Is this still the case where you can not do lookups on multi value fields? e.g.   I might have a list of 100 hosts similar to:        hostname,   (ip1, ip2)   I want to add location, sys-owner to this table.  Both IPs may have the same location but sys-owner will be differing.  lookup table   I want to see something like the following come out for each line.  hostname  ip1   Toronto      Smith                        ip2    Toronto     Jones   How would I do this? | inputlookup mylastresults.csv | makemv delim=" " ip | mvexpand ip | lookup gatheripinfo ip OUTPUT location sys-owner | table hostname ip sys-owner       ... View more

This post is originally from 2012! A more modern post is https://answers.splunk.com/answers/310388/hungry-newbie-best-way-to-learn-splunk-well-effici.html , the hungry newbie post has a number of useful links for tutorials. Also Splunk 6.X Fundamentals Part 1 (eLearning) is now free. ... View more

In Splunk, you can simply run the search host="trlpws003" AND cs_uri_stem ="*emreservationlist.asp" and you can see the list of fields that splunk has identified and their names by using the blue/grey box on the left of the search results. Click the "edit" button to see the complete list of fields, as Splunk will only show the selected fields and interesting fields by default. When you use the fields command as you did above, you are suppressing the default field extractions. While you may want to do this later, I think you should start by looking at what Splunk does by default. The fields sidebar may help you - but it might not. Typically, Splunk identifies the fields in the events based on the sourcetype. If the sourcetype is iis, then Splunk will extract the IIS fields (and hopefully name them appropriately). However, if you have used a different sourcetype name, Splunk will not know to use its built-in IIS field definitions. What is the name of the sourcetype for the results of this search? ... View more

adding limit=10 to the sort command does the same as head but is more efficient as splunk doesn't have to sort all lines. The top comand by default returns 10 but you can change it by adding limit=xx to any number you want. ... View more

You don't provide a sample of your logs, but from what you write, I assume that something like the following would do what you want; sourcetype=your_sourcetype time_taken > 100000 | top cs_uri_stem Hope this helps, Kristian ... View more

Try something like : ...| eval time_sec = round(time_taken/1000) | where time_sec > xx | stats count by cs_uri_stem ... View more

I believe the cron schedule would be; 0 0 * * 5 http://en.wikipedia.org/wiki/Cron Hope this helps, Kristian ... View more

| eval time_sec = round(time_taken/1000) | chart max(time_sec) as max_response_time by cs_uri_stem | where max_response_time > xx | sendemail to="elvis@server.com,john@server.com" format=html subject=myresults server=mail.server.com` Then you saved the search and edit it in Manager >> Searches & Reports, to set the schedule ... View more

Try this: .. | eval time_sec = round(time_taken/1000) | timechart span=2h max(time_sec) AS max_response_time, min(time_sec) AS min_response_time, avg(time_sec) AS avg_response_time by cs_uri_stem Hope this helps. > please upvote and accept answer if you find it useful - thanks! ... View more

Paste some sample logs with that sample of data including he CustumReport.aspx entry. ... View more

So what does your output look like when you run: host="trlpws003" AND cs_uri_stem ="CustomReport.aspx" is the stem being extracted correctly? Can you search for: CustomReport.aspx What does that output look like? ... View more