I have a graph that displays an average value per day over a week as columns. When clicking a specific column a line chart displays how this value averaged over that day. The value passed from the per day-average chart is the date that is clicked and it is then input as a token (in this case "Aug 10, 2015") in the following query: ... date_mday=[ search index=os | eval theDay=substr("Aug 10, 2015", 4, 3) | return $theDay ] date_month=[search index=os | eval theMonth=case(substr("Aug 10, 2015", 1, 3) LIKE "%Jan%", "january", substr("Aug 10, 2015", 1, 3) LIKE "%Feb%", "febuary", substr("Aug 10, 2015", 1, 3) LIKE "%Mar%", "march", substr("Aug 10, 2015", 1, 3) LIKE "%Apr%", "april", substr("Aug 10, 2015", 1, 3) LIKE "%May%", "may", substr("Aug 10, 2015", 1, 3) LIKE "%Jun%", "june", substr("Aug 10, 2015", 1, 3) LIKE "%Jul%", "july", substr("Aug 10, 2015", 1, 3) LIKE "%Aug%", "august", substr("Aug 10, 2015", 1, 3) LIKE "%Sep%", "september", substr("Aug 10, 2015", 1, 3) LIKE "%Oct%", "october", substr("Aug 10, 2015", 1, 3) LIKE "%Nov%", "november", substr("Aug 10, 2015", 1, 3) LIKE "%Dec%", "december") | return $theMonth ] date_year=[ search index=os | eval theYear=substr("Aug 10, 2015", 8, 5) | return $theYear ] ... As you can see the query evaluates the day and "converts" it to date numbers that are possible to use the search with. This works but of takes A LOT of time to execute, using a subsearch as an excuse to evaluate a "local" token is ugly and of course very time consuming. Is there any other way of doing this, either by adjusting the query or using a completely different method? I should mention that installing any additional apps etcetera is for various reasons not an option, the solution needs to applicable with a vanilla Splunk instance. I also do not want to change the dateformat as I want to keep it as "human readable" as possible (lol). Tricky! ... View more

The following query... index=os host=* (source=cpu NOT cpu="all") OR source=vmstat OR source=df | stats max(cpu) as cpus, max(memTotalMB) as memoryMB, dc(Filesystem) as drives by host | eval cpus=if(isnum(cpus), tostring(cpus + 1)." cores", "N/A") | eval memoryGB=tostring(round((memoryMB/1000), 0))." GB" | eval drives=if(drives=0, "N/A", tostring(drives)." drives") | fields host, cpus, memoryGB, drives | rename host as Node | rename cpus as "Available CPU cores" | rename memoryGB as "Available RAM" | rename drives as "Available drives" ... displays some information about a specific host in table. I would like to expand this table with a column containing information about the hosts total disk size which I get by doing: index=os host=* sourcetype=df | `convert_memk(Avail, cap)` | stats first(cap) as cap by Filesystem host | stats sum(cap) as cap by host | eval cap=if(cap=0, "N/A", round(cap/(1024*1024),0) . " GB") What would in your opinion be the best and most effective way of combining these two searches? Since the latter one filters both by Filesystem and host you'd have to change the approach in order to get it to play with the first one without getting cores, memory etc. filtering by Filesystem as well. ... View more

I have a search query that begins like this: index=someData earliest=08/06/2015:10:00:00 latest=08/06/2015:21:00:00... rest of search. I need to set the date of earliest and latest as dates of today and if I've understood it correctly I should be able to convert the now value to epoch time but then I need to use eval and that is not possible(?) within the first search pipe, how should I structure the search so that I can do this effectively? Edit: I should mention that I cannot use any d@d or similar as I use the search in an overlay comparing results for two days and this will mess up the timeline. ... View more

I have the following query: some query... | bucket _time span=1d | eval date=strftime(_time, "%b %d, %Y") | chart avg(value) as Value over date Which is tethered to the following time span: <earliest>-$global_time$d@d</earliest> <latest>-1@d</latest> Where global_time can be any integer representing a number of days. The data that comes out is correct but the statistics (and therefor visualization) always show the first day of the current month as the first entry, if I search over let's say 40 days I get the following result: 1st July ... 28th July, 24th June, 25th June, 26th June, 29th June... until 40 posts has been filled. What is wrong here??? Weekends are not included as there is no output data for Value during those days. ... View more

I am relatively new to Splunk and would like to get a better sense of using subsearch as I can see how valuable it must be if you could fully utilize it. I would like to know some of the best practices when using subsearch in general but more specifically within eval-statements, how to think in order to get the right data out of the subsearch. What does a subsearch actually return? It of course depends on what you put in the search query but how does an eval-statement interpret the result? Depending on if the subsearch ends with return, table someValue, head 1 or just a bunch of event or statistic-lines, how it is interpreted? How does a subsearch result containing multiple fields differ from a subsearch that only returns one field? What are the best practices for returning a specific value of a field to use within an if statement? Something like this: eval cowStatus=if([subsearch returning current number of cows] &gt; 50, "Cow overload!", "All cool") I hope my questions are not to broad. ... View more