When using the fields sidebar, I can see how often a field appears out of my total result set (ie Appears in 62% of results), and how often the top values of that field appear in the results. When I use the top command, I can see how often these values appear out of the total number of events that contain that field. How can I obtain statistics similar how the field sidebar presents them, as a percentage of the total result set? In my use case I have UserAgent split out to multiple fields and want to know what are the top UserAgents across our total traffic. ... View more

I'm trying to make a UserAgent report on from a summary index that I'm populating with a count for each browser/os that hits IIS. sourcetype="iis*" earliest=-2h@h latest=-1h@h |rex "(?i)\\(compatible;\\+MSIE(?P<MSIE>[^;]+)" |rex "(?i)\\+Chrome/(?P<Chrome>[^\\+]+)" |rex "(?i)\\+.*?Firefox/(?P<Firefox>\\d+\\.\\d+\\.\\d+)(?=\\+)" |rex "(?i)\\+.*?;\\+\\w+\\+(?P<Windows>\\w+\\+\\d+\\.\\d+)(?=;)" |rex "(?i)OS+\\+X\\+(?P<OSX>[^;]+)" |rex "(?i)\\+Version/(?P<Safari>[^/]+)" |rex "(?i)^(?:[^ ]* ){9}+Opera\\/(?P<Opera>[^\\(]+)" |rex "(?i)\\+Ubuntu/(?P<Ubuntu>\\d+\\.\\d+)" |sistats count(Firefox) as FFcnt, count(MSIE) as IEcnt, count(OSX) as OSXcnt, count(Windows) as Wincnt, count(Safari) as Safcnt, count(Chrome) as Chrcnt, count(Opera) as Oprcnt, count(Ubuntu) as Ubucnt, count(_raw) as rawcnt I can see that the search is running and populating the index with fields named "psrsvd_ct_Chrome" etc. These however appear to be reserved for internal use by Splunk. How can I use this data now that I've added it to the Summary index? Specifically, I want to run a timechart against it. I'm using v4.1.6 ... View more

I'm reviewing debug logs that have some Enter/Exit values for each step of a process. Currently I can calculate the total Transaction duration or the duration of a specific operation within that transaction(Enter/Exit entries), but I'd like to pull these into a single search so that I can calculate the difference in duration from a specific operation vs the total transaction. My problem seems to be related to getting all my fields to final calculation. Only SID & duration of the outside transaction are coming through. Here's my search SomeOperation | transaction SID maxspan=120s maxpause=120s [search host="foo" sourcetype="bar" SID | transaction SID maxspan=120s maxpause=120s | eval total=duration | fields SID, total, _raw] | eval diff=total-duration | fields SID, diff, duration, total Edit: Here's an example of the data I'm looking at: 2010-08-16 12:02:33:221 [26 ] DEBUG SomeApp SID=123 Process: Enter 2010-08-16 12:02:33:221 [26 ] DEBUG SomeApp SID=123 Blah blah blah 2010-08-16 12:02:33:221 [26 ] DEBUG SomeApp SID=123 Blah blah blah 2010-08-16 12:02:33:221 [27 ] DEBUG SomeService SID=123 SomeImportantOperation: Enter 2010-08-16 12:02:34:284 [27 ] DEBUG SomeService SID=123 SomeImportantOperation: Exit 2010-08-16 12:02:35:221 [26 ] DEBUG SomeApp SID=123 Blah blah blah 2010-08-16 12:02:35:221 [26 ] DEBUG SomeApp SID=123 Blah blah blah 2010-08-16 12:02:35:221 [26 ] DEBUG SomeApp SID=123 Process: Exit I basically want to get the duration of the whole group, plus the duration of SomeImportantOperation. This will allow me to calculate a difference between the two and see whether or not SomeImportantOperation is bogging down the whole transaction. (ie What percentage of the transaction is spent in SomeImportantOperation?) My search does appear to be working, but my field 'total' does not appear to be making it out of the subsearch (which causes my 'diff' calculation to fail too). ... View more

The Capacity Planning for Splunk page recommends disks that are: capable of 800 IO operations / second (IOPS) What are some ways that I can measure potential throughput? I might have access to some secondhand hardware, and this would be one of the main criteria I use before accepting it for Splunk use. ... View more

Hi, I'd like to create some dashboards that make use of Sparklines, so that I could explicitly track a number of key performance indicators. I've seen the Community Page that describes how to use jQuery Sparklines to bring this data outside of a Splunk 3.x instance, but it seems like this should be easier to do within the 4.x architecture. I see references to adding custom HTML & CSS in the developer documentation, but not much about adding Javascript. I'm also confused how search results could be serialized into a csv list (necessary for input into the Sparkline library). I'd probably make use of the How to use one search for a whole dashboard page as well. Where would you start? ... View more

I've been using the AmMap Example but I'd like to drilldown on a different field than 'ip'. I'm not sure where I can set this though. Sometimes the field name is different than 'ip' so the drilldown would work better for me if it just searched the raw address instead IE instead of searching: ip=127.0.0.1 search just: 127.0.0.1 Great app BTW! ... View more

Is there a way to set tags based off a wild card value? IE I have the following hosts and I want to apply the 'test' tag to all of them foo1 foo2 foo3 foo4 Right now I think I have to apply a tag to each host individually host=foo1 host=foo2 host=foo3 host=foo4 But what I'd really like is to do something like: host=foo* Is this possible, or is there another way that I can do this (such as with a saved search?) As we provision new hosts, sometimes tagging gets missed, which then causes omissions on searches that use these tags. Just trying to find a good work around. ... View more

Since I updated our server to 4.1.2 I'm seeing the following error with most searches. The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WinEventLog...'. The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WMI:WinEventLog...'. I tried to export lookups as mentioned in this answer, but I think the actual file paths are missing. I think I might need to install a newer version of the Splunk for Windows app? My server is running on Linux. ... View more