Is your datetime.xml file really in $SPLUNK_HOME/etc or $SPLUNK_HOME/etc/system/local? Perhaps some escape characters got dropped from your comment, but your regex doesn't look right. This works in RegExr: \ABC(\d{4})(\d{2})(\d{2})\.csv ... View more

The query which you have give is working.I think the reason behind is avg:* is fixed field name.In my case field name is dynamic. Avg:< > ... View more

Thanks for the support. ... View more

See @gkanapathy comments. http://answers.splunk.com/answers/3005/getting-event-timestamp-from-source-file-name ... View more

Please accept the answer if it is what got it worked out. ... View more

FWIW - I think you should learn about how timechart works instead of asking the community to give you ready-made solutions. ... View more

The purpose of join is to get the group of employee id's. Ex: for consider empid=10 present in both data source. In DS1 sum(field1) will be 20 and in DS2 sum(field2) is 10. I want to get the average for empid 10. Likewise I want to get the result for all employee Ids present in both DataSourcec in a single search. ... View more

Try these Options 1 host=hostA | stats sum(field) as FieldTotA | appendcols [search host=hostB | stats sum(field) as FieldTotB] | eval division=round(FieldTotA/FieldTotB,2) Option 2 | multisearch [search host=hostA | eval fieldA=field | table fieldA] [search host=hostB | eval fieldB=field | table fieldB] | stats sum(fieldA) as FieldTotA, sum(fieldB) as fieldTotB | eval division=round(FieldTotA/FieldTotB,2) ... View more

Thanks this solves my issue ... View more

First of all it sounds like you need to take the Splunk tutorial (http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial ). It equips you with the knowledge you need for knowing where to look for solutions. Secondly, the join command docs are here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join ... View more

Docs on getting data in: http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/AboutgettingdataintoSplunk _time as when Splunk reads the file: set DATETIME_CONFIG = CURRENT in props.conf. http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf ... View more

I have did the below things on output.cong. [indexAndForward] index=true selectiveIndexing=true [tcpout:group1] server=10.203.246.71:9997 and in input.config [monitor:///dbmon-dump://OracleDev/TestME] _INDEX_AND_FORWARD_ROUTING=local _TCP_ROUTING=group1 I am not getting the data in 10.203.246.71.I have enabled 9997 for data receiving. still i am not getting data. In metrics.log i find below info. StatusMgr - destPort=9997, eventType=connect_done, sourceHost=10.203.246.71, sourceIp=10.203.246.71, sourcePort=50248, statusee=TcpInputProcessor Can anybody help. ... View more