@kristian_kolb Suppose we want splunk to evaluate yesterday's day on its own and we dont mention specific day of the week like "Wednesday"  and then use yesterday's day of week to compare data with same day of week for last 2 weeks, how we can achieve that? ... View more

Like this: | makeresults | eval x="183512 217654 217655 217656 217657 224808 263806 263807 263808 263809 263810 263811 279992 279996 314724" | makemv x | mvexpand x | rename COMMENT AS "Everything above creates test event data; everything below is your solution" | rex mode=sed field=x "s/(26380[6-9]|26381[0-1])$/group1/g s/^\d+$/group2/g" | stats count by x ... View more

Hi @xvxt006 Glad you were able to find a solution through @jkat54 🙂 Please don't forget to resolve the post by clicking "Accept" directly below his answer. This will make it easier to find for other users with similar questions. ... View more

Hi, Yes you are correct. I am trying to find if there are any repeated requests to that particular uri. i got the results but i am seeing the count as 1 and there is no single event with count as 2, which is not believable. I am still digging thru the data. ... View more

In order to replace a portion of a field (or _raw), you need to use capture groups in your rex sed replacement command. The syntax for including the capture group in the sed replacement is to use a backslash and then the number of the capture group (starting with 1). In the example below, I created two capture groups to get the first part of the URI and the back part after the product ID. I then structured the sed replacement to print out the first part (\1) followed by "XXX" (the static part you want to mask) followed by the second capture group (\2). Hope this helps! 😃 | makeresults | eval uri="/appliance/detail/v3.0/vendor/3423434erts/fridge" | rex field=uri mode=sed "s/^(\S+vendor\/)\w+(\S+)/\1XXX\2/g" ... View more

Answered in https://answers.splunk.com/answers/717313/how-do-i-do-a-reverse-dns-lookup-in-splunk-1.html ... View more

update ping; modified the answer to be correct now ... View more

you can use this command : | set union [ search 1] [ search 2] ... View more

Thank you ... View more

If this answered your own question then please mark it as accepted. If not then please explain your question. ... View more

feel free to vote and accept ..... ... View more

See this link for details on what all tokens are available for drilldown from a table. http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML#table_.28event_tokens.29 So, you would be able to use $click.name2$ for name of the click column (that will be 400) and $row.JVM$ OR $click.value$ for PR511 ... View more

Hi vganjare, You can that using the dropdown token in two search in the same panel! This is an code example where an user can select one sourcetype in dropdown that will interact with two search in the same panel. The token sourcetype ($sourcetype$) is in the both search like follow, try to run it! <form> <label>Dropdown Form Input Element</label> <description>Events Filtered by User and Sourcetype using Dropdown Form Inputs</description> <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="sourcetype" searchWhenChanged="true"> <label>Select a Sourcetype:</label> <prefix>sourcetype="</prefix> <suffix>"</suffix> <default>*</default> <choice value="*">All</choice> <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now"> <![CDATA[index=_internal | stats count by sourcetype]]> </populatingSearch> </input> </fieldset> <row> <panel> <table> <title>Table of Events for All or one sourcetype</title> <search> <query>index=_internal $sourcetype$ | table _time, sourcetype, _raw</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="displayRowNumbers">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="count">5</option> <option name="rowNumbers">true</option> </table> <table> <title>Table of count for All or one sourcetype</title> <search> <query>index="_internal" $sourcetype$ |stats count by group sourcetype</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="displayRowNumbers">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="count">5</option> <option name="rowNumbers">true</option> </table> </panel> </row> </form> ... View more

hi xvxt006, this is my email gyslainko@gmail.com , I come from Cameroon and I'm going to look at what you specify below. in case of further collaboration, you can write me. please forgive my english. ... View more

As mentioned in the docs you can add dynamic sub menus, also for alerts. I extended my answer with en edit. Hope this helps. ... View more

You can try to download the dmg file from Splunk.com and double click on it to install. This is very easy step. I have installed the latest version of Splunk on Mac and I don't see any problems. Please note that the latest version of Splunk requires us to create username and password during the installation whereas with Old versions we get default username and password with it (admin/changeme) Download .dmg file from below location: https://www.splunk.com/en_us/download/splunk-enterprise.html#tabs/macos You can also follow the video on youtube. https://www.youtube.com/watch?v=1wkmEvsUe68 ... View more

One last question - by using the above query, for "this week" we are going to get the counts for whole week right? What if i just want to get the count only for today compared to same day last week by date_hour? ... View more

Try the updated search. ... View more

Thanks. I have tried this previously and for some reason it did not work. Now it worked. Thanks for your help. ... View more

You are welcome 🙂 ... View more

Thank you. I have version 6.0 😞 is there any way in 6.0? ... View more

I am able to get results if i use left join and have max value specified. Like this...join type=left max=600 _time ... View more

i got it. i have used | convert dur2sec(Latency) ... View more

Thank you. I will try this and let you know. ... View more

Update to the latest version http://sideviewapps.com/apps/sideview-utils/ the 1.X versions are ancient. In addition to a giant leap forward in features, performance and reliability, you'll get much much better documentation and working examples. ... View more