Hi I'm trying to save the results of 2 queries on a dash to a token and then add them up into a 3rd query. I'm running 8.2 and and it's beginning to look like all this only became available in 9 ? https://docs.splunk.com/Documentation/Splunk/9.0.0/DashStudio/searchTokens I dont see the button described here In the Edit Data Source panel, check the box for Use search results or job status as tokens.  I tried some of the stuff like job.resultCount etc...but cannot get anything to interpolate. Am I totally out of luck for v8.2 ? ... View more

Hey Gurus I have a conundrum here regarding a Dashboard Studio board I'm working on to show Infoblox zone transaction details. I'm trying to write queries that allow for either passing a grid site name or leave it blank and show global stats. Normally, the default value for a token is "*" and that works perfectly with splunk's host wildcard. However, for some reason, you decided to use a different wildcard for the "where like" function, that being "%". This messes up a query I have when not passing a value for site. Fe. the following query works out as desired when I pass token "sf01-ibsn-c01n"  for macro_site:       where new_serial="$macro_serial$" AND like(client_resolved, "$macro_site$%")       It interpolates it as :       where new_serial="2654170934" AND like(client_resolved, "sf01-ibsn-c01n%")       Of course, when I don't pass a site, the query turns into garbage:       where new_serial="2654170934" AND like(client_resolved, "*%")         I cannot change the default value to "%", since now the host wildcard is messed up. I basically need either two conditional defaults or, perhaps, some dash/xml logic to deal with this ? Any help would be appreciated. Thank you !  ... View more

Gurus I am working on a Studio Dash and I would like to add the output of a transaction the way it is usually shown in the search gui for debugging purposes so I can easily see if the transaction is correct. Turns out the only option I seem to have is a table but here I only get the raw msg. That's ugly and unreadable, of course, since the newlines are merged into one.  Is there a way to do this within a dashboard and make the message look just like in the search gui ? Perhaps I could re-insert the newlines ?   Thx ... View more

Gurus This should be simple and probably is but I can't get it to work. I have an index that captures some huge page stats from our oracle rac nodes. I'm trying to calculate total memory wasted per cluster because of over allocation of huge pages. Let's say I have 2 nodes in a cluster: devdbc01n03 devdbc01n04 then the following works: index=linux_huge_pages host=devdbc01n*.* | eval test_var = GB_Wasted * 2 | timechart avg(test_var) GB_Wasted is a field that splunk extracts from the log and it contains the amount of GB wasted per rac node because it has not been allocated so times 2 shows the total amount of RAM wasted for this cluster (avg) in this case. Problem is, the number of cluster members varies between 2 and 4 so the "2" here should really be dynamic. Based on the host=devdbc01n*.* wildcard it'll match the only 2 members of this cluster but I want splunk to determine this dynamically based on dc(host) instead. I cannot get it to replace "2" with this dynamic value. I tried the following : index=linux_huge_pages host=devdbc01n*.* | eval test_var = GB_Wasted * stats dc(host) | timechart avg(test_var) that gives me an operator error and this one: index=linux_huge_pages host=devdbc01n*.* | stats dc(host) as dist_host_count | eval test_var = GB_Wasted * dist_host_count | fields test_var which doesn't throw an error but also doesn't show a number. dc works by itself though. index=linux_huge_pages host=devdbc01n*.* | stats dc(host) this gives me the desired number of distinguished hosts but how do I assign a variable to it so I can do a calculation ? thx ... View more

Splunk gurus Newbie here trying to get a feel for what's possible in splunk. I'd like to alert on "trigger2" Nov 4 19:34:00 blabla Nov 4 19:34:01 trigger2 Nov 4 10:35:00 blabla EXCEPT when it's preceded by "trigger1" up to 60s before "trigger2" like: Nov 4 19:33:05 trigger1 Nov 4 19:34:00 blabla Nov 4 19:34:01 trigger2 Nov 4 10:35:00 blabla From what I've seen this means in splunk terms : Search for "trigger2" but also output everything up to 60s before the matching line Take this output and do a subsearch for "trigger1" If found ignore but if not alert on "trigger2" I see things like "localize" and "format" but I'm unsure if any of those can achieve this. Splunk support says this is rather complicated. Anyone wants to take a stab ? I'd love to see it. ... View more

Gurus I just started playing with splunk and after reading the alert howto it looks like a real-time/rolling window alert is a good start. I tested a simple "Failed password" scenario where more than 2 failed logins per 60 seconds should trigger an alert. This works as expected for all usernames. If I have the same user fail to logon 3 times within 60 seconds it sends an email. However, it also sends an email when 3 different users fail to log on within this timeframe. I'm pretty sure "stats count per user" is the answer here but when I add that to "Failed password" in my search nothing triggers anymore. Not even when the same user fails 3 times within 60 seconds. I believe there is a stats table that gets created as described here : http://docs.splunk.com/Documentation/Splunk/latest/User/Alertusecases This article makes it sound like I can just add this pipe to my query to make the alert aware of whether the same user fails or various users. Clearly I'm missing something. I might have some misconception here but shouldn't I be able to view this table in the alert dashboard ? Where can I see the results in this table ? The alert is "Failed password | stats count per user". As soon as I remove the pipe it starts working as before. Any hint is appreciated. Thx ... View more