@niketnilay For some reason that parameter didn't work for me, it didn't overwrite the default. ... View more

Would have been great if you've added some code to work on. Maybe it's just a small typo... ... View more

In my experience with Splunk 6.6.x, the time fields applied via collect will default to the value of info_min_time , which is the earliest time of the search window. This is consistent with the documentation about collect. I've had good luck using the addtime=false option with collect. You might play with that and see if it works for you. I've had conversations with other folks for whom it didn't work, but we weren't able to trace the root cause. ... View more

Answer updated Please accept and upvote any comment which helped you. Thanks ... View more

No.. they're above 400. This is the reason I don't use KV_MODE=AUTO because it has a 100 limit max extractions. The can be alphanumerical aswell or have only symbols ... View more

It looks okay, but just to be sure I'd write it as (?<Property>[^=]+)=(?<Value>.+) ... View more

@greggz if the workaround resolved your issue please accept to mark this question as answered. ... View more

@greggz if you are on Splunk Enterprise 6.6 or higher you can try the Trellis layout. For Splunk Enterprise 7.0 or higher you can also add Compare Series option to compare how various stats are trending through timechart command and hover to see individual values at specific time. Following is a run anywhere dashboard examples based on Splunk's _internal index( I have created some dummy data for various stats, they are not necessarily accurate) and used component instead of host as per your use case. Following is the Simple XML code: <dashboard> <label>Compare Trend for multiple stats</label> <row> <panel> <chart> <search> <query>index=_internal sourcetype=splunkd log_level!=INFO component!="ConfContentsCache" | timechart count as request_count count(eval(log_level=="ERROR")) as error_count sum(date_second) as total_duration by component limit=20 useother=f</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="height">700</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">zero</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option> <option name="charting.legend.mode">seriesCompare</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">1</option> <option name="trellis.scales.shared">0</option> <option name="trellis.size">large</option> <option name="trellis.splitBy">_aggregation</option> </chart> </panel> </row> </dashboard> ... View more

No it's not helping, I sort by host and _time because I need one host at the specific time for all distinct hosts. This code pulling in values from other times to the same host giving false values ... View more

Btw man, what can I do if I want to override a sourcetype that I have already assigned ? Example: For a ".cnf" file I assign a generic sourceType. But sometimes in those files, it comes XML written and I wanted to assign a new sourcetype with "KV_MODE = xml". Any ideas, like a Regex searching inside the file and alert me for a XML match and then assign that very XmlSourceType ? Thanks ... View more

@kamlesh_vaghela Thanks for your answer, but I know I can do it with Js. Maybe I should have specified that I was looking for a solution in the SimpleXML realm 🙂 ... View more

What is the time frame of the base search? If I understand what you’re trying to do, try something like this: index=mock_index host=* source="server.cnf" |table watt* host | append [search index=mock_index host=* source="server.cnf" earliest=-6mon|table watt* host ] | stats values(*) as * by host| transpose column_name=Property header_field=host 50 The append will add all the results to the bottom of the dataset is the base search and then use stats to join them together on host. You could use latest or other commands instead of values. This is just to give you another idea to accomplish what I think you’re going after. It should give you all results not in the base search as well as in the base search. ... View more

I just added the working query to main answer. ... View more

You are welcome, i have converted Please accept! ... View more

@niketnilay ♦ My pleasure! Btw you migth not need to get the PostProcessManagers, cause I think when you start the Parent Search , the children searches will automattically start aswell. All the best 😉 ... View more

And here I was just complicating everything. Thanks sir ... View more