This is pretty cool! I didn't know about the map keyword. It didn't work as is, I had to add an extra "search" keyword in there. The final result was this host=firewall* | dedup host | table host | map search="search host=$host$ | stats count by error_code event_desc | sort -count" maxsearches=100 ... View more

Thanks. This combined with a little more searching helped me find the syntax. http://splunk-base.splunk.com/answers/3435/escape-and-in-the-xml-of-dashboards?utm_source=supportcase&utm_medium=link&utm_campaign=relatedanswers&utm_term=Syntax+error+when+adding+regex%27s+in+the+XML+of+a+dashboard ... View more

I know this is old, but a shorter way to do this is: host="server1" source="df" usedPct | eval usedPct = trim(usedPct, "%") This will allow you to keep the original column, just reformatted without percent, rather than creating a new field called "myString" ... View more

Check your Apache logging format (httpd.conf). The jobs running behind the tables require the "combined" format. You may be in "common" format. The jobs are using search filters based on referrer or client UI. This causes an empty result set if your logs are in "common" format. A simple way to test this is to try comparing the following searches in the web intelligence search window: "eventtype=pageview eventtype=ua-browser-*" vs. "eventtype=pageview". If you have no results on the first one but plenty of results for the second one, then the jobs I'm talking about are likely failing with no results. ... View more

Ahh, you should be able to do that using the append command, there are examples in the SplunkDeploymentMonitor app that do this. Let's assume you want to compare today with the same day last week, then the basic idea is as follows: search .... | timechart span=1h count | eval marker="Today" [search earliest=-7d@h latest=-6d@h ... | timechart span=1h count | eval marker="LastWeek" | eval _time =_time+86400*7] | timechart span=1h sum(count) AS count BY marker Note: we need to add 86400*7 to the timechart results of last week so that we can overlap the last week's timechart onto the today's. ... View more

I also added a note about changing the source too. Specifically, to look into having the script send the events directly to Splunk, skipping the intermediate file. ... View more

Hi, you can Get both Ip-Address and Host using the site Ip-Details.com .They are accurate and Reliable.I usually do Ip-Search in this site.So I Prefer you to this site.It will be more Useful to you.... ... View more

I have not seen this before. I would definitely get this to support@splunk.com ... View more