I have a bunch of logs from a program that regularly updates local files with changes in network files, and I would like to find out which computers haven't received an update in the past 7 days. The fields I am using to differentiate the computers is source and sourcetype. However, the only way to tell if no files have been updated is if there are no events logged in splunk. Is there an feasible way to denote this? I need a list of all of the sources/sourcetypes which haven't had any events in the past 7 days. ... View more

I have a set of events that are generated with locations in the form of xloc and yloc. (z, or height, is irrelevant) I am trying to find events that happen in the same place, but I want to group any events that happen in the same area, say 5 meters. (+-5) Is there a way to do this in splunk? ... View more

I am relatively new to drilldowns, so this may just be a simple error in the order of my modules, but the module here isn't replacing $clicked.value$, but instead adding onto the end of the search string. <module name="HiddenPostProcess" layoutPanel="panel_row1_col1" group="Longest Time to Level(Based on Median)" autoRun="False"> <param name="search">fields "Level Reached", "Median Time to Level"</param> <param name="groupLabel">Longest Time to Level(Based on Median)</param> <module name="ViewstateAdapter"> <module name="HiddenFieldPicker"> <param name="strictMode">True</param> <module name="JobProgressIndicator"> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="HiddenChartFormatter"> <param name="charting.secondaryAxisTitle.text">Minutes</param> <param name="charting.chart">bar</param> <module name="FlashChart"> <param name="width">100%</param> <module name="HiddenSearch"> <param name="search">index=zos_gameplay event_type="level" | transaction source_player_id maxevents=2 | stats max(played_time) as max, min(played_time) as min, min(source_player_level) as StartingLevel, max(source_player_level) AS LevelReached by source_player_id | eval level_time=round((max - min)/60000, 2) | where level_time>0| where LevelReached=$click.value$ | stats list(level_time) as "Time to Level" by source_player_id, source_character_name | sort +"Time to Level"</param> <module name="ConvertToDrilldownSearch"> <module name="JobProgressIndicator"></module> <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">Top 10 Fastest Levelers for Level $click.value$</param> </module> <module name="HiddenChartFormatter"> <param name="chart">bar</param> <param name="primaryAxisTitle.text">Character Name</param> <param name="secondaryAxisTitle.text">minutes</param> <param name="legend.placement">none</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">160px</param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> The resulting search string is as follows: search index=zos_gameplay event_type="level" | transaction source_player_id maxevents=2 | stats max(played_time) as max, min(played_time) as min, min(source_player_level) as StartingLevel, max(source_player_level) AS LevelReached by source_player_id | eval level_time=round((max - min)/60000, 2) | where level_time>0 | where LevelReached=$click.value$ | search "Level Reached"="9" "Median Time to Level"="66.54" I don't want the "| search ..." to be added at the end. I just want the level value to replace $clicked.value$ Any suggestions? ... View more

I am trying to make an external dashboard for splunk that needs to be real time. At the moment, all we can do is make a script on our end to resend the search every so often and refresh the page for the new results. What I want to know, however, is if there is a way to query splunk to make a real time search. In other words, can a real time search be executed from some syntax in the search string? Without using the time range picker whatsoever? EDIT: I have tried to use " earliest=rt-10m latest=rt " but got an error saying: Invalid value "rt-5m" for time term 'earliest' ... View more

I am working on a game, and have been asked to create an interesting dashboard. My superiors want to know how long it takes a player to level up. however, they want it in played time, not world time. the field we are using for played time is an integer representing the total time (in milliseconds) that a player has been logged into the game. How would I go about creating a search that gives me the difference in the played_time field every time a player levels up? (signified by a level up event where the player's level has been increased) I have tried a transaction search (suggested from a previous question), but the only way I could think of to make it count for played_time ( ... | eval _time=played_time ...) returned many fewer results than the regular search, and took a long time. Any suggestions? the fields I need to use are player_name, player_level, and played_time. ... View more