I was afraid of that. Would be nice if there were a second separator-like character, but I'll make do. Thank you for confirming. ... View more

That won't work. It just prepends the string sourcetype. I want the value of the sourcetype field. ... View more

There's something wacky about how the Splunk regex parser interprets backslashes. As a rule of thumb, to match a literal backslash you need one more than you think you do. This should work: rex mode=sed field=foo "s/(\\\)/\1\1/g" ... View more

Not an expert on this app, but I think the summarizing part is defined in alert_actions.conf. The stanza in savedsearches.conf should have a setting like action.<name> = 1 and the corresponding summarization is handled in the alert_actions file. This lets multiple searches reuse the same alert throttling logic. ... View more

@wrangler2x: Yes, but I wanted to make the fields easily available for other users without telling them to run a rex in the middle of their search. ... View more

@xdp4: You've probably given up on this by now, but what exactly doesn't work--are the matching hosts in each search not joining together, or is there a count field in both the lookup and the live search that's breaking isnull, or something else? I got a working search very similar to the one you posted in your own answer, so fundamentally this technique is fine; it's likely a problem with your particular data set. Since the join field is IPs, it's probably not an issue of mismatching capitalization, but there might be stray newlines or something that's causing the join to break. Also, since you're searching all indexes for the past day, it might be as simple as the subsearch timing out before it can return any data. Running a live search over index=* just to see what hosts are reporting in gives me the heebie jeebies. If you're on a moderately recent version of Splunk, try this instead: | tstats count where index=* by host. ... View more

When Splunk says "missing a search command before [some character]", it means the parser got to that character and didn't understand what came next. You could either paste the search into a text editor and manually find character #57, or you could just look for all such characters in your search and try to determine if any of them could be confusing the parser. In this case, the issue is likely your regex's character set: [-a-zA-Z0-9...]. Even though it's supposed to be legal to lead off the character set with an unescaped hyphen, Splunk does not properly recognize it. You'll need to escape it with a backslash. ... View more

I still want the user to be able to drill down on the value in a clicked section of the pie chart. The problem is that there is no way to click on all sections at once. ... View more

Thanks for confirming. ... View more

No results. So they'd all come in with the sourcetype of the monitor? And there's nothing else it would be doing? ... View more

Try condition match="match(value, & quot; \ \ *& quot;)" but without all the interior whitespace. (I added that so the characters would post verbatim.) ... View more

It doesn't look like you need another answer here, but be aware that as of 6.2, there is an mvdedup command that does exactly what you need: eval contract=mvdedup(contract). See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions. ... View more

@Georgin: It doesn't have to be quoted unless the value itself contains separators. E.g. field=0 OR field=1 is fine, but you would have to use quotes for field="My String With Spaces". ... View more

This is for JS and CSS specifically, so I don't think there's an endpoint for those components. I'll see if I can hack the POSt headers. ... View more

Thanks, this is helpful. ... View more

Just to double-check, the files don't need to appear on the indexers at all? Does it hurt anything if they're there (i.e. cause extra load)? ... View more

Yeah, I kind of figured there wasn't any magic. We have the same problem with average, that we're calculating an average of averages, but I knew about that one. I don't think running any daily search over the raw data will fly, but I'll see if people are okay with the reduced accuracy of the p* values over the hourly data. Thanks. ... View more

The label at the top of the column in the job inspector says Duration (seconds), so it's in seconds. The number you're reporting is so ridiculously large that I suspect it's not real--maybe there's a time discrepancy somewhere on one of your indexers or your SH/storage or something. ... View more