Top

Category Activity

Search events against a lookup table and show matching count Hey Guys, I am trying to figure out an approach to a problem I have, I have my firewall sending logs to splunk which... by jerrad Path Finder in Security 09-10-2010 1 2	1	2
How to perform a division between subresults Hi all, I would like to perform the following each result returned by source="wmi:cputime" daysago=30 \| where Perc... by rootto Explorer in Splunk Search 09-10-2010 0 4	0	4
Splunk stop with SplunkLightForwarder turned on takes.....forever! Why? I have SplunkLightForwarder turned on for AIX and Linux (Suse) and when initiating a Splunk stop it takes 5-10 minute... by MasterOogway Communicator in Splunk Cloud Platform 09-10-2010 0 6	0	6
Is it possible to preserve original order of events? Would someone kindly confirm if Splunk is expected to preserve the order of events as they are presented in the origi... by hulahoop Splunk Employee in Getting Data In 09-10-2010 3 7	3	7
Forwarding using a UDP port Can the forwarding port be set to a UDP port? Tried changing the type to UDP in the outputs.conf file, but Splunk ke... by kmille2 Explorer in Getting Data In 09-10-2010 1 2	1	2
maxfiles in limits.conf I can see the maxfiles parameter in $SPLUNK_HOME/etc/system/default/limits.conf for Splunk 4.1.4 , but it is not desc... by mzorzi Splunk Employee in Monitoring Splunk 09-10-2010 2 1	2	1
How can I limt my search results to the first event returned? How can I limit my search results to the first event returned? I am trying to define a transaction that starts with ... by ericrobinson Path Finder in Splunk Search 09-10-2010 0 4	0	4
Scheduled Summary Index searches not firing on time We use summary indexing to improve search performance and to avoid unnecessary lookups and field extractions. It is s... by stephanbuys Path Finder in Knowledge Management 09-10-2010 1 6	1	6
Create semaphore with splunk Hi all i need to create a graph like a semaphore green between 2 values yellow between other 2 values red over a valu... by pinzer Path Finder in Splunk Search 09-10-2010 1 4	1	4
separating many similar files into different indexes I have a tree of files that looks something like the following: /var/log/able/access.log /var/log/baker/access.log /... by mfrost8 Builder in Getting Data In 09-10-2010 0 8	0	8
Setting up forwarder from CLI problem Hi, I'm experiencing problems when configuring SSL forwarder from CLI. My questions are: Is it enough to move output... by gljiva Path Finder in Deployment Architecture 09-10-2010 0 2	0	2
Running a script in another user context Hello, My splunk server belongs to a different domain with a trust set up. I have a python script that does some Ac... by kholleran Communicator in Getting Data In 09-10-2010 0 7	0	7
Apps packaged in splunk rpm have invalid permissions? We have installed splunk instances on our servers to be used as forwarders. We use the deployment client/server to p... by christopherutz Path Finder in Deployment Architecture 09-09-2010 1 2	1	2
Can the UI display the time stamp of my events in another format than MM/DD/YYYY? The UI is displaying the time stamp of my events in US format (MM/DD/YYYY), but I would like the time format to be di... by hexx Splunk Employee in Getting Data In 09-09-2010 5 2	5	2
search error for sendemail Dear I search cmd: sourcetype="access_combined" clientip="192.0.1.42" \| sendemail to="teng.johnny@msa.hinet.net" fo... by johnnyt New Member in Alerting 09-09-2010 0 1	0	1
Combining Multiple Fields in Charting Given a data set with events that fall into X categories and Y subcategories, can I display a chart that shows a colu... by blurblebot Communicator in Splunk Search 09-09-2010 0 2	0	2
Compressed data from forwarder to indexer I'm having some trouble getting this working. I've tried both the regular forwarder as well as the light forwarder. ... by Eli_Klein Explorer in Getting Data In 09-09-2010 0 2	0	2
/var/tmp files seem to be created by Splunk. Why? Any gurus know why there are files created in /var/tmp/ folder by Splunk? splunk@splunk:/var/tmp> more ddtb553596446... by clyde772 Communicator in Getting Data In 09-09-2010 0 2	0	2
Scripted Input failing, runs fine when run manually Hello, I have a scriped input that is throwing an error: ERROR ExecProcessor - message from ""MyScript.bat"" python... by kholleran Communicator in Splunk Search 09-09-2010 0 4	0	4
Licensing error reported in splunkd.log on LWF's - "ERROR LicenseManager - License expired or over limit. Blocking search until this is resolved." We have the splunk LWF service installed on 100 (ish) vm's that should all be passing traffic to our indexers. All th... by mctester Communicator in Installation 09-09-2010 1 1	1	1
datetime.xml filename timestamp !?! Hello, I am trying to extract the timestamp from the filepath of my log files. I've read and followed variations of... by jamesbaud Engager in Splunk Search 09-09-2010 4 2	4	2
Sudden spike in indexed data. How to narrow down The amount of data I index daily is pretty consistent for the most part. I suppose it's gradually increasing, but no ... by Branden Builder in Getting Data In 09-09-2010 3 5	3	5
Load Saved Results via CLI Does anyone know how to load saved results from a previous search via CLI command? The documentation suggests that w... by clincg Path Finder in Splunk Search 09-09-2010 1 1	1	1
Is it possible to hide _raw from a search result? The data I'm sending to my Splunk Index is made of a number of KV records. A subset of a record data looks like: tra... by mzorzi Splunk Employee in Splunk Search 09-09-2010 4 2	4	2
Put Data in Separate Index Based on Timestamp II I know this Question has been asked before (http://answers.splunk.com/questions/712/put-data-in-separate-index-based-... by chris Motivator in Splunk Search 09-09-2010 0 11	0	11