While this works perfectly for any number within last 24 hours but when I change time to 7 days or something else, title shows the "...in the Custom time" Any fix for this ? ... View more

Hi, when I added it to my dashboard, the table doesn't show any results, it says "Search is waiting for input..." ... View more

Is there any way to display results in a report for the entire environment (ie. sh1, sh2, sh3...etc) or will it need to be run individually for each instance? ... View more

Try this: index="x" sourcetype="x" ConfigManagerErrorCode=28 | stats count BY host | rename COMMENT AS "The stuff below converts your 5 rows into 1" | eval hosts="counts" | xyseries hosts host count ... View more

Looks like its SPLUNK GUI BUG, When i tried saving this token using XML at backend, it worked!! It was having trouble through Splunk GUI. ... View more

HI @DalJeanis Thanks for replying. i will clear out the air here. I am using a for loop and where variable i decides the batch size inside loop there is if condition, if satified one condition it starts search4, till now everythings work great. In else Condition, i am triggering start search9 where the value of variable i is being used to set a token used in search so for e.g if value of i =1 , i am setting token value token1=400 and token2= 200 and triggering search using startSearch(). if value of i =2 , i am setting token value token1=600 and token2=400 and riggering search using startSearch(). and so on till loop is valid. now ideally in else loop, if there are 3 values of i there should be 3 instances of token and search JOB, instead i always and only get last instance of search9. please let me know if you need more explainations. Thanks ... View more

Hi @tareddy | inputcsv testCSV.csv , you will get date(human readable or EPOCH, However you had put them while creating CSV as STRING) , so u need to format string to time using strptime and strftime , once you have it in timeformat. you can use filters to get your desired results ... View more

You can also add the time filter into the WHERE clause of inputlookup , e.g. | inputlookup MyKVstoreName WHERE [| makeresults count=1 | addinfo | eval info_max_time=if(info_max_time=="+Infinity", 2147483647, info_max_time) | eval search="( (MyTimeField>=" . info_min_time . ") AND (" . "MyTimeField<" . info_max_time . ") )" | table search ] ... View more

KV Store is intended to be use for large data sets so I'd continue to use a single lookup rather than have to update your macro every month. If you have doubts, Google mongodb. ... View more

I'm actually connecting to Informix, I was able to convert to epoch using ((DATE(dt) - DATE('1970-01-01')) * 24 * 60 * 60) AS epoch_time where dt is the date field. Still not having much luck creating a db input, though ... View more

this is feasible and i completely understand it ... View more

General principles: if it worked and then stops, something has changed. What changed? Assuming that all the applicable logs are in Splunk, set the search window to the time when it stops working and look for errors... or even just (* OR index=_internal) | dedup punct to see a rough idea of what types of things are in there. ... View more

Have you tried copying transpose.py from $splunk_home/etc/apps/search/bin/ to an app that the user has access to? ... View more

I am using Splunk cloud and Jira cloud: I give the below details in splunk, get the error :Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/splunk-add-on-jira-alerts/admin/jira_alerts_install/jira JIRA Alert Actions Configure JIRA Alert Actions Server Server Base URL https://splunkatlas.atlassian.net/ JIRA Username JIRA Password Since Splunk cloud and Jira cloud both on cloud, I dont think there is any firewall in between is causing the problem or could be. Any similar experience advise would help. Thanks!. , ... View more

After playing around with this I was able to get over the 10k or 50k results. This required all 3 settings on the search head. $SPLUNK_HOME/etc/system/local/limits.conf [scheduler] max_action_results = 175000 [searchresults] maxresultrows = 175000 $SPLUNK_HOME/etc/system/local/alert_actions.conf [default] maxresults = 175000 this enables an email alert containg a .csv to have 175k rows Note: When I pushed the same configs from deployer and they ended up in an app/default as it should, but my .csv was limited to 10k rows.. when i put it straight on $SPLUNK_HOME/etc/system/local via cli on each member I got 175k rows in the csv ... View more

This is exactly what i was looking for, Thanks @Vganjare ... View more

@Amohlmann thanks for quick response, i undertand that out of box splunk does not have this capability . but there is an app for the same. i want to integrate that app or write my own python/js files to do this action ... View more

Have you tried using the User Navigation within Splunk? If not this can achieve want you want to, have a look here and download the pdf: http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/BuildNavigation ... View more

Hi , Nawneel I think you can do it like this(in splunk 6.2): 1- you create 2 new roles for users of each group with appropriate restriction. 2- when you edit the dashboard permission you will see the roles you created. Now for that dashboard, you can tick read or write. doing so alls users to whom you have assigned the role will be affected by that. Note: to create role in splunk web go to : setting -->Access control-->Role to edit dashboard permission : setting-->User interface-->Views, localize your dashboard and edit permission ... View more

I don't see, "return value 3" anywhere in this. This might help you figure out specifically which action is failing or help you help us figure out what is wrong: https://technet.microsoft.com/en-us/library/cc535232.aspx ... View more