Hi, I am getting the input source file date from the name of the file itself (sourcefilename20151412.csv), like this: index="radius" |eval subname=substr(source,14,8) |top subname |table subname result: 20151412 I want to transform this time format from 20151412 to 2015-14-12 Is it possible with rex ? I would like know more about rex. Thanks ... View more

Hi, I got an index which continuously receive new source file automatically, what I want is to my search to only return events from the last source file. Should be something simple but I did not figure it out, maybe with the |head command. ... View more

Hi, For the first version of the DB Connect I know it is not possible, but what about Splunk DB Connect 2? ... View more

Hi Everyone, I would like to add a row, about a total (sum), for each segment list (see the picture), and if a list has only one value than there is no need to show a total. (only if possible) here is what I got: index="Test" |stats count by "Event Category", "Threat Type" |stats list("Threat Type") as "Threat Type" list(count) as Count by "Event Category" Using |addtotal doesn't work at all. ... View more

I need to remove a list of servers from my search. This list changes once a month so I thought of using a lookup table. Is it possible? How can I do it? So in my index, there is a field Server_Name, and on my lookup table there is a field Server_Name_To_Be_Removed. What I need is to compare both fields and remove the events that match value of this field. Index=Servers MyBaseSearch NOT Compared_Equal_Server_Name_To_Be_Removed=Yes ... View more

Hi, How Can I do a simple line graph, here is an example: I got four Fields ( Fruits, June, July, August), like this and I want on XAxis( June, July, August) and each fruit must be a serie, like this: So there is no time fields on this one, so probably I need to use |chart ... View more

Hello, I would like to know how to customize a little bir more one of my dashboards. How to Add a button on a dashboard panel which directs to another dashboard or URL? ... View more

I have a Risk field with this possible values (Critical, High, Medium, Low) and I want to be red when critical, high is purple, yellow medium and green low. I would like to do this in the query itself, if it is not possible , let´s do it on xml!!! Here is the xml: <chart> <title>Severidade - Vulnerabilidades Vencidas</title> <searchString>index="patches" earliest=@d latest=now Estado=Vencida OR Estado=Expired NOT Descripci_xF3n="EHT*" NOT Title="EHT*" NOT GrupoName2="DS - PROJETOS" | stats count by Risk</searchString> <earliestTime>0</earliestTime> <latestTime>now</latestTime> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.chart">pie</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">minimal</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> Thanks in advance ... View more

Got a date field that I would like to return only events that were within a specific range, from today to 15 days in the future. To get today: |eval timenow=now() |eval nowstring=strftime(now(),"%d/%m/%Y %H:%M:%S") |table nowstring 04/11/2014 10:35:59 My date field is already like this: |table "Resolution Period" 27/01/2014 23:59:59 But when I try a simple search like this: |where "Resolution Period" > nowstring |table "Resolution Period" I still got all events, unfiltered. Do I need to change something on the "Resolution Period"?? And How to return only events that were within a specific range, from today to 15 days in the future.??? Thanks in advance ... View more

How to compare field values ​​in different indexes? which returns "match" and "not match" Same as vlookup functionality of Excel. By using | join I get the "match" one, but how to can I get "not match"??? index=A* source="AB*" | rename "Field A" as name | eval name=lower(name) | join type=inner name [search index=B* |eval name=lower(name) |table name | sort name] | table name |sort name ... View more