Great app.. I just cant figure out how to assign a value that matches the event_count or anything else (closed_txn count) In the example below, he shows how to calculate rolling 7 day average, but its a static number. My dashboard uses "Business week to date". So I want my denominator for the average to be the number of day I am in the week (or event_count as mentioned above). I have just so far been unsuccessful in getting it to work. Monday=total/1; Tuesday=total/2; Wednesday=total/3 etc.. | timechart count span=1h | timewrap d series=short | addtotals s* | eval 7dayavg=Total/7.0 <-Basically, how do I make this dynamic based on the number of runs, or day of the week?-> | table _time, _span, s0, s1, 7dayavg | rename s0 as now, s1 as yesterday ... View more

I am using DBquery to access a DB that has our monitoring configuration. I am trying to determine ratio of monitors meeting a certain monitor naming standard. I am doing this by parsing the monitor name and searching for and counting those meeting those standards, and then counting the total number of monitors. Most business groups have a least a couple monitors meeting the standard, but a few do not. This results in the standards search for those groups returning no results. What I want, is for it to return the number 0 so that I can calculate a coverage percentage with eval. Example: Biz group A has 100 monitors and 10 match standard = 10% coverage Biz group B has 200 monitors and NONE match standards. Therefore I cannot calculate the ratio. ... View more

My field in the events is as follows UserFullName=Lastname, Firstname , I know that I can use a regex to extract the fields and concantenante the fields using eval to create a new fullname field. That just seems a long way around. Thanks. ... View more

Not a splunk newbie, but I cant seem to figure out how to format my timechart values to be readable. The default format: 2013-08-28T14:30:00.000-04:00 Is not ideal for reading, and is normally too much information. ... View more

Basic problem is that I need to pull out valid reporting dates for each account. If you can imagine a text box, and a drop-down.. The text box is looking for an account number. I then want splunk to run the populating search for the dropdown to get the valid reporting dates, using the account number entered in the text box. Is this possible? ... View more

I am creating a dashboard form that is driven off of a text box, and a drop-down. I am trying to dynamically populate the dropdown with the valid date choices for reporting as stored in the DB. The problem is the date is a string in the DB I am querying (20,120,331). NO problem I thought.. I will use the TO_DATE oracle function. Now, the date is showing in Epoch in splunk UI (1333166400). Anyone have any idea on how to make this display correctly? --I already tried convert - convert timeformat="%H:%M:%S" ctime(time)-- ... View more

I have tried escaping the underbar to no avail.. My string is "L1_a123456" I can see all events matching the first part up to the _ e.g. "L1" As soon as I add the "_", the search returns no results. Please help! ... View more

Hello All, I recently deployed a new dashboard to look at response times and the count of the requests. We found that because of the difference in the numbers, a log scale on the Y-Axis was much better for display purposes. I edited the report to change the y axis to log, and it looks correct for me on the dashboard. Everyone else is still seeing a linear scale. Any idea? ... View more

Hello, I am using simple XML to construct a dashboard using a searchTemplate with a timepicker. My questions is, can you have multiple timepickers on the same dashboard? Id like to have 3 charts running the same search on different dates/times. Thanks! ... View more

How do I add a few lines of text in a graph explaining what they are seeing on the graph? We have several searches showing transactions across many services that could use an explanation. A good description would be helpful. ... View more

We are testing in a high throughput environment capturing logs that grow to 251MB in ~ 4-6 minutes at which time the logs are rolled to a dated log file. e.g. test.log -> test.log.20110315042946 The problems is that Splunk thinks we have already indexed one or more of the rolled log files, and results in us missing data from the performance run. I have read about using the crcSalt but to avoid using that on rotating log files. 03-15-2011 09:38:04.028 ERROR TailingProcessor - Ignoring path due to: File will not be read, seekptr checksum did not match (file=/opt/perf/gett/log/test.log.20110315091120). Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or contact Splunk Support for more info. Can someone suggest how this problem can be managed? ... View more