [email protected] server=localhost subject="Report No 1 has been executed at"+""+$_time$ message="This is an example message" sendresults=true inline=true format=raw sendpdf=false but i am not getting the date in the message. Getting Output: Report No 1 has been executed at Expected Output: My Subject : Report No 1 has been executed at 27/05/2015 10.12.10 AM Please suggest how to edit my search. Thanks in Advance ... View more

Hi, i have Hunk licence. i wants to know the how the hunk license will work with hadoop cluster nodes Thanks in Advance ... View more

Hi, I am using join in a splunk dashboard with two indexes with time as parameter, but i am not getting the correct results. Without the join, it is working fine. The date column is st_date and I have used this column in the token also, but I am still getting the wrong output. Please suggest if I missed anything. My search: index=a| JOIN type=inner aid[ SEARCH index=b] |table st_date,aid,location My Xml: test Clone <input type="time" token="st_date" searchWhenChanged="true"> <default> <earliest>0</earliest> <latest></latest> </default> </input> <panel> <table> <search> <query>index=a| JOIN type=inner aid[ SEARCH index=b] |table st_date,aid,LOCATION</query> <earliest>$st_date.earliest$</earliest> <latest>$st_date.latest$</latest> </search> <option name="wrap">undefined</option> <option name="rowNumbers">undefined</option> <option name="drilldown">row</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </table> </panel> Index a sno st_date aid 1 01/01/2014 10 2 01/01/2015 5 Index a sno aid LOCATION 1 10 us 2 5 UK If i select date (startdate & enddate) as '01/01/2014 ' & '02/01/2014 ' Expected result sno LOCATION aid 1 us 10 but i am getting result as sno LOCATION aid 1 us 10 2 UK 5 Please suggest how to get the Expected result and how to use date parameter as the where condition in splunk search/dashboard with join. ... View more

Hi, Can you please share How to convert mongodb ISO date into Normal date format in Hunk . I am getting the date format as "1426185748" but i want the output format as "YYYY-MM-DD" Thanks in advance ... View more