Although it isn't in the eventtype settings page- which is bizarre. How do you add colours to eventtypes defined manually? ... View more

figured it out: splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | eval quota = [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota | head 1 | return $quota] ... View more

I know this is a really old post- but couldn't find a similar question. The "| eval SLA=5 " works fine, but how could you do it if you wanted the value "5" to come from a search? eg: splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | appendcols [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota] | eval quota2=quota| eval quota=150 Here I'm trying to add a horizontal line for the quota, ie the result from: | rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota "quota" works fine "quota2" just displays as a single point ... View more

Seeing this exact same issue on 6.0. Did you ever resolve it? ... View more

Took me a while to notice your example had the day and month the wrong way round, should be: earliest="11/12/2012:20:00:00" latest="11/12/2012:20:00:00" ... View more

How does "Show Source" work then? That knows how to highlight the specific event you ran the workflow from. Looking at the workflow configuration, it uses $@sid$ from the _cd field, could that be used? ... View more

Reading this, I'm assuming the only way to identify an event is by using the custom fields and time of that event, and there doesn't exist a generic way of uniquely identifying an event? i.e., I shouldn't have to search for it over a period of time, as I already know the event I'm looking for. ... View more

@somesoni2 - Splunk 6.0 and simple xml if possible. @aweitzman - Time doesn't work for me because we can have multiple events with the exact same timestamp (to the millisecond) ... View more

Then you can change the "+" to "*" to match 0 or many characters ("+" matches 1 or many): (?i)&account=(?P [^&\s]*) That would produce: account="" If you wanted it to be "-", then you can use this eval: In search: | eval account=if(isNull(account),"-",account) In props.conf: EVAL-account = if(isNull(account),"-",account) ... View more