Hello, I am right now trying to reed Lotus Notes (to be coorect: Domincos console.log-file) Events. One of my problems I have, is the following: (its not connected to Notes especially, but people should know, that at least someone tried it.) Sometime I have an ID, but it can occur once, or comma separated twice. What can I do to get this value into two values for one field (I am using the search-time extraction). e.g. ...[%Timestamp%] Message ABC123 delivered.... ...[%Timestamp%] Message ABC129,ABC130 delivered.... My current RegEx extraction for the field is: ... (?P [\dA-Z]+) ...//some other fields exist before and afterwards but how can I make it detect things twice.. ? Thanks for your support! Regards, Xantor! ... View more

Hello, I would like to use the a d3 Chart in a HTML-Dashboard. Dearly I have got a problem in combination with require.js that is used by splunk. In the following you could find a first require, that works (I corrected the path so that d3 works, and I get the d3-Version in the console.) Afterwards I use the same thing again, but this time in combination with some other modules. As a result, d3 is undefined. require(["d3"],function(d3){ console.log(d3.version); }); // // LIBRARY REQUIREMENTS // // In the require function, we include the necessary libraries and modules for // the HTML dashboard. Then, we pass variable names for these libraries and // modules as function parameters, in order. // // When you add libraries or modules, remember to retain this mapping order // between the library or module and its function parameter. You can do this by // adding to the end of these lists, as shown in the commented examples below. require([ "splunkjs/mvc", "splunkjs/mvc/utils", "splunkjs/mvc/tokenutils", "underscore", "jquery", "splunkjs/mvc/simplexml", "splunkjs/mvc/headerview", "splunkjs/mvc/footerview", "splunkjs/mvc/simplexml/dashboardview", "splunkjs/mvc/simplexml/element/chart", "splunkjs/mvc/simplexml/element/event", "splunkjs/mvc/simplexml/element/html", "splunkjs/mvc/simplexml/element/list", "splunkjs/mvc/simplexml/element/map", "splunkjs/mvc/simplexml/element/single", "splunkjs/mvc/simplexml/element/table", "splunkjs/mvc/simpleform/formutils", "splunkjs/mvc/simpleform/input/dropdown", "splunkjs/mvc/simpleform/input/radiogroup", "splunkjs/mvc/simpleform/input/multiselect", "splunkjs/mvc/simpleform/input/checkboxgroup", "splunkjs/mvc/simpleform/input/text", "splunkjs/mvc/simpleform/input/timerange", "splunkjs/mvc/simpleform/input/submit", "splunkjs/mvc/searchmanager", "splunkjs/mvc/savedsearchmanager", "splunkjs/mvc/postprocessmanager", "splunkjs/mvc/simplexml/urltokenmodel", // Add comma-separated libraries and modules manually here, for example: // ..."splunkjs/mvc/simplexml/urltokenmodel", // "splunkjs/mvc/checkboxview" "d3"],{ console.log(d3.version); The specific error message I receive from chrome at this point is the following: "Uncaught ReferenceError: d3 is not defined " Do you have any idea, how to fix such an issue? Thank you very much for your support! UPDATE Work-around 16th July 2014 Meanwhile it works, but the solution looks very creepy: I require a few of the packages mentioned above (I think all before the map-element + d3) and print the d3-version-number into the commandline before I require everything in sum and run my normal stuff. If someone would have an idea, which module could use its own d3 here, it would be great to fix that. Kind regards, Xantor ... View more

Hello, I wanted to take a look at some data with splunk, as I was suddenly very surprised by its form. splunks showed me some maximum points, where he found a lot more events than in the average. The problem: When I took a look at it with an other query to see the time-ranges of each group I found something very interesting. Splunk seems to group some events outside of the other ranges! - And I couldn't understand WHY? thats my Query: sourcetype=blablabla| stats min(UTC) max(UTC) count by _time Unfortunately the result is the following: I really would have liked you to upload the picture directly here. But the website said, that only PNG or JPG Files are allowed... And guess what: It didn't accepted my Windows Snipping tool result: Neither as PNG or JPG. Meanwhile I reached a point where I can only say: Sorry Splunk. But such bugs REALLY sucks and are not worth the huge amount of money, we'll have to pay! I hope that someone has an explanation and especially that the Splunk Team, which should be reading here, responds if possible, otherwise its very unlikely to recommend it for the company I am evaluating Splunk for. Especially because its not possible to report a bug now without using the Enterprise support... Regards, Xantor ... View more