I currently have a search that uses 3 join statements to get me the criteria I'm looking for over the last three years. Essentially it looks like: earliest=@year latest=now EVENT_TYPE=Login date_month=january | stats dc(USERNAME) as newUsers by foo | join foo [search earliest=-1year@year latest=@year EVENT_TYPE=Login date_month=january | stats dc(USERNAME) as olderUsers by foo ] | join foo [search earliest=-2year@year latest=-1year@year EVENT_TYPE=Login date_month=january | stats dc(USERNAME) as oldestUsers by foo ] | table foo oldestUsers olderUsers newUsers This gives me a lovely visualization with 3 bars per foo, each the count of users that logged in to our software in January of this year, last year, and 2014. The problem is twofold: (1) it takes forever to run, and more importantly, (2) If user John Smith didn't log in January of this year, there is nothing to join on and compare logins from last year or the year before. Therefore, I'm missing data. When I timechart the above, I don't get the visualization I want, but my data is accurate. I also tried using append and timewrap , neither of which got me what I'm looking for. This is what the append and a timechart gets me the data by foo, but in 3 groups of bars, 1 group per year. This is what the timewrap gets me: This is what my join gets me (this is last month compared to this month, and client_type=foo in my above example). This is what I want to see, but I need a method that gets me a complete dataset. Thoughts? ... View more

I am using Splunk 6.1.1 and currently have a form that takes an integer input (foo) and timerange. The URL for this view after entering the values is https://splunk/app/app_name/view_name?earliest=-30d&latest=now&form.foo=1#. I then generate a PDF from this page. Thing is, I need this form for about 650 instances of foo, and I'd like to run it once a month. I can't schedule the view since it requires input, and I refuse to create 650 instance of the form without input. My hope is to create a python or ruby script that calls this view with the required input, generates a PDF from the output, and gives me the document metadata so I can store elsewhere. Is this a thing? Looking through the API docs, I see lots for scheduled searches, but this isn't a scheduled search. Any assistance would be much appreciated. ... View more

I am trying to rex a URL string. Here is an example: ManageAccount.do?ACTION=VIEW&id=27271905&acctViewType=transactions My SPL is \w+\.\w+\?ACTION=VIEW\&id=\d+\&acctViewType=\w+ which is about as specific as one can get. Thing is, this doesn't return results. I tried the following: \w+\.\w+\?ACTION=.* to try and generalize, but my result was "ManageAccount.do?ACTION=VIEW" Has anyone heard of issues with & in a regex, and issues with it in Splunk? ... View more

I have a lot of experience with front end querying and search time Splunk queries, but I am less familiar with the back-end magic that can happen in Splunk. I've created an input with DBX that returns an ID and a JSON from our database into Splunk. I tried parsing the JSON with spath, rex sed, and other options for a few hours yesterday, to no avail. If I could set the kv_mode to json in the config file, I think my life will be much easier. My question is, can (and how) would I do this? Are there any documents/previous threads that would have this information? Since the input is a query, and not a static file, I wasn't sure if it was configurable. Any and all info would be greatly appreciated. ... View more

This seems similar to http://answers.splunk.com/answers/108423/stacked-chart-to-show-how-many-calls-where-assigned-to-the-assignee-by-the-queuemanagers.html, but I can't seem to apply it in practice. I have 3 values: stats sum (Requests) hourOfRequest (date_hour essentially) host I want to see a stacked chart, where each column is a host, and the sum(request) per hourOfRequest are the series within each column. I've tried a few different methods, but can't seem to get it. ... View more