Preemptive note, I am not looking for instructions on how to run a subsearch.   I have results from a completed search that goes back 90 days which took an extremely long time to run. Lets say the search was:     index=foo     Now that I have those results, I need to filter them down, lets say I'd like to filter them down to:     index=foo host=bar     I'd like to search within those results without Splunk having to query the entire indexer again to reduce the amount of time the second search takes. Basically, is there any way to have Splunk query the existing, cached results already on the search head rather than having to query the indexer twice? ... View more

I have a dashboard that is only accessible via drilldown. When drilldown occurs, a hostname is passed to this dashboard, and all filters are set to invisible using the "depends" attribute. I need to set the title of the dashboard (not a panel within the dashboard, but the dashboard itself) as the hostname that was passed to it. Here's the code I have so far, this is not currently working. Instead, Splunk is presenting the literal text "$server$". Can anyone please help? <form> <label>Windows Monitor > $server$</label> <fieldset submitButton="false"> <input type="text" token="server" depends="$thisTokenDoesNotExist$"></input> </fieldset> ... </form> So when the token passed is "form.server=MYSERVER", I want the dashboard label to display as: Windows Monitor > MYSERVER ... View more

Basically, I want to plot a baseline (average count per host over 1 week) over an existing graph I have of my "top 10 talkers". Dropping this problem down to two hosts for simplicity, let's say I have a host, "foo". When I run | tstats count WHERE (host=foo* OR host=bar*) by host, _time , I get a table similar to the following: host | _time | count foo | 2018-11-11 | 3719 foo | 2018-11-10 | 1344 foo | 2018-11-09 | 9615 bar | 2018-11-11 | 4894 bar | 2018-11-10 | 8897 bar | 2018-11-09 | 128 Now, what I want to do is the following: Average all days OTHER than the current day (In the above example, get the average of the count of the 9th and 10th) per host. [EX: Average of 9th and 10th for Foo is 5,479.5, Average of 9th and 10th for Bar is 4,512.5] Add the average taken as a new column for ALL days of that host, including today. I then want to discard all entries older than today, leaving me with just today's foo and bar values, as well as their averages over the previous two days. I then want to plot these two in a bar graph, with a line through the bar showing the average value (or some other similar marker over the bar to indicate what the average the previous 2 days was). So really, I want my results to look something like this. Here's what I have now. | tstats count by host, _time | eval time=_time | eval day=strftime(time,"%j") | eval today=strftime(now(),"%j") | eventstats avg(count) by host AS average | where day<today | sort -count Basically I can't figure out: How do I get the where clause ONLY to apply to the eventstats clause (AKA "Perform an eventstats only on results where day)? ... View more

So, I know MV Combine asks that you specify the one unique field in a set of results, and returns a multi-value entry that merges all the non-unique values. I want to do the opposite. I have a table of events that contains a single non-unique field, and I want to merge the unique fields into a single event. For example, the original table might look something like this: And I'm trying to turn it into something like this: Does anyone have any insight into how I could do that? ... View more

So basically, I have a ton of events coming in on UDP 514. Based on the document linked below, I was able to configure my Sourcetype Overrides so not everything comes in as "Palo Alto". However, now my 3PAR Storage Array logs are coming in as: sourcetype = 3par_array index = network I'd like to override my Index field based on the Regex I configured for Sourcetype Overrides, however Splunk says that "DestKey = Index" is undefined. Could someone please help me out? http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Advancedsourcetypeoverrides ... View more