This is the answer. What version of Splunk was this feature implemented? ... View more

Each query provides a unique set of data, presumably with different fields/columns, so I'm not sure you want to combine multiple queries into a single input. Defining multiple inputs allows you flexibility in scheduling and in determining other parameters like source type and field names. If you really need to combine output from multiple queries that would have common field names, etc., you could use a UNION type of construct to combine their data sets into a single set for return to Splunk. I'm not sure what the exact Informix syntax would be, but perhaps something like this: select column_1, column_2 from table_1 where column_1 = x union select column_1, column_2 from table_2 where column_2 = y or like this: with query_1 as (select column_1, column_2 from table_1 where column_1 = x union select column_1, column_2 from table_2 where column_2 = y) select column_1, column_2 from query_1 or perhaps combine the queries into a view in the database and select from the view in your input. ... View more

Hi @hxa27 Awesome! No problem at all, glad you got the missing piece of the puzzle 🙂 I'm sure some other folks might have missed (or will miss) that same step. I converted my comment to an answer so you can mark it as solved by clicking on the big check mark next to my response. This will help other people who are having the same issue find this solution. 😄 Patrick ... View more

What if I want 5 days before today and today in my dropdown? could you please help me? ... View more

you wont be able to get in normal sql query. you need to do it splunk query. What is the database you are using? ... View more

then why "Time Elapsed" in where? ... View more

1) Once something is indexed in Splunk, it's in Splunk. Changing the monitor settings doesn't delete the data from your index. Deleting the old files doesn't delete the data from your index. You can selectively delete data from Splunk, but that only removes it from search results, not from the index itself. (So it doesn't free disk space or anything) Generally this isn't recommended. You can find out more about the delete command here 2) You probably don't want a real-time alert here. It would be much better to set up an alert with a short interval that only searches within that interval. So set up your search to look at the past 5 minutes, and then run every 5 minutes. It'll only trigger on new events, as you don't look at the same span of data twice. It also won't monopolize a CPU to keep a realtime search running. ... View more

Okay, my solution requires that the scripted input collects the file name. So you need to write a script that Splunk runs. In your Add Data, you will specify that script. You will not specify either the folder name or the file names. Of course, your script will have to read the names of the files in the folder. If your script can't get the file names, this solution will not work. ... View more

Add this after the timechart: ... | eval duration = duration / 60 | rename duration as "Duration in minutes" ... View more

Could you be more specific about what you are trying to do and how you are unable to do it? Have you read the Alerting manual (http://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts)? ... View more