thanks a lot.. removing case_sensitive_match worked.. ... View more

The KVStore could be present inside an app and you may be running the search from search app. The search is not able to reach the kvstore. try running the search from the app where the kvstore is created. ... View more

this is the view i am using. it uses a saved search along with postprocess View Adhoc <param name="filter">*</param> <param name="maxSize">2</param> <param name="clearOnJobDispatch">False</param> <param name="html"><![CDATA[ <h1>Adhoc Search</h1> ]]></param> <module name="SavedSearch"> <param name="name">WaasMonitoring-30d</param> <module name="HTML"> <param name="html"> <b> </module> <module name="TextField"> <param name="float">left</param> <param name="name">EventCode</param> <param name="label">EventCode</param> <param name="template">EventCode="$value$"</param> <module name="TextField"> <param name="name">NetworkCode</param> <param name="label">NetworkCode</param> <param name="template">NetworkCode="$value$*"</param> <module name="TextField"> <param name="float">left</param> <param name="name">Site</param> <param name="label">Site</param> <param name="template">Site="$value$"</param> <module name="TextField"> <param name="name">location_id</param> <param name="name">location_id</param> <param name="label">Location Id</param> <param name="template">location_id="$value$"</param> <module name="TextField"> <param name="float">left</param> <param name="name">SiteTier</param> <param name="label">SiteTier</param> <param name="template">SiteTier="$value$"</param> <module name="TextField"> <param name="float">left</param> <param name="name">SiteCategory</param> <param name="label">SiteCategory</param> <param name="template">SiteCategory="$value$"</param> <module name="TextField"> <param name="name">Site_SubCategory</param> <param name="label">Site SubCategory</param> <param name="template">Site_SubCategory="$value$"</param> <module name="HTML"> <param name="html"><![CDATA[ Note : Search is run for the past 30 days. Wildcards can be used ]]> <module name="Button"> <param name="allowAutoSubmit">False</param> <module name="PostProcess"> <param name="search"><![CDATA[ search $EventCode$ $NetworkCode$ $Site$ $location_id$ $SiteTier$ $SiteCategory$ $Site_SubCategory$ | table _time EventCode priority NetWorkCode location_id Region Site SiteStatus SiteTier SiteCategory Site_SubCategory]]> <module name="Pager"> <param name="maxPages">50</param> <param name="count">20</param> <module name="Table"> <module name="SearchControls"> <param name="sections">export </param> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> </module> ... View more

thanks a lot for the response. i am using splunk 6.2 and sideview utils 3.3.. any help on how to fix it? ... View more

awesome that's good to know. ... View more

thanks for the response. i am getting an exception in the configure input screen. "Encountered the following error while trying to save: In handler 'command': Command name md5sum does not exist" ... View more

Hi Could you please let me know on how to use the Command Modular input. I was not able to find any details documentation on how to use it. i found that it was a TA and i was not sure on how to reach the command screen as shown in the screen shot. ... View more

i think i have not posted my question clearly.. inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query my second query is index=equivalency sourcetype=json | spath | stats list() as | transpose which would result all the fields in the JSON. i want to pass the fields from the first query to the second query to filter the JSON data. ... View more

i think i have not posted my question clearly.. inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query my second query is index=equivalency sourcetype=json | spath | stats list(*) as *| transpose which would result all the fields in the JSON. i want to pass the fields from the first query to the second query to filter the JSON data. ... View more

i think i have not posted my question clearly.. inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query my second query is index=equivalency sourcetype=json | spath | stats list(*) as *| transpose which would result all the fields in the JSON. i want to pass the fields from the first query to the second query to filter the JSON data. ... View more

i think i have not posted my question clearly.. inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query my second query is index=equivalency sourcetype=json | spath | stats list(*) as *| transpose which would result all the fields in the JSON. i want to pass the fields from the first query to the second query to filter the JSON data. ... View more

i think i have not posted my question clearly.. inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query my second query is index=equivalency sourcetype=json | spath | stats list(*) as *| transpose which would result all the fields in the JSON. i want to pass the fields from the first query to the second query to filter the JSON data. ... View more

this query too jus extracts the fields and not the values along with the fields.. is it possible to extract the values too from the JSON along with the fields and display it in a table. ... View more

i want to add lookup table to the search criteria. for ex: index = tech sourcetype=json technology=os | fields ************ i want the fields to be extracted from the lookuptable.i am trying to implement properties file kind of functionality , where when i add fields to the lookup table the search query in the app automaticaly detects it and uses it in its query. ... View more