Hi, I am trying to load this CSV file: time,name,ActiveUsers,CaptureTimeDelta,CurrentValue,DeltaTimeAuditLog,Kurtosis,LocalTimeDelta,Mean,Samples,Skew,Variance 2019-02-12T13:10:36,AddShipments,,,0.00000000,,88.10602295,,0.00970874,103,9.16633183,0.00961448 2019-02-12T13:10:36,ConsolCount,,,1.00000000,,3.67393608,,1.48936170,94,1.23317451,0.65414215 2019-02-12T13:10:36,EditConsols,,,0.00000000,,0.00000000,,0.00000000,94,0.00000000,0.00000000 2019-02-12T13:10:36,EditShipments,,,0.00000000,,38.53877106,,0.02127660,94,6.19019906,0.02082390 2019-02-12T13:10:36,GetAuditWindow,,,5.00000000,,210.03408186,,26.39361702,94,3.16661255,12504.23868266 2019-02-12T13:10:36,GetConsols,,,0.00000000,,68.64629382,,1.60638298,94,8.01521793,63.49400181 2019-02-12T13:10:36,GetShipments,,,4.00000000,,4.62276245,,50.74468085,94,1.55334745,2470.61566320 2019-02-12T13:10:31,MQFlushStandardQueue,,,0.00000000,,39.47942421,,0.02127660,94,6.32050599,0.02082390 2019-02-12T13:10:31,MQFlushStatsQueue,,,0.00000000,,0.00000000,,0.00000000,94,0.00000000,0.00000000 2019-02-12T13:10:31,MainLoop,,,92.00000000,,72.99251268,,79.29787234,94,2.95450406,15798.86871888 2019-02-12T13:10:36,PageFaultCount,,,77049.00000000,,,,,,, 2019-02-12T13:10:36,PagefileUsage,,,64151552.00000000,,,,,,, 2019-02-12T13:10:36,PeakPagefileUsage,,,108593152.00000000,,,,,,, 2019-02-12T13:10:36,PeakWorkingSetSize,,,101318656.00000000,,,,,,, 2019-02-12T13:10:36,QuotaNonPagedPoolUsag,,,24736.00000000,,,,,,, 2019-02-12T13:10:36,QuotaPagedPoolUsage,,,162840.00000000,,,,,,, 2019-02-12T13:10:36,QuotaPeakNonPagedPoolUsage,,,1080064.00000000,,,,,,, 2019-02-12T13:10:36,QuotaPeakPagedPoolUsage,,,162840.00000000,,,,,,, 2019-02-12T13:10:36,ShipmentCount,,,1.00000000,,3.67393608,,1.48936170,94,1.23317451,0.65414215 2019-02-12T13:10:36,WorkingSetSize,,,69599232.00000000,,,,,,, 2019-02-12T13:10:36.02,StatsMonitor,2065,0.36,,0.56,,0,,,, I am using Splunk Free to develop some dashboards and processes, so everything is local. I have tried simply loading it interactively or via directory scan. The end result is the same. When I load it interactively, the process in Splunk Web displays the heading, which is in the first line. Everything looks right at this stage. However, when the loading process is complete, there seems to be no knowledge of the headings in the search tool. The timestamp is picked up correctly, but the meaning of each column seems to be lost. I am using the default csv source type. I have tried variations of this sourfce type with no success (specifying the heading line etc). What am I missing here? Thanks, ... View more

Hi, I am trying to load JSON data via cURL into an HTTP Event Collector. I know that I am reaching the service and getting a response, but it is always the same: {"text":"Error in handling indexed fields","code":15,"invalid-event-number":0} I execute it on Windows with the command: curl -k "https://localhost:8088/services/collector" -H "Authorization: Splunk 41051b3a-6563-4bec-bd57-94fe1f73df8d" -d @%1 and I pass the name of the file which contains the following: {"time":"2018-08-31T06:10:06.000","event":{"name":"AddShipments","number":"10"}} I have declared a source type derived from JSON and indicated that the key for the timestamp is 'time'. This appears to work, but I simply cannot seem to get the data loaded. Are there mandatory fields that I need to add? I should point out that I have tried adding 'index' and 'sourcetype'. This seems to work, but also seems superfluous as the token ID maps to these values. In any case, it does not help. Or do I need to pre-define the JSON structure somehow? I though it could absorb any structure and you parse for what you need later with the spath command. I am using Splunk 7.1.2. Community edition of Splunk Enterprise Any advice would be most appreciated. Thanks, Stan ... View more

As much as I have tried every variant in the potential answers, I can't make this work. I have the following code: <input type="dropdown" token="machine_tok" searchWhenChanged="true"> <label>Select a machine</label> <prefix>Machine_Name="</prefix> <suffix>"</suffix> <choice value="*">ND001913</choice> <default>ND001913</default> <search> <query>index=nextgen_machine | stats values(Machine_Name) as machines</query> </search> <fieldForLabel>machine</fieldForLabel> <fieldForValue>machine</fieldForValue> </input> Which displays the default value of ND001913. The other values are found, but presented as a comma delimited list as only one single other value. How to I get this to return one item in the drop-down for one unique value? ... View more

Some advice on something I would have thought to be easy. I have a field called Elapsed . I want to calculate the number of events in a window of two hours, divide this count by 7200 (the number of seconds in 2 hours) and multiply this by the average value of Elapsed divided by 1000 over this two hours. I then want to send this evaluated result to a timechart. Here is my current search: index=ediinter Elapsed>0 | bucket _time span=2h | stats avg(Elapsed) as Residence, count as Total | eval queue=((Total/7200)*(Residence/1000)) | timechart span=2h first(queue) as Queue but this produces no results What am I filtering out? Thanks, Stan ... View more

I have a problem with a requirement to remove data collected on weekend days from my indexes. I can do this accurately, but when I run a calculation over the resultant set, it seems to continue to include data from these days as 'zeros'. Here is the search string: index=edistats RealName="ShipmentOpen" | `isWeekDay(_time)` | where weekDay < 6 AND weekDay > 0 | timechart span=1d avg(Elapsed) as average | `lineartrend(_time,average)` | timechart max(average) as mean sum(newY) as regression The included macros are: isWeekDay: eval weekDay = strftime($time$,"%w") and lineartrend: eventstats count as numevents sum($x$) as sumX sum($y$) as sumY sum(eval($x$*$y$)) as sumXY sum(eval($x$*$x$)) as sumX2 sum(eval($y$*$y$)) as sumY2 | eval slope=((numevents*sumXY)-(sumX*sumY))/((numevents*sumX2)-(sumX*sumX)) | eval yintercept= ((sumY*sumX2)-(sumX*sumXY))/((numevents*sumX2)-(sumX*sumX))| eval newY=(yintercept + (slope*$x$)) | eval R=((numevents*sumXY) - (sumX*sumY))/sqrt(((numevents*sumX2)-(sumX*sumX))* ((numevents*sumY2)-(sumY*sumY))) | eval R2=R*R The first macro does the job and comes up with the days I want to drop, however, if I do this, the fitted linear regression is lower than what it should be. This is clear from the visual display as the raw trend is mostly flat. Do I need to do something in the lineartrend macro to ensure it avoids these dropped days? Thanks, Stan ... View more

Hi there, I have an issue with time zones where my analysis system (Splunk Free) is in the Australian Eastern time zone and I am trying to analyze data which was captured in the Central European time zone. I checked the data imported and I have the right times on the data once I tell Splunk it originates in Europe. I see my times in the data. What I am doing is averaging the data over 24 hours. So when I say '15-May', I would like this to be 15 May in Europe, not Australia. I can't seem to figure out what I need to configure in Splunk to 'fool' it that I am analyzing in Europe. Do I need to change locale on my system? Thanks, Stan ... View more

HI there, I have been trying to set a specific date time in the default setting for the date time picker: &lt;fieldset autoRun="true" submitButton="false"&gt; &lt;input type="time" token="time" searchWhenChanged="true"&gt; &lt;label /&gt; &lt;default&gt; <earliestTime>04/01/2015:00:00:00 CET</earliestTime> <latestTime>now</latestTime> &lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; I am taking the format from the docs which indicates %m/%d$Y:%H:%M:%S, but I keep getting an error when I try and run the query (Invalid earliest_time). I have tried multiple permutations with no success. Is this a locale dependency (I am in Australia and we usually reverse the month and day). This is driving me crazy. Any advice would be well received! Thanks, Stan ... View more