@richnavis  Can you please try this? YOUR_SEARCH | autoregress Time_End as Time_End_pre p=1 | autoregress Source_Number as Source_Number_pre p=1 | autoregress Dest_Number as Dest_Number_pre p=1 | eval duration_Time_End_pre=strptime(Time_End_pre,"%H:%M"),duration_Time_Start=strptime(Time_Start,"%H:%M") | eval duration = round(duration_Time_Start-duration_Time_End_pre) | eval callbacks = if(Source_Number=Source_Number_pre AND Dest_Number=Dest_Number_pre AND duration<=120,"True","False") | table Time_Start, Time_End, Source_Number, Dest_Number duration callbacks   My Sample Search : | makeresults | eval _raw="Time_Start, Time_End, Source_Number, Dest_Number 10:10, 10:20, 555-1212,555-1313 10:22, 10:30, 555-1212,555-1313" | multikv forceheader=1 | autoregress Time_End as Time_End_pre p=1 | autoregress Source_Number as Source_Number_pre p=1 | autoregress Dest_Number as Dest_Number_pre p=1 | eval duration_Time_End_pre=strptime(Time_End_pre,"%H:%M"),duration_Time_Start=strptime(Time_Start,"%H:%M") | eval duration = round(duration_Time_Start-duration_Time_End_pre) | eval callbacks = if(Source_Number=Source_Number_pre AND Dest_Number=Dest_Number_pre AND duration<=120,"True","False") | table Time_Start, Time_End, Source_Number, Dest_Number duration callbacks   Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more

This is still working in 8.1x But also please vote for an official method for wildcarding sourcertypes : https://ideas.splunk.com/ideas/E-I-11 ... View more

shankarananth, if you could convert your comment to an answer, I will accept that as the answer ... View more

Thanks yannK.... I went ahead and tested this and that is exactly what happens. Splunk does not remove it. I agree that having a mixture of manual and auto apps could be confusing, and that is not what I'd prefer to do, but it appears the splunk documentation suggest that deploying the splunk_ta_aws app should'nt be done by the deployment server when deploying to the heavy forwarder. Anyway, your wisdom helped. Thanks! ... View more

@richnavis, any success with trying out the suggested solutions yet? ... View more

Yes, there are lots of us that drive alerting off of splunk, or through splunk to another application. But your idea for an overall architecture is probably too much of a one-size-fits-all. Just because there exists an event -- let's say a password failure -- doesn't mean that there is anything wrong. Not all alerts are created equal. Think of an alert as a report that you want someone to receive whose purpose is to draw their attention to something. The urgency of the "something" -- and also the specificity of the "something" as being out of the normal range --will determine the frequency you need to alert on. 1) Tell me within a day if the previous day we reached over 80% disk usage on any machines in group XYZ. 2) Tell me within X hours (or YY minutes) if a host becomes unavailable or stops reporting. 3) Tell me monthly if any user goes over X hours of working from home , or if any user visits certain types of websites more than X times in the 30 day period. 4) Tell me within X minutes (or YY seconds) if the number of event X per second goes outside of normal bounds. Sometimes there will be events that are probably just normal goofs, but over the medium term you have to check for patterns to make sure it's not some kind of attack (whether outsider or insider). Not this second or minute, but also not a month from now. @adonio's suggestions are right-on. You will build up your knowledge base and your arsenal of alerts over time, creating them and adjusting them and retiring them over time as your business cases dictate and what is "normal" for your organization changes. Stick to the "Agile" way of thinking for now. Implement early and often, and adjust and reorient as you learn. Don't worry about getting it perfect, done is better than perfect, and splunk is easy enough to modify as you go along. ... View more

Just save it on the summary and do | makemv delim="," YOUR_SPARKLINE_SI_FIELD Then you can display it normally. ... View more

The "official" procedure is to copy from the frozen bucket to the thawed one and then rebuild it. I would assume that doing it from cold to thawed wouldn't be advised. You can allow the data to reach the frozen bucket and from there you can thaw it. Maybe this way would work for you... ... View more

Like this: ... | eval date_minute = strftime(_time, "%M") | eval FirstOrSecond=if((date_minute>=30), "Second", "First") | eventstats dc(FirstOrSecond) AS numHalves BY IP | where FirstOrSecond="First" OR (FirstOrSecond="Second" AND numHalves=1) | timechart ... ... View more

Check whether you can access the counters using perfmon on the local machine (assuming you have a forwarder on the local machine that is doing the collection). You may also need to use the 64 bit or 32 bit version of perfmon depending on whether your application is 64 bit or 32 bit. Sometimes the alignment of the counters gets corrupt and you need to rebuild the counter definitions in the registry. Another point is that the Splunk forwarder must have sufficient privileges to access the perfmon data (typically needs to run with an account that has local administrator rights). ... View more

Yup, adding date_hour=0 to your initial search run over 7 days is what you need. It'll be quick because those are indexed fields, resulting in this job inspector output: DEBUG: base lispy: [ AND index::myindex [ EQ date_hour 0 ] ] ... View more

@ tks that is useful I just used this to have the legend appear in this order error,warn,info, so this is what you would do with whatever labels you are working for. It is very statis as I was looking for something more dynamic based on the values in the graph. &lt;option name="charting.legend.labels"&gt;[error,warn,info]&lt;/option&gt; Also I was looking at this, anyone know what this does? &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; ... View more

I'm looking at 6.0.0/6.0.1. ... View more

Ah, TIME_PREFIX = \t ... View more

Thanks.. This worked! ... View more

Thanks for the reply.. Will certainly use this functionality if written.. ... View more

Thanks for your answer ... View more

I'm guessing a bit, but I think if you switch to the Table module, the column labels in Table are allowed to wrap, so if you switch from Splunk's SimpleResultsTable to the Sideview Table module your problem will go away. And the Sideview Table module does support the sparkline() function in stats, as of Sideview Utils 2.6.5, so you can switch to Table now without losing sparklines. to be specific, replace this: <module name="SimpleResultsTable"> <param name="displayRowNumbers">False</param> <param name="entityName">results</param> </module> with this: <module name="Table" /> ... View more

BUG! Turns out that by eliminating the regex part of the search, I can get this to work. Turns out that replacing regex search_name="(PRVD|ORDER|PRODUCT) with three explicit references to the search_name seperated by OR will get the script to fire. This is definitely a bug in their code (python perhaps) that their dev team should be aware of.. ... View more

You can use any regex with replace() . So replace(MSG,"\([^\)]*\)","(P)" would work for (non-nested) parens. ... View more

I have very similar problem also with perfmon. I though it happened because of delay in data, so I've tried to set time to search as rt-30s, the problem still exists, Some Ideas? ... View more