Hi everyone, I am using Splunk db connect v2. I created identities and connections. I also created a database input. The query displays the table with the different fields. I don’t know what to enter for source, sourcetype and index. Do I have to create new one? I tried to put the name of my database input in those fields but Splunk displays an alert message. I am not able to do a search like source=”nameofmyinput”. Could you please help me with that? Thanks in advance, Claire ... View more

Hi everyone, I have a field that is a date. It’s written: month/day/year . I have redefined this field as _time. So, I am able to count by month, however, when I want to see only the result for last month it didn’t work. Here is the code to display count by month: source="Active.csv" | bucket span=1mon _time | eval extracted_date_field = strptime('FirstDate', "%m/%d/%Y") | eval _time = 'extracted_date_field'| eval w_month=strftime(_time, "%b/%Y")|chart count by w_month To display only the last month I tried this: source="Active.csv" earliest=-1month@month | bucket span=1mon _time | eval extracted_date_field = strptime('FirstDate', "%m/%d/%Y") | eval _time = 'extracted_date_field'| eval week_month=strftime(_time, "%b/%Y")|chart count by week_month But the results are wrong... Could you please help me with that ? Thanks ! ... View more

Hi everyone, I have a question about a subsearch. I have this query : source="test.csv" earliest=-mon@mon [search source="source1.csv" "Status"="Ship" | rename "Serial Number" AS "Serial" |table "Serial" ] | table "Serial" "Last Week" This search displays the serial numbers that are shipped and the date ("Last Week"). I want to display another field which is in "source1". After having looked at some splunk answers I tried to add "fields" in the subsearch but it didn't work. Could you please help me with that ? Thanks in advance for your help ! ... View more

Hi everyone, I have a file with serial numbers and purchase order numbers. In a first table, I display a serial number and the corresponding purchase order. This table is the result of a drilldown. The user has clicked on a serial number on another page. The new page got the serial_token in an text input and displays the result in a table (serial number and purchase order number). On the same page, in a second table, I want to display all the serial numbers that have the same purchase order as my first table. I have no idea on how I can do the second table. Could you please help me with that? Thanks, ... View more

Hey everyone, Here is my problem: I have two sources (Source1 and Source2): * In source1 I have the field "device number" written like that: "Inst-C6:82:c3" * In the second source I have the field "MAC Address" written like that: "9B:DC:DF:C6:82:c3" As you can see, the parts in bold are the same. I would like to create a table with this two fields that displays when field1=field2. I don't know how to select the part in bold and add a condition to create a table. Could you please help me with that? (This will permit me to link these two different sources) Thanks in advance ! ... View more

Hi everyone, I have two dashboards that display results on a map. The first dashboard displays results for source1 and the second displays results for source2. Here is the code for the first source: <map> <search> <query>source="source1.csv"| geostats latfield=latitude longfield=longitude count</query> </search> <option name="mapping.data.maxClusters">100</option> <option name="mapping.drilldown">all</option> <option name="mapping.map.center">(52.43,-93.6)</option> <option name="mapping.map.zoom">4</option> <option name="mapping.markerLayer.markerMaxSize">50</option> <option name="mapping.markerLayer.markerMinSize">10</option> <option name="mapping.markerLayer.markerOpacity">0.8</option> <option name="mapping.tileLayer.maxZoom">7</option> <option name="mapping.tileLayer.minZoom">0</option> <option name="drilldown">all</option> </map> The code for my second dashboard: <search> <query>source="source2l.csv"| geostats latfield=latitude longfield=longitude count</query> </search> I want to display the results of my two searches on the same map with different color. How to display results from different sources on the same map? Thanks in advance for your help ... View more