It would help if you shared the context of your search. Lacking that, here's a tidbit of info to go on which may help point you in the right direction: https://answers.splunk.com/answers/565395/how-to-return-0-when-the-search-has-no-results-in-1.html ... View more

Btw. What the above search does is is counts all hosts by host name over your search time and then concatinates that sum of hosts next to your host if the resultant host count is greater than 2. Since I assume you are scanning events by _time which is what is populating the time field, you will see duplicate results if you come across more than one host with the same host name. Eg: 1:20 host1 (2) 1:22 host2 1:24 host1 (2) ... View more

So you don’t want to split by time then. Your search | fields host, _time | eventstats count(host) as hostCount | eval host = if(hostCount > 1, host.” (“.hostCount.”)” , host) | table host, _time ... View more

Do you want the 2 next to the host and in the same column, or a separate column with the count of hosts? Your search | fields host, _time | eventstats count(host) as hostCount by _time | table host, hostCount, _time Your search | fields host, _time | eventstats count(host) as hostCount by _time | eval hostAndCount = host.” (“.hostCount.”)” | table host, hostAndCount, hostCount, _time In situations where you only want to show a numeric if the host count is greater than one: Your search | fields host, _time | eventstats count(host) as hostCount by _time | eval hostAndCount = if(hostCount > 1, host.” (“.hostCount.”)” , host) | table host, hostAndCount, hostCount, _time ... View more

In situations where you only want to show a numeric if the host count is greater than one: Your search | fields host, _time | eventstats count(host) as hostCount by _time | eval hostAndCount = if(hostCount > 1, host.” (“.hostCount.”)” , host) | table host, hostAndCount, hostCount, _time ... View more

Or you can do : Your search | fields host, _time | eventstats count(host) as hostCount by _time | eval hostAndCount = host.” (“.hostCount.”)” | table host, hostAndCount, hostCount, _time ... View more

Do you want the 2 next to the host and in the same column, or a separate column with the count of hosts? Your search | fields host, _time | eventstats count(host) as hostCount by _time | table host, hostCount, _time ... View more

There sure is. Check out this link in Splunk answers and let me know how it works out. https://answers.splunk.com/answers/26163/metadata-via-rest-api.html ... View more

Hmm. I’m curious to understand. Each event in Splunk has multiple lines of a log event? I can’t say I know your data or how it’s coming into Splunk, but it would be good if each of these was an individual event with linebreaking. If this can’t be done and you have multiple lines in each event, there are ways of handeling this, but it would be better to understand how events are coming in first before explaining how you can split multivalue or multi line events if that is not the case. ... View more

Exactly what went through my mind when I read the search. Join is used on a common field between the two searches. Then any and all of the additional fields from the subsearch are added to the data where the common join field matches. Here’s an example. Say I had two searches, and the first search returned host and ip address and the subsearch contained the same host names and had additional data I wanted to add wherever host names match from the initial search in the subsearch. I would do: My search which output host and ip: Search something | fields host, ip | join type=left host [| search something else | fields host, location, model] | table *. What would happen is the subsearch would match all hosts returned from the initial search and give me the host, ip, location, and model based on the host in the resultant set of data. Be aware that join is case sensitive with sub searches. So I tend to use an eval to make the existing field to match on either upper or lower if it is a string. Eg; Search something | fields host, ip | eval host = upper(host) | join type=left host [| search something else | fields host, location, model | eval host = upper(host) ] | table * Hopefully that helps you in understand the join command. Happy splunking! ... View more

This should get you what you need: Great IoT, Sensor and other Data Sets Repositories ... View more

This should help Your search | bucket _time span=1month | stats sum(field1) as totalField1, sum(field2) as totalField2 by _time Or Your search | Timechart sum(field1) as TotalField1, sum(field2) as totalField2 span=1month. ... View more

Can you provide the Search you are using? Are you using the timechart command in your search? ... View more

My pleasure my man. Remember to pay it forward if and when you can!! Happy splunking! ... View more

Haha. Great to hear BearMormont! Happy Splunking! ... View more

If you are attempting to do it through simple xml: SimpifedXMLDrilldown on Splunk Docs On that Page Scroll down to the Predefined Drilldown Tokens section, then look under the Table subsection. Here are the options I believe you may be looking for EG: **table** **Token** Description $click.name$ Leftmost field (column) name in the table. Typically, _time is leftmost in a table that includes this field and where columns are ordered by default. $click.value$ Leftmost field (column) value in the clicked table row. $click.name2$ Clicked field (column) name. In a <condition> element configuring drilldown in a table, field corresponds to $click.name2$. $click.value2$ Clicked field (column) value. Use this token to capture the specific table cell value that users click. $row.<fieldname>$ Access any field (column) value from the clicked table row. $earliest$ Earliest time for the clicked table row. If not applicable, uses the earliest time of the search. $latest$ Latest time for the clicked table row. If not applicable, uses the latest time of the search. An Example in dashboard usage: Example A click on the table sets a token which is consumed by the search of the chart visualization. <dashboard> <label>In-page Drilldown</label> <row> <panel> <table> <title>Set sourcetype token on click</title> <search> <query> index=_internal | stats count by sourcetype </query> <earliest>-1h</earliest> <latest>now</latest> </search> <drilldown> <condition field="sourcetype"> <set token="sourcetype">$click.value2$</set> </condition> </drilldown> </table> <chart> <title>Chart for $sourcetype$</title> <search> <query> index=_internal sourcetype=$sourcetype$ | timechart count by sourcetype </query> <earliest>-1h</earliest> <latest>now</latest> </search> </chart> </panel> </row> </dashboard> So as for what you are looking for, assuming you want the clicked value to be part of the link: <table> <search>index=_internal</search> <!-- Pass the clicked cell's value, earliest time, --> <!-- and latest time to a destination form's --> <!-- token ('foo') and search parameters --> <drilldown> <link> <![CDATA[ /app/search/simple_xml_form?form.foo=$click.value2$&earliest=$earliest$&latest=$latest$ ]]> </link> </drilldown> </table> You can find many more examples in the drilldown section of the link above. ... View more

if you have Splunk 7 you could do it throught the GUI: https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Drilldownonstatisticaltablerowsandcells ... View more

on a side note, in the rex extraction I include the x in extraction for the ip address: (\d{1,3}.(\d{1,3}|x).(\d{1,3}|x).\d{1,3}|x) I wasn't sure if this was part of the actual message or if you were obfuscating the ip with the x's. If you are unfamiliar with regular expressions the above looks for: \d - any digit \d{1,3} any digit 1-3 digits long (\d{1,3}|x) - any digit 1-3 digits long or x (lowercase) I'm not sure if you will have to use an additional \ to escape any special characters.. eg: the \d may need to become \d as I don't have any data to test with. hope this helps! ... View more

great... so now all you need to dedup on is the message: yoursearch | rex field=_raw "%.*(\d{1,3}.(\d{1,3}|x).(\d{1,3}|x).\d{1,3}|x)\s(?<bgp_message>.*)" the above should produce and extraction of the end of the event.. EG: Down BFD adjacency down vpn vrf SIP Down BFD adjacency etc.. search with dedup: yoursearch | rex field=_raw "%.*(\d{1,3}.(\d{1,3}|x).(\d{1,3}|x).\d{1,3}|x)\s(?<bgp_message>.*)"| dedup host, bgp_state, bgp_neighbor, bgp_message ... View more

it would be good to understand which fields are being extracted from each event, as as well as what the string in the actual event data is. For instance, if the timestamp isn't in the event itself then you can dedup on router name, _raw... if there are other fields being extracted such as neighbor, status (eg:Down) Message (Down BFD adjacency down or vpn vrf SIP Down BFD adjacency) you can then dedup on those as well.. if you don't see those field extractions, you can extract them using rex or regex commands. This may help you get started to extract fields to allow you to dedup properly: yoursearch | rex field=_raw "(?%.):\sneighbor\s(?\d{1,3}.(\d{1,3}|x).(\d{1,3}|x).\d{1,3}|x)\s(?.$)" | dedup change_type, neighbor_ip, router_message ... View more

Hi there proylea, You may also have success by setting the quota via the authorize.conf file. I can't say that I'm an expert on the subject, but figured I'd provide any insight seeing as how you haven't had many responses. Hopefully this helps you get onto the path of succeeding in limiting concurrent searches: http://docs.splunk.com/Documentation/Splunk/6.0.6/Admin/authorizeconf From what I've read on the topic, you should be able to limit search concurrency to a role rather than across applying a limit to all searches across the cluster: cumulativeRTSrchJobsQuota = * Maximum number of concurrently running real-time searches in total across all members of this role * Requires enable_cumulative_quota = true in limits.conf to take effect. * If a user belongs to multiple roles, the user's searches count against the role with the largest cumulative search quota. Once the quota for that role is consumed, the user's searches count against the role with the next largest quota, and so on. * In search head clustering environments, this setting takes effect on a per-member basis. There is no cluster-wide accounting. cumulativeSrchJobsQuota = * Maximum number of concurrently running historical searches in total across all members of this role * Requires enable_cumulative_quota = true in limits.conf to take effect. * If a user belongs to multiple roles, the user's searches count against the role with the largest cumulative search quota. Once the quota for that role is consumed, the user's searches count against the role with the next largest quota, and so on. * In search head clustering environments, this setting takes effect on a per-member basis. There is no cluster-wide accounting. My idea is that you can create a user and add the user to only this role to limit the amount of concurrent searches the user can perform. Then run the search as that user. ... View more

Use tstats and specify the variables: • index=main • earliest=-30d • groupby (_time, sourcetype) • span=1s | tstats count as COUNT where index=main earliest=-30d by _time,sourcetype span=1s | timechart span=1h max(COUNT) as eps by sourcetype useother=f ... View more

If you're running the latest version, some of that info is on the Index Activity dashboard, and you can use that search as a start. Change out the calc for measuring max, min, avg, etc EG: timechart avg(kbps) by series timechart max(kbps) by series kbps by sourcetype: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | timechart avg(kbps) by series eps by sourcetype: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | timechart avg(eps) by series If you wanted host or source, use group="per_source_thruput" or group="per_host_thruput" instead. ah, one more suggestion... If you don't want to chart the results in a timeseries, you can swap out the timechart command with the stats command which may be a better fit for the solution you are looking for: EG: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | stats avg(eps) by series ... View more