I need to run many searches and consolidate all the results. Each search looks like this .......| stats count avg(field1) avg(field2) So the output columns are always the same, and each search will only generate one row. How can I send the output to one single CSV file? Is there a way to append to an existing CSV file? I can go via the Web UI or via CLI- either way is fine. Thanks! ... View more

Oracle contains a lot of information about processing/performance and storage. 1) Oracle Automatic Workload Repository (AWR) has processing/performance data. Currently we have a cron job that queries Oracle system tables, and dumps the output into a file in a tabular format, much like a SQL command output. This is per hour. 2) Oracle Automatic Storage Management (ASM) has storage usage data. Currently we have a cron job that queries Oracle system tables, and dumps the output into a file in a tabular format, much like a SQL command output. This is per day. Looking for best practice around how to splunk all this data. Ideally the file approach would be best- and potentially the SQL scripts could be changed to output in a specific format. Has anyone splunked any of this data successfully? ... View more

We have summary indexes currently but we have problems: When splunkd is down for maintenance summaries have gaps How is this better in 4.2? What are the other benefits? ... View more

I have a search command: .....|starttime=02/17/2011:19:20:00 endtime=02/17/2011:20:10:00 | timechart span=1s count When I click on "Show Report" to view the graph, the x-axis only goes from 19:20 to 19:24. Since I have a very granular span=1s I suspect I am hitting some graphing limit here. Any suggestions on getting the graph to display the full time range?? ... View more

I am parsing through a lot of data, so I want to do this preferably in one search command. 1) I want to generate distinct counts field1 and field2, grouped by field3. 2) I also want to generate distinct count on field1 and field2, without a group by. so for 1 I have something like this: ....| stats dc(field1) dc(field2) by field3 and for 2 I have something like this: ....| stats dc(field1) dc(field2) How can I combine both of these into one search command? so that I have the following table field3 dc(field1) dc(field2) a 20 30 b 50 80 Total 55 90 Note that Total unique != sum of a+b, because of overlaps. ... View more

Version 4.1.1 I am using advanced dashboard with the timerange picker option that is used by all the panels. I want to have a customized timerange picker drop down with only a few items such as: Last 15 minutes Last 60 minutes Last 4 hours and not the others. Is it possible? ... View more

How can I use lookups for a source CSV file that is not under the Splunk code tree? I am using Splunk 4.0.10. CSV lookups work fine when the file is under the Splunk code base, but it doesn't work when I place the file in a random location (accessible) separate from the code base. ... View more

I have seen documentation on lookups in general. I am most interested in dynamic lookups. Specifically I have the following scenario: Splunk 4.0.10 Oracle 11 how do I setup a JDBC connection to Oracle in the Splunk config files? How can I use the Oracle connection to lookup a table in Splunk at search time? Please provide some examples. Thanks! ... View more

How can I execute one search to display data on multiple panels in a dashboard? I want to chart several metrics for the same criteria (same time range, same index etc). However I want to chart these metrics on separate charts- due to scaling issues and clarity. So for a search like this: index=A | stats count, avg(responseTime) by host I want to chart count and avg(responseTime) on different charts on the same dashboard. However I dont want to split this up into two different searches for the two dashboard panels due to performance reasons. ... View more

I need to calculate the object allocation rate in the jvm. That value can be derived from the jvmlogs. If I subtract the "heapBeforeGC" field in one line from the “heapAfterGC” field in the previous line and divide it by the elapse time I can get a good estimate for how many bytes we allocate in the jvm per unit of time. I need to trend that value. Delta provides a diff between the same field in adjacent events. What can I use to diff different fields in adjacent events, and then trend that? Here are couple of log lines: 2010-05-11T00:09:26.079+0000: 325107.330: [GC [PSYoungGen: 451418K->42291K(453312K)] 1847697K->1438569K(1874624K), 0.0203820 secs] [Times: user=0.25 sys=0.01, real=0.02 secs] 2010-05-11T00:09:29.776+0000: 325111.027: [GC [PSYoungGen: 453299K->45942K(460864K)] 1849577K->1442220K(1882176K), 0.0228840 secs] [Times: user=0.27 sys=0.01, real=0.03 secs] I want to diff the fields in bold for successive events ... View more