I have a table that shows something like this: Site X V 1.1 V 1.2 V 1.3 Site Y V 1.3 Site Z V 1.2 I want an alert to show me when a site has multiple versions. I cannot not quite get my search correct. The search I am currently using: | dbquery "SQLDB" "SELECT * FROM TABLE WHERE StatusType="Version" ORDER BY SITES"|Stats values(StatusValue) by SITES ... View more

I am relatively new to all things splunk. I am trying to set up a timechart that will pass a value onto another input. I can pass through $click.value$ fine along with $click.value2$. However in a time chart, that passes either the date or the count. I want it to send through the data sitting in the legend. <drilldown> <set token="form.Address1">$click.value$</set> <set token="Address1">$click.value$</set> </drilldown> What can I use instead of $click.value$? EDIT: More clarification. I am tracking the use of IP addresses. I have a search (see below) that will timechart which IP address performed a particular search over time. ...|timechart count by IPAddress I then would like to pass through via drilldown which IP address I clicked on. $click.value$ passes through the date(x axis). $click.value2$ passes through the count (y axis). How do I pass through the IP address instead? Screenshot showing more what I want to passthrough: -I do not have enough Karma to attach an image- Pretty much, when you click on a colored line in the timechart, I want to pass through (via drilldown) the data in the legend (in this case the IP address). ... View more

I am super new to using the powerful eval command but cannot quite get my head around the syntax. Can someone help me? I am trying to show stats to show how many useragents have the word bot somewhere in the field vs those that do not. ... | eval type=BOT if(useragent="*bot*")|eval type=NOT if(useragent!="*bot*")|stats count by type ... View more

In the DB Connect app, when I try to add a Database Input, instead of selecting a Table Name I would like to Specify the SQL Query. I want to run a very simple join query to use as the input. Is this possible? If so, what am I doing wrong: select Documents.tmpname, DocumentStatistics.* From DocumentStatistics INNER JOIN Documents On DocumentStatistics.image_id=Documents.image_id; I am getting the following error when I try to do this (it works fine if I just select the table): 01-13-2015 11:53:46.206 +1100 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://Database/New Data: [New Data] Invalid query " select Documents.tmpname, DocumentStatistics.*\r\r\n From DocumentStatistics\r\r\n INNER JOIN Documents\r\r\n On DocumentStatistics.image_id=Documents.image_id;" without proper {{ ... $rising_column$ > ?}} pattern! with query = ... ... View more

I am a splunk/drill down and eval newbie. And I have a quick question. I would like to have a drill down set up in a dashboard so I can click on a date in a timechart and have another panel lower down in the same dashboard update to show data from the date that I clicked on. Currently I can pass through the $click.value$ through to a date picker but that will only pass through the earliest. For instance <drilldown> <set token="timefield.earliest">$click.value$</set> <set token="form.timefield.earliest">$click.value$</set> </drilldown> How do I make it set the timefield.latest as well? I feel like I am missing something really obvious. The only solution I could think of was to make an eval query and use that, but being a noobie to that I cannot get that to quite work yet either. Also this would not be ideal as the amount of time I want to look at varies depending on the time period I am looking at. Example of the Eval I was trying to use |eval $form.placeholder$=timetestearliest+timetest Thanks ... View more