Hi all, I need to make by default all searches in Splunk 6.1.1 as case InSensitive. For example, this search are case InSensitive: index=_internal log_level=info But this search are case Sensitive: index=_internal | where log_level=info Hm, strange... Why? Maybe it's bug and I need to report about it? How can I set default case InSensitive search everywhere? I know about function lower() , but it's just particular solution. Thanks. ... View more

Hi all! How can I declare few different SearchTemplate's in one Dashboard with SimpleXML? I need it for optimization. Or I can do it only with AdvancedXML? In documentation (http://docs.splunk.com/Documentation/Splunk/6.1/Viz/PanelreferenceforSimplifiedXML) I found that can be declared not only in Form, in Table/Chart/Events/... too. But, I need to declare in and use results in few Charts (maybe as PostProcess). Thanks! ... View more

Hi all! As I understand, Splunk doesn't have any special functions for normal work with string. I need to get index of a not constant char/substring in another string. Substring is not constant, it's value from another field. Solution for constant substring: http://answers.splunk.com/answers/66496/how-to-get-index-of-a-particular-letter-in-string But, it has not work for dynamic substring. I tried to form regular expression: index="b2b_integration_oss" | eval string="Some long string" | eval regExString=".*(?<substring>\b" + searchField + "\b).*" | rex field=string regExString Then, I got next error: Error in 'rex' command: The regex 'regExString' does not extract anything. It should specify at least one named group. Format: (?<name>...). Why doesn't exist in Splunk any analogs for SQL CHARINDEX function? Anyone can guide me please on this? Thanks! ... View more

Hi all! I am working on task: Create cumulative chart for counting Success and Error entities, by 1 hour slice interval, with checking latest [Status] value by [ID] and [StatusDateTime] to every [Slice]. "Slice logic" - for example, exist next Events: ID Status StatusDateTime ------------------------------ 1 Error 2014-04-23 10:55 2 Success 2014-04-23 10:55 1 Success 2014-04-23 11:55 Need to get next result: Slice Success Error ------------------------------------ 2014-04-23 11:00 1 1 2014-04-23 12:00 2 0 I know how to calculate count separately for 1 hour periods: index="log_index" | eval GroupDate=strftime(relative_time(StatusDateTime, "+1h@h"), "%Y-%m-%d %H:%M") | stats latest(Status) as Status by ID, GroupDate | stats c(eval(Status="Success")) as SuccessCount, c(eval(Status="Error")) as ErrorCount by GroupDate In SQL, I can do subqueries for each period and calculate it (specifying latest in Sub-Search as GroupDate). But, as I understood, Splunk does not support passing parameters/values from Main-Search to Sub-Search, is it true? I do not have any ideas how to create needed cumulative logic. Anyone can guide me please on this? Thanks! ... View more