so here is my new assignment: we have about 15 alerts that search for various key phrases in our Cisco network's syslogs. Some of them return hundreds or even thousands of results (usually in a "|stats count" format). My boss wants me to create a dashboard with a time picker to see the daily number of returned results for each alerts in a stacked bar chart. So basically the X axis would be the date and the y-axis would be count with each alert represented by a different color. I am thinking i need to specify the search for each alert, then somehow assign it a variable to be specified in an "xyseries" command. I already have the date conversion from another dashboard:   convert timeformat="%m/%d" ctime(_time) AS date | stats count by "xyz",date | xyseries date, "xyz", count What i can't seem to get is each alert's search string as a separate item in the series. Here is an example alert: index=network key_word=*HWPORTMAN-*QUEUE OR key_word=LINECARDMGMTPROTOCOL-*WARNING | stats count by host ... View more

My boss has asked me to create a chart that shows the number of fired alerts (y-axis) by day of the month (x-axis). I suggested we do this as a stacked chart with each alert represented by a different color. I know the alert variable is "ss_name" and i found this expression to create the "date": convert timeformat="%m-%d" ctime(_time) AS date I just cant get the correct syntax to get all 3 elements in to the chart. So far i have this: index=_audit action="alert_fired" | convert timeformat="%m-%d" ctime(_time) AS date | timechart date by ss_name Thanks! ... View more

We recently upgraded from 6.5.4 to 6.6.0 as an interim step on our way to 7.3.6. We had about 12 realtime searches that triggered alerts that were working perfectly. right after the upgrade to 6.6.0 we get the error above and see that there is a 98% skip ratio in the Scheduler Activity dashboard. Splunk will not help us as this is an unsupported version but i need to get this foxed before i will be allowed to upgrade to the final, supported version. Here is the full event: 07-26-2020 16:59:00.318 -0400 INFO SavedSplunker - savedsearch_id="nobody;search;Route Flapping", search_type="scheduled", user="mvas**", app="search", savedsearch_name="Route Flapping", priority=default, status=skipped, reason="The maximum number of concurrent real-time scheduled searches on this instance has been reached", concurrency_category="real-time_scheduled", concurrency_context="saved-search_instance-wide", concurrency_limit=1, scheduled_time=1595797140, window_time=0 I understand the concurrency limit might be the culprit but have not been able to find how to fix it. ... View more

I recently upgraded my Cisco Networks App from 2.3.4 to 2.5.7 but now all the dashboards are getting this error in historical mode. Here is the query from one of the modules: | tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product IN (IOS) Cisco_IOS_Event.index IN (*) BY host Cisco_IOS_Event.index | rename Cisco_IOS_Event.index AS index | search nodename=Cisco_IOS_Event | stats sum(count) ... View more