Thanks Michael. I will implement your advise and let you know. ... View more

First you need to create an alert which will look for desired URL and run a script. That script should handle to run your saved search and email the search result. ... View more

Hi Mahesh, Something like following using stats with eval should work and it is preferable to use rename instead of eval for renaming fields. source="F:Splunk_Log Files*" status="Allow" | eval bytes=round(((recv_bytes)/1024),2) | eval Start=substr(dst_ip, 1, 3)| eval End=substr(dst_ip, 1, 3 )|stats sum(bytes) as File_Transfer sum(eval(if( Start>=1 AND End<=85,bytes,0))) as Infrastructure by src_ip| rename Infrastructure AS Infrastructure ." MB"| rename File_Transfer AS File_Transfer." MB" Thanks, Sanjay ... View more

Santosh, Here is how I have done it (for Oracle database). It is little tricky though :-). When we use TimePicker in dashboard, it returns time range (info_max_time & info_min_time). So you need to change your query to use both upper and lower range. You need to use "addinfo" command to get info_max_time & info_min_time. Once you have those 2 fields, you can analyse the return values with TimePicker selection. e.g. info_max_time would have "+Infinity", when we select "All time". Both info_max_time & info_min_time would return epoch time (Unix time number / counts every seconds on and after 1 January 1970 ) for other selection. So you need to construct your query in such a way that if you have All time selected then not to apply date criteria. For this reason, you need to construct your query dynamically. Let's take your query (removed few fields for simplicity): <query>| dbquery "CENTRO" "SELECT ShowRoomCode FROM Centro_Customer_Visit WHERE TransDate='$TOKEN2$'"</query> and construct dynamically: <query>|dbquery "CENTRO" [search index=main| head 1 | addinfo | eval query=IF(info_max_time="+Infinity","SELECT ShowRoomCode FROM Centro_Customer_Visit","SELECT ShowRoomCode FROM Centro_Customer_Visit WHERE TransDate between (sysdate - ( (((sysdate - to_date('01-Jan-1970', 'dd-Mon-yyyy')) * 86400) - ".info_min_time.")/86400)) and (sysdate - ( (((sysdate - to_date('01-Jan-1970', 'dd-Mon-yyyy')) * 86400) - ".info_max_time.")/86400))")|fields query|format "" "" "" "" "" ""]</query> You might need to use appropriate command in MS SQL SERVER (may be getDate() ) instead of sysdate in Oracle). I hope this will help. Let me know. Thanks, Sanjay ... View more

Looking at your example, you are not joining two searches, you are filtering one search with common fields from other search. If that is the case, then you can try as below: index=SearchA [index=SearchB|fields CommonField as search|format]|table SearchAFields ... View more

It started at noon and Splunk was getting until 12:55 PM however it stopped after 1 PM. Does this mean anything? ... View more

We thought about that but not preferable to create new summary index in this case. ... View more

no as lookup can be done to any record for last one year. ... View more

Did you mean |dbquery instead of |dblookup. I was using |dbquery but the lookup file kept growing and its huge. To avoid this we also wanted to implement dblookup in datamodel. ... View more

Could you pls elaborate more what do you mean by "you can use the dblookup to regularly generate a new Splunk lookup"? ... View more

Settings > Server Controls > Restart Splunk ... View more

What do you mean by changes to index files? ... View more

Yes it would require Splunk restart. ... View more

We are also planning to have at least 4 environments (DEV, TEST, POST-PROD & PROD). Since DEV box acts like sandbox, we will just copy required files to TEST environment. Then everything will be packaged on TEST environment and promoted to POST-PROD & PROD. We are not there yet as we are on planning phase. We heard about Puppet or Chef but never used. So We are also interested to find better practices for deployment. ... View more

You can append events with 0 0 for all values i.e. for value11 & value12 for this example. Later you can remove as it appears in the query. ... View more

You should be able to change the email message for any alert. check this if it helps ... View more

You can follow this ... View more

Can you use top instead of head like: ...|top limit=10 by sourcetype|... ... View more