"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
renaming searches, reports and dashboards
Replies to This Discussion
-
Permalink Reply by Dave P on -
I haven't figured out how to rename them, but I did figure out that if you clone them and give them a new name, it's essentially the same thing. If it's not, I haven't discovered the difference yet.
-dave
-
Permalink Reply by Michael Wilde on -
As of version 4.0.6. It is not possible to rename searches from the UI. However, all of splunk's configs are stored in fairly easy to understand config files. Searches, for example, are stored in "savedsearches.conf" (docs page link). Pop in to that file, edit the stanza name for that search. But where is "savedsearches.conf" stored? It depends.
If you are logged in have created/saved a search, by default it should save to $SPLUNK_HOME/etc/users/$USERNAME/$APPNAME/local/savedsearches.conf.
You can see a search object's sharing settings, which should by private by default (meaning, no other user can see/edit your search).
If you want it to be available to everyone within the app it was created in, such as the "search app" just share it.
Now if i share it, and make it available to users within my "App Context" -- and that app being the "search" app, my configuration for that search will actually move from my "user/local" directory to $SPLUNK_HOME/etc/$APPNAME/local/savedsearches.conf
You will likely have to restart your server if you change this configuration file underneath Splunk. There are a few that do not require a restart--this just isn't one of them.
© 2012 Created by Michael Wilde.
