I have  a requirement where I have to show a pie chart which shows pending/opened/assigned service request from last Feb to till now but the time span should be 40, as well as which services are older than 80 days. it will come in ">80" legend. Like in this way only (0-40, 40-80, >80)   My Search query is :  index a | table a b c d        [a b c d stands for a=user, b=date, c=service request number and d=days] | chart count(c) by d span=40     My Output : days                 count(number) 0-40                          3111 40-80                       2252 80-120                      478 120-160                 2757 But I want my output in manner : days                 count(number) 0-40                          3111 40-80                       2252 >80                           3235 (478+2757)   Is it possible to get my desired output in the pie chart? Please give me an example with a search query if we can do that.  ... View more

Hi Everyone, Recently I’m struggling with a small issue. I have a Splunk dashboard where I have used Text-box to search a product number in it. But recently I need to check multiple products number at a same time, because one by one product number search is too much time taking activity. I have tried to use multi select input feature but somehow it’s not working. Can someone suggest me a easy and best way to do the same. I have multiple table where I have to check the products number are present or not but need to search multiple products number at a sametime. Thanks in Advance, @saibal6 ... View more

Hi Experts, Recently I made my Splunk DEV as a slave license and my master license is Splunk PROD. After Slave License whenever I'm trying to install any Splunk Apps or Splunk Add-ons in Splunk DEV. As usual Splunk wants to restart to reflect the changes, whenever I did splunk restart, it's getting stuck and showing me an comment that waiting for the server available for a long time. Can anyone tell me what's the reason behind that? is there any limitations or any rule are set for Slave license? if you have any Splunk Documents, please share the link also. Thanks in Advance, @saibal6 ... View more

Hi Splunk Experts, Recently I'm facing an issue which is quite exceptional issue. In my Splunk PROD environment which has Splunk Enterprise Version - 7.1.0 and recently I have updated the Splunk Enterprise version - 7.3.0 in my Splunk DEV. I can able to find Splunk Add-on Builder in 7.1.0 in Splunk DEV but I could not able to find Splunk Add-on Builder in 7.3.0 Splunk PROD. Can anyone please help me on this matter? If you have any proper Splunk Documentation of it, then please attach it also. ... View more

Hi Experts, I have admin permission to login into the splunk. So whenever I run a report, it's taking hardly 2 seconds or less than that. So i have shared that report with user only read access mode. But whenever user is trying to run that report it's showing an message that "waiting for queued job to start Manage Jobs". Could anyone help me on this matter? What should I do in this case or how can I troubleshoot this issue? If you need more info in this matter, please let me know. Thanks, @saibal6 ... View more

Hi Splunk Experts, I have configured a monitoring path in my Splunk Enterprise environment with the help of Splunk Universal Forwarder. From last 2 days I have facing an issue that particularly a one log file was not indexing in my Splunk environment whether my rest of logs files are same as like that log file, the pattern, naming convention,type everything is same. I thought there is a problem in the indexing phase or the problem in the inputs.conf. Many of you will tell me that add crcSalt in the inputs.conf but I already added it because I phase this kind of issue previously. But this time my issue is in my Splunk Universal Forwarder. When I have checked my Universal forwarder splunkd.log file then I can get the error log why the log file was not getting indexed in my splunk environment. The error log is : (Date and time) WARN TailReader - Access error while handling path: failed to open for checksum: My monitoring Log Path (Date and time) INFO TailReader - File descriptor cache is full (100), trimming... (Date and time) INFO TailReader - File descriptor cache is full (100), trimming... (Date and time) ERROR TcpOutputFd - Read error. An established connection was aborted by the software in your host machine. (Date and time) INFO TcpOutputProc - Connection to xx.xxx.xx.xx:9997 closed. Read error. An established connection was aborted by the software in your host machine. I don't know how to fixed this issue and the important part is, this same configuration has done on a long time ago means at least near by 2 months and it's working properly then I don't know what happened in my Universal Forwarder server that it's showing me this issue. Please help me on this matter and if you have sufficient Splunk document then please attach the url also and my Universal Forwarder and Splunk Enterprise environment both are in Windows OS. Thanks, @saibal6 ... View more

I have a set of table formatted data where the data is related to Date, specific store and the total count of customers that are coming to that store on an everyday basis. Now, I want to create a report where I can scheduled an alert only for those stores which have no customers visit on yesterday. Is this possible? I don't know how can I be able to do that, and I didn't find any proper command to make this type of report. Please suggest me the best command and give a small example also. ... View more