Hi, How to escape/ or use $ symbol from (?PERROR\s-\s[^\n\r]+?(?=\s[0-9]|$|[\n\r])) regex which is in below view View : <module name="URLLoader" layoutPanel="panel_row1_col1" group="Details" autoRun="True"> <module name="Search"> <param name="search">index="mwrap_idx" sourcetype="CARApp" $excep$ | rex field=_raw "(?P<test>ERROR\s-\s[^\n\r]+?(?=\s[0-9]|$|[\n\r]))" | rename test as Exception | lookup Lookupcarexcep.csv "Logged Text" AS Exception OUTPUT "Display Text" | table "Display Text" Exception _raw</param> <module name="SimpleResultsTable"> <param name="entityName">results</param> <param name="drilldown">row</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> <param name="popup">True</param> </module> </module> It is giving me "Unbalanced quotes" error ... View more

Hi, I've to create dashborad with two section in it. How should i give title for these sections inside dashboard. Currently I've used following code for title. <module name="SimpleResultsHeader" layoutPanel="panel_row1_col1" group="Server Health" autoRun="False"> <param name="entityName">results< /param> <param name="headerFormat"> < /param> < /module> I've used above "SimpleResultsHeader" module two times for two titles one at beginning but before "TimeRangePicker" module and one in the middle (i.e inside "TimeRangePicker" module). But After selecting different time the title which is inside "TimeRangePicker" module shows "None" The first title works fine because it is outside "TimeRangePicker" module. So is there any particular module to use as a Title? If i removed parameters from the above SimpleResultsHeader module it is giving me error? Any alternate way to do this? ... View more

hi this is mt search index=tm_idx host="server" "finished executing normally" | rex field=_raw "(?i)Process\s\"(?<Processname>\w+)" | rex field=_raw "elapsed\stime\s(?<myduration>\w.\w+)\sseconds" |eval pname=Processname+":"+"Process" |timechart span=1w sum(myduration) by Processname usenull="f"|sort _time i am displaying processes and their duration by week.I have kept a drop-down list to select a month but when i select month e.g September it gives me chart showing data from 29 august happening same for other months also. I want to start my chart time from 1st of every month.how can i do it ? Here i have selected march but i can see february data also which i don't want to. Thanks ... View more

Hi, I have installed Java-script SDK on my windows splunk 5.0.4 and node.js But i am not understanding how to run the Java-script codes can anyone guide me. i read installation guide given on http://dev.splunk.com/view/SP-CAAAEC9 but not understanding what to copy where totally confused this is my splunk installation directory C:\Program Files\Splunk Path of SDK D:\Splunk\splunk-sdk-javascript-1.2.1 where i should paste D:\Splunk\splunk-sdk-javascript-1.2.1\client files? Do i need to paste the SDK also in splunk installation directory? I want to integrate D3 charts for that will i be needing only client side/ server side scripting or both? Thanks Thanks ... View more

hi, hi, How can i plot value of three fields on timechart ProcessName duration(Sec) _time SaveAllData 1.2 2013-09-24T04:57:20.325+0530 SaveAllData 0.02 2013-09-24T02:57:17.680+0530 working_Days_test 0.05 2013-09-23T22:16:57.994+0530 CreateProductsCSV 0.05 2013-09-23T12:08:27.489+0530 i want to see a timechart which shows which process took how many seconds and at what time Thanks ... View more