The problem here is what your definition of what alerting really is. To me alerting can only be useful if it is structured and regular, what use is there to be alerted about something... when you go look for it? Thats kind of after the fact. If you had used a scheduled search to look for this alert factor then you may have been notified an hour or two prior to you discovering it. You could generate your own alert by writing a custom search command or running a search against an external script. Perhaps even by using outputlookup to generate values in a lookup that are checked by an external script run on a cron schedule - but it rather seems to defeat the point of alerting, surely? ... View more

Actually this case user can be able to choose fileds which he is not intreseted.Like filedPicker.If we use fields user will not able to see the columns permenantly i want to hide them temperorly. ... View more

This is an old post, but leaving this here in case someone else is looking for it (like me): https://www.splunk.com/blog/2014/02/24/using-bootstrap-modal-with-splunk-simple-xml.html ... View more

Since you haven't provided any sample events, I'll assume that your event looks like this, in a sourcetype called "X". 2012-09-27 11:09:22 userid=bob A=20 B=30 2012-09-27 11:12:31 userid=eve A=24 B=10 This search: sourcetype=X | eval AB_diff = A - B | table A, B, AB_diff would give you the result; A B AB_diff 20 30 -10 24 10 14 If this is not what you want to achieve, please provide better sample data and more detailed requirements. Hope this helps, Kristian ... View more

thanks ayn ... View more

Thanks,Now its working ... View more

Lose the dollar signs from the context.get statement. The dollar tokens are not necessary when you're using the context object directly. Also, dont put the quotes around the whole expression. Quite possibly the parens are also redundant although they'll probably do no harm. for example: <param name="condition">(context.get("series")=="ERROR")</param> ... View more

startswith and endswith: startswith= A search or eval-filtering expression which, if satisfied by an event, marks the beginning of a new transaction. For example: startswith="login" startswith=(username=foobar) startswith=eval(speed_field < max_speed_field) startswith=eval(speed_field < max_speed_field/12) Defaults to "". endswith= A search or eval-filtering expression which, if satisfied by an event, marks the end of a transaction. For example: endswith="logout" endswith=(username=foobar) endswith=eval(speed_field < max_speed_field) endswith=eval(speed_field < max_speed_field/12) Defaults to "". ... View more

Thanks ayn.Can it possible trancation check only the first occurence of that id and clumping all the next 100 events rather that breaking at every event where this id is appearing like in regex "mxmatch=1" like this can we restrict transaction.That means it will check only once for id and will clumping all the following 100 events. ... View more

John, did it worked for you ? ... View more

enter code here Use KV_MODE = XML in props.conf or Check out the spath command. | spath SPATH The spath command--the "s" stands for Splunk (or structured) -- provides a straightforward means for extracting information from structured data formats, XML and JSON. It also highlights the syntax in the displayed events list. KV_MODE: KV_MODE = [none|auto|multi|json|xml] * Used for search-time field extractions only. * Specifies the field/value extraction mode for the data. * Set KV_MODE to one of the following: * none: if you want no field/value extraction to take place. * auto: extracts field/value pairs separated by equal signs. * multi: invokes the multikv search command to expand a tabular event into multiple events. * xml : automatically extracts fields from XML data. * json: automatically extracts fields from JSON data. * Setting to 'none' can ensure that one or more user-created regexes are not overridden by automatic field/value extraction for a particular host, source, or source type, and also increases search performance. * Defaults to auto. * The 'xml' and 'json' modes will not extract any fields when used on data that isn't of the correct format (JSON or XML). ... View more

even these indexes are also not created PerfMon and Os. ... View more

I downvoted this post because doesn't provide valuable input ... View more

how to do that? ... View more

You can change the order of the fields that are returned using either the fields or the table command. | inputlookup mylookup.csv | fields s,b,k,a,h | inputlookup mylookup.csv | table s,b,k,a,h ... View more

Hi All. I have the same question? but i'd like to make it not in SimpleResultsTable, but in SideView's Table. I need to drill with searchterms in exactly clicked cell value and its column name. ... View more

This will only show values that have counts. Using the fields command we can show the count of other series that may have existed, but how do we fill those null values with 0 if they have no events? The fillnull command does not seem to work in that case. ... View more

Thanks nick. ... View more

When i have indexed the files seperately in splunk then sourcetype is working.But for both files the automatic source type is not working splunk is taking some default source type not the source type that i have given like data and server. ... View more

updated. /k ... View more

Thanks Ayn... ... View more

Like this: <form> <label>Two search example</label> <description>A question in answers.splunk.com</description> <fieldset autoRun="true" submitButton="false"> <input type="dropdown" token="search_string_tok1"> <label>Hard-Coded Searches</label> <choice value="earliest=0 latest=now() | head 5">last 5 events</choice> <choice value="earliest=0 latest=now() | head 10">last 10 events</choice> <default>last 5 events</default> </input> </fieldset> <row> <panel> <table> <title>User-selected search</title> <searchString>$search_string_tok1$</searchString> <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="rowNumbers">false</option> <option name="table.drilldown">all</option> <option name="table.wrap">1</option> <option name="type">list</option> <option name="wrap">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> ... View more

Well Sideview Utils itself contains examples and documentation, and there's a page dedicated to how the drilldown keys work with clickable tables and charts. See inside the app itself for more details. ... View more

Thanks Ayn,Its working fine.......... ... View more

Thanks kristian,sorry i forgot to mention that iam having same x.log extension file on other folder also i mean iam getting log on basis of each date.And iam copy that to one folder like Parent folder having a,d,c folder all files having same extension and same line breaking.Please check i have edited my queries. ... View more