I have a dashboard that shows a bunch of different metrics for some data that I have. One of the metrics compares todays counts vs an average of the last four weeks on the same weekday and up to the same time of the day. So in essence my data looks kind of like this.   type avg_past today ---------------------------------- foo 10456 10550 bar 6 9 baz 20 30 etc...   I've got this charting to a bar graph where I can see for each type the past average vs today. What I would like to do is only show the ones where there is a statistically significant difference between the past and today. I could throw on something like this  to my search ...   | where today > (avg_past * 1.25)   And that will work ok for types that have lots of data, but for instance in my example above "bar" has 50% more data. So, it would also show up, but it's really not statistically significant. So, my predicament is that I need the percentage different to be larger the smaller the counts and smaller as the counts go up. Thoughts on how to achieve this? Thanks. ... View more

I have a time picker on my dashboard called timePicker. There are some pie charts that are populated based on the earliest and latest of the time picker. That part works great. However, I have on the same dashboard a line graph that shows counts over hour by day for the last 7 days. That earliest and latest is set static like this ...   earliest=-7D@d latest=now   Ideally I would like the line graph to not just show the previous seven days before now, but the previous seven days based on the time picker. The latest part is easy. I could do this ...   earliest=-7D@d latest=$timePicker.latest$   My trouble is with earliest. I need to subtract 604800 from  it (seven days worth of seconds). I tried this, but it doesn't seem to work.   [stats count | eval early=$$timePicker.earliest$$ | eval earliest=early-604800 | fields earliest] latest=$timePicker.latest$   I doubled $ for the earliest token to escape it out because it is used in a dashobard ... I read somewhere that  $ needs to be escaped. Anyway, I get no results. I'm sure my syntax is wrong or maybe I'm going about it wrong. Anyone have any thoughts on how to do this? I guess another thought would be to create a token when the time picker is selected that calculates $timePicker.earliest$ - 604800 but I'm not sure if that is possible or how to do it. Any help would be much appreciated. Thanks. ... View more

I've got a report that is run on a schedule every five minutes. I would like the "latest" to be set to the most recent increment of 5 minutes. This solution used to work but no longer appears to. Does anyone have any thoughts for how to achieve this? I cannot simply rely on latest=now() because the report certainly will not always run exactly at the correct time. So, I need to be able to snap to the latest 5 minutes so that my counts do not get improperly calculated. Edit: Here is my base search. I'm trying to get latest to snap to the most recent five minute increment. It's not returning any results. index=_internal source=*license_usage.log* type=Usage earliest=-0d@d ([makeresults | eval latest=(floor(now()/300))*300 | fields latest]) However, if I do something like this is does return results. I don't want this ... I was just testing to see if the syntax was messed up or something. The above base search is what I want because it snaps latest to the most recent five minute increment of the hour. index=_internal source=*license_usage.log* type=Usage earliest=-0d@d ([makeresults | eval latest=relative_time(now(), "-m") | fields latest])  Why does relative_time(now(), "-m") work but (floor(now()/300))*300 doesn't? ... View more

I have a dashboard with four pie charts across the top. I've set up drill downs for these that open up a new tab. However, I'm wondering if it is possible to put and events panel below them and depending upon the pie chart that is clicked dynamically build the SPL for the events panel. The four pie charts have very different searches and drill downs, so I cannot simply just populate some tokens for use with the events panel. I would need to actually dynamically build the SPL and pass that to the events panel. Is that even possible? Thanks. ... View more

I'm upgrading the Splunk_TA_windows to the newest version in our environment. We are coming from an old 5.x version. Now that the Windows TA, Active Directory TA, and the DNS TA have all been consolidated into one TA, I've got some questions for how to best deploy this. I've looked at the local inputs.conf files for all three of the legacy TAs and consolidated them into a local inputs.conf file for the new TA. I've deployed it to one machine using the deployment server and have immediately discovered an issue. I figured the AD and DNS logs would not be present on a Workstation PC so those pieces would not run, however, that's not the case. Some the AD powershell inputs are running on my laptop, which is not what I want. So, I'm figuring I need to find a way to split out the local inputs.conf file by machine type (workstation/server/domain controller/DNS server). I'm thinking maybe I need to deploy the Splunk_TA_windows to all our windows machines as is ... no local inputs.conf. And then maybe create small apps to turn on certain features of the TA per machine type. Is that the right way to do this? Would that even work? I'm thinking there might be issues with the scripted inputs as the script files would live in another app. Anyway, I'm just not sure what the best way to handle this is. Any help would be much appreciated. ... View more

I've got my universal forwarders and heavy forwarders doing indexer discovery through the cluster master like so ...   ************************** * outputs.conf * ************************** [indexer_discovery:clustermaster] pass4SymmKey = {password} master_uri = https://{my cluster master}.domain.foo:8089 [tcpout:clustermastergroup] indexerDiscovery = clustermaster useACK = true [tcpout] defaultGroup = clustermastergroup   Is there any reason I could not do the same in the cluster master's outputs.conf file? Basically, it would ask itself over 8098 who the peer nodes are. ... View more