HI kpavan, It is simple. Take a look on this link. I'm sure it will help you. https://answers.splunk.com/answers/59008/change-the-login-page-and-master-page-of-splunk.html Good luck. ... View more

Hi, you can only use css inside of an HTML tag. So, if possible you should first of all try enclosing that part of the code with HTML TAG. ... View more

HI, _indextime might help you. The _indextimefield contains the time that an event was indexed, expressed in Unix time. You might use this field to focus on or filter out events that were indexed within a specific range of time. ... View more

HI,can you show your xml code? ... View more

Hi, you can modify the default splunk python script, as this is the script that actually send the emails. It resides in: $SPLUNK_HOME/etc/apps/search/bin/sendemail.py . To rename the attached csv name , rename the default filename ( filename = "splunk-results.csv") I advice you to see this: https://answers.splunk.com/answers/2641/how-do-i-customize-scheduled-search-alert-emails.html ... View more

HI TRY THIS index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) | timechart avg(Value) by host ... View more

I agree with you JEFFLAND. It is a good thing to downvote a misleadind answer, but no need to do it when an answer do not just solve the problem. It is discouraging to be downvote simply because your answer do not solve the problem. If we all see things like woodcok ,It simply mean that answers.splunk.com will become a plateform for those who knows an not for those who want to learn. ... View more

Hi Bugnet, i hope what you want is a concatenation. if yes try this: ... | strcat cs1 "_" cs1lable User-Agent doing so will give you the expected result if your fields cs1 and cs1lable are extracted fields ... View more

I think ,to have the two timestamps, we need only to set the TIME_FORMAT to the format of 11:14:00 808 milliseconds .By doing so the other timestamp will be set by default to the same format. SO try this TIME_FORMAT= %y%m%d %H%M%S%3Q where 3Q is for milliseconds. AND do not forget to specify TIME_PREFIX . your stanza in props.conf will look like this for example: [source::] TIME_PREFIX = ][ TIME_FORMAT = %y%m%d %H%M%S%3Q TIME_FORMAT starts reading after the TIME_PREFIX (or directly at the start of the event, if there's no TIME_PREFIX attribute). ... View more

HI , see how to to it with TIME_FORMAT in props.conf http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Configuretimestamprecognition ... View more

try this: index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name] ... View more

try this: ... | eval time_field=strptime (_time,"%Y-%m-%d")| stats max(fieldname1) as fn1 by time_field ... View more

docs.splunk.com/Documentation/Splunk/6.0.2/Viz/Dynamicdrilldownindashboardsandforms ... View more

index= _audit action=search | eval [rest / services/ search / jobs splunk_server = loca l | addinfo | where sid = info_sid | rename eai: acl. app as my_app_name | return my_app_name ]|stats count(search) AS "Number of search" by my_app_name ... View more

Hi this will help : docs.splunk.com/Documentation/Splunk/6.2.2/Data/Configuretimestamprecognition ... View more

try this: ..........|stats .......................over yourField ... View more

What is the source of your data? is it from a forwarder? if yes, it may be a game of time zones. see docs.splunk.com/Documentation/Splunk/6.2.2/data/Applytimezoneoffsetstotimestamps ... View more

HI try this: index=sqltem OR index=jobinfo|table starttime, endtime, user_id, dbname, instruments_processed, inst_skipped, error_nums,jobid,user_id,database,status,jobstarttime,jobfinishtime YOU CAN USE ......|fields ........ AT THE PLACE OF ........|table........ ... View more

Hi this will help. docs.splunk.com/Documentation/Splunk/6.2.2/Data/Configuretimestamprecognition To configure how Splunk Enterprise recognizes timestamps, edit props.conf . There are a number of attributes that pertain to timestamps. In particular, you can determine how Splunk Enterprise recognizes a timestamp by using the TIME_FORMAT attribute to specify a strptime() format for the timestamp. You can also set other attributes pertaining to timestamps; for example, to specify where a timestamp is located in an event, what time zone to use, or how to deal with timestamps of varying currency. ... View more

Hi there are many ways : lets do IFX. 1-from the result of your search.click the arrow to the left of timestamp of an event. 2-select EXTRACT FIELD under EVENT ACTION 3-the IFX opens in a new window, EXTRACT FIELDS. 4-Now it depending on the splunk version,the UI will be different. but in 6.2... there are steps. 5- at the first or the 2nd step, where you have a sample event, SELECT THE STRING you consider as value, a text box will be open and PUT THE NAME OF THE FIELD. 6-after that follow carefully the other steps ...... for other ways see: docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Managesearch-timefieldextractions ... View more

can you be more explicit on what you want? what do you mean by dynamic hostname and index? can you provide a sample of the result you are expecting? ... View more

Hi john_howley, this may help: stackoverflow.com/questions/23763141/splunk-concurrent-seaches-user-vs-system ... View more

Hi here is an example of usage: props.conf: [your_data_sourcetype ] SHOULD_LINEMERGE = false LINE_BREAKER =([ \r\n ]+) REPORT - delims= commalist transforms.conf: [commalist ] DELIMS = "," FIELDS = field1 , field2 , field3 , ... you can also use in your props.conf options like: LINE_BREAKER =..... SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE = ..... MUST_BREAK_AFTER = ..... FIELD_DELIMITER =... ... View more

Hi, try specifying 100% rather than 450px ... View more

HI ilyazs, if you want list of hostnames(host) with index names ,try this: source=logFile1 OR logFile2 |stats values(host) AS hostName values(index) AS indexName by source i suggest you to read this: docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Whatsinthismanual ... View more