All Topics

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Topics

Hi Team, Could you please help me with the below request? There are two database servers currently being monitored in Appdyanmics.   These two servers are of windows 2012 version.    These two serv... See more...
Hi Team, Could you please help me with the below request? There are two database servers currently being monitored in Appdyanmics.   These two servers are of windows 2012 version.    These two servers will be upgraded from windows 2012 to windows 2019.   Now we need to install appdynamics components on the servers with new version(2019) like DB agent and configuration changes. Please guide me on how to install the appdynamics components and configuration changes. Thanks&Regards Srinivas
Hi there, Search to trigger an alert when the particular job (scheduled jobs) is running more than the threshold time (lets say 5 mins). I have fields to create an alert are Job name (unique),  s... See more...
Hi there, Search to trigger an alert when the particular job (scheduled jobs) is running more than the threshold time (lets say 5 mins). I have fields to create an alert are Job name (unique),  source, source type, index and time. Thanks in Advance, Regards, Theja
Hi, I am trying to concatenate 3 fields into 1 field but I am unable to do so. I tried: and this: Can someone help? There should be a single column of emails with 1 email per... See more...
Hi, I am trying to concatenate 3 fields into 1 field but I am unable to do so. I tried: and this: Can someone help? There should be a single column of emails with 1 email per row. Thanks!
Is it possible to monitor a website URL on a dashboard? and how can i configure this easilly?
is variance inflation factor {VIF} available in splunk mltk app.
I have total 17 orders.  Box Estimates is wrong 6 out of 17 orders. What is the average wrong box estimate in total? This is my attempt who is wrong:   | spath path=data{}.actual_totes{}.f... See more...
I have total 17 orders.  Box Estimates is wrong 6 out of 17 orders. What is the average wrong box estimate in total? This is my attempt who is wrong:   | spath path=data{}.actual_totes{}.finalBoxAmount output=actualBoxes | spath path=data{}.estimated_totes{}.box output=estimatedBoxes | eventstats count AS total | eval box_missing=if(actualBoxes != estimatedBoxes, "YES", "NO") | eval average= (actualBoxes - estimatedBoxes) / total * 100 | table actualBoxes estimatedBoxes total box_missing average    
Looking to use the file-monitoring-extension found on Github. https://github.com/Appdynamics/file-monitoring-extension FileWatcher-3.1.1 Got the extension working on Windows using the Standalone... See more...
Looking to use the file-monitoring-extension found on Github. https://github.com/Appdynamics/file-monitoring-extension FileWatcher-3.1.1 Got the extension working on Windows using the Standalone Machine Agent. Metrics are registered with the Controller and after each MA restart there is only 1 data point for each metric and the all the metrics are 0's after that. Any subsequent restarts only generate 1 data point again, and while accurate there are never any other data points for the metrics. See the screenshots below showing that. There are some Warnings in the MA Log file, but do not seem to be related to the issue we are experiencing. Log and Config file added below also. Hope someone is using this successfully and can offer some input. AppD support do not assist with extensions anymore. Shows data points and how they only have data after a restart All relevant metrics are there, but have no continuous metric s reporting in Logs LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:56,642 INFO SystemAgent - Starting Machine Agent.... LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:56,642 INFO ControllerTimeSkewHandler - Skew Handler is : [enabled]. LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,191 INFO SystemAgent - Full certificate chain validation performed using default certificate file LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,677 INFO ManagedMonitorDelegate - Started Agent Metric Generation Service LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,692 INFO ManagedMonitorDelegate - Event Service is : [enabled]. LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,692 INFO ManagedMonitorDelegate - Initialized with maxPublishQueueLength [2], aggregationFrequencyInMillis [60000] LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,692 INFO ManagedMonitorDelegate - Metric Service is : [enabled]. LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,692 INFO ManagedMonitorDelegate - Started Agent Env Properties Service LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,692 INFO ManagedMonitorDelegate - Scheduled Continuous Task Monitor with frequency [30000]ms LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,692 INFO MonitorConfigReader - Reading monitor config file:C:\AppDynamics\machineagent-bundle-64bit-windows-22.9.0.3458\monitors\analytics-agent\monitor.xml LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,708 INFO MonitorConfigReader - os name [windows 10] version [10.0] LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,708 INFO NodeMonitorManager - Initializing managed monitor [analytics-agent] LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,708 INFO ManagedMonitorDelegate - Not initializing managed monitor [AppDynamics Analytics Agent] - Disabled in configuration file. LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,708 INFO MonitorConfigReader - Reading monitor config file:C:\AppDynamics\machineagent-bundle-64bit-windows-22.9.0.3458\monitors\FileWatcher\monitor.xml LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,708 INFO MonitorConfigReader - os name [windows 10] version [10.0] LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,708 INFO NodeMonitorManager - Initializing managed monitor [FileWatcher] LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,708 INFO ManagedMonitorDelegate - Initializing managed monitor [FileWatcher] LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,708 INFO ManagedMonitorDelegate - Executing managed monitor [FileWatcher], task name [File Watcher Extension Run Task] LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,708 INFO ManagedMonitorDelegate - Task [File Watcher Extension Run Task] for monitor [FileWatcher] is continuous LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO ABaseMonitor - Using File Watcher Version [v3.1.1 Build Date 2020-05-06 17:49:45] LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO ContinuousTaskMonitor - Continuous Task [FileWatcher] Started LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO NodeMonitorManager - Not running legacy system-agent monitor because SIM is enabled. LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO NodeMonitorManager - Not running legacy system-agent monitor because SIM is enabled. LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO NodeMonitorManager - Directory [C:\AppDynamics\machineagent-bundle-64bit-windows-22.9.0.3458\monitors\unmanaged] not found, continuing. LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO AgentMonitorManager - Initialized System Monitor Manager with directory [C:\AppDynamics\machineagent-bundle-64bit-windows-22.9.0.3458\monitors] LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO SystemAgent - Set up agent monitor manager LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO SystemAgent - Orchestration is disabled - disabling one-way agent transport. The agent will not be able to execute workflow tasks. LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO SystemAgentConfigManager - Scheduling configuration refresh at an interval of 60 seconds LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO SystemAgentConfigManager - Configuration refresh task interval is 60 seconds LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,746 INFO SystemAgent - Configuration manager successfully configured LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,761 INFO RunbookHandler - Runbook Operation Execution is : [enabled]. LAPTOP-41O4030E==> [system-thread-0] 06 Oct 2022 10:35:57,761 INFO SystemAgent - Started AppDynamics Machine Agent Successfully. LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:57,761 INFO ABaseMonitor - Started executing File Watcher at 2022-10-06 10:35:57 CAT LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:57,761 INFO ABaseMonitor - Using File Watcher Version [v3.1.1 Build Date 2020-05-06 17:49:45] LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:57,761 INFO PathResolver-File Watcher - Install dir resolved to C:\AppDynamics\machineagent-bundle-64bit-windows-22.9.0.3458 LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:57,846 INFO MonitorContextConfiguration-File Watcher - Loading the contextConfiguration from C:\AppDynamics\machineagent-bundle-64bit-windows-22.9.0.3458\monitors\FileWatcher\config.yml LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,178 INFO ConfigProcessor-File Watcher - Extension config properties file for replacing placeholders not provided LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,193 INFO MonitorContextConfiguration-File Watcher - The metric prefix is initialized as Custom Metrics|File Watcher LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,193 INFO MonitorContext-File Watcher - Charset is windows-1252, file encoding is Cp1252 LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,209 INFO ControllerInfoFactory-File Watcher - The install directory is resolved to C:\AppDynamics\machineagent-bundle-64bit-windows-22.9.0.3458 LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,225 WARN ControllerInfoFactory-File Watcher - Cannot unmarshall the config file from C:\AppDynamics\machineagent-bundle-64bit-windows-22.9.0.3458\conf\controller-info.xml javax.xml.bind.JAXBException: Error while searching for service [javax.xml.bind.JAXBContextFactory] at javax.xml.bind.ContextFinder$1.createException(ContextFinder.java:72) ~[jakarta.xml.bind-api-2.3.3.jar:2.3.3] at javax.xml.bind.ContextFinder$1.createException(ContextFinder.java:69) ~[jakarta.xml.bind-api-2.3.3.jar:2.3.3] at javax.xml.bind.ServiceLoaderUtil.firstByServiceLoader(ServiceLoaderUtil.java:46) ~[jakarta.xml.bind-api-2.3.3.jar:2.3.3] at javax.xml.bind.ContextFinder.find(ContextFinder.java:354) ~[jakarta.xml.bind-api-2.3.3.jar:2.3.3] at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:691) ~[jakarta.xml.bind-api-2.3.3.jar:2.3.3] at javax.xml.bind.JAXBContext.newInstance(JAXBContext.java:632) ~[jakarta.xml.bind-api-2.3.3.jar:2.3.3] at com.appdynamics.extensions.controller.ControllerInfoFactory.fromXml(ControllerInfoFactory.java:114) [?:?] at com.appdynamics.extensions.controller.ControllerInfoFactory.getControllerInfoFromXml(ControllerInfoFactory.java:102) [?:?] at com.appdynamics.extensions.controller.ControllerInfoFactory.initialize(ControllerInfoFactory.java:59) [?:?] at com.appdynamics.extensions.conf.modules.ControllerModule.initController(ControllerModule.java:54) [?:?] at com.appdynamics.extensions.conf.MonitorContext.initialize(MonitorContext.java:85) [?:?] at com.appdynamics.extensions.conf.MonitorContextConfiguration.setConfigYml(MonitorContextConfiguration.java:80) [?:?] at com.appdynamics.extensions.ABaseMonitor$1.onFileChange(ABaseMonitor.java:132) [?:?] at com.appdynamics.extensions.conf.modules.FileWatchListenerModule.createListener(FileWatchListenerModule.java:52) [?:?] at com.appdynamics.extensions.conf.MonitorContextConfiguration.registerListener(MonitorContextConfiguration.java:146) [?:?] at com.appdynamics.extensions.ABaseMonitor.initialize(ABaseMonitor.java:122) [?:?] at com.appdynamics.extensions.ABaseMonitor.execute(ABaseMonitor.java:186) [?:?] at com.singularity.ee.agent.systemagent.components.monitormanager.managed.MonitorTaskRunner.runTask(MonitorTaskRunner.java:149) [machineagent.jar:Machine Agent v22.9.0-3458 GA compatible with 4.4.1.0 Build Date 2022-09-28 07:21:43] at com.singularity.ee.agent.systemagent.components.monitormanager.managed.ContinuousTaskRunner.run(ContinuousTaskRunner.java:50) [machineagent.jar:Machine Agent v22.9.0-3458 GA compatible with 4.4.1.0 Build Date 2022-09-28 07:21:43] at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?] at java.util.concurrent.FutureTask.run(Unknown Source) [?:?] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) [?:?] at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?] at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?] at java.lang.Thread.run(Unknown Source) [?:?] Caused by: java.util.ServiceConfigurationError: javax.xml.bind.JAXBContextFactory: Provider com.sun.xml.bind.v2.JAXBContextFactory not found at java.util.ServiceLoader.fail(Unknown Source) ~[?:?] at java.util.ServiceLoader$LazyClassPathLookupIterator.nextProviderClass(Unknown Source) ~[?:?] at java.util.ServiceLoader$LazyClassPathLookupIterator.hasNextService(Unknown Source) ~[?:?] at java.util.ServiceLoader$LazyClassPathLookupIterator.hasNext(Unknown Source) ~[?:?] at java.util.ServiceLoader$2.hasNext(Unknown Source) ~[?:?] at java.util.ServiceLoader$3.hasNext(Unknown Source) ~[?:?] at javax.xml.bind.ServiceLoaderUtil.firstByServiceLoader(ServiceLoaderUtil.java:39) ~[jakarta.xml.bind-api-2.3.3.jar:2.3.3] ... 22 more LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,240 WARN CryptoUtils-File Watcher - The password has not been set properly. Using empty password. LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,240 INFO ControllerModule-File Watcher - Initialized ControllerInfo LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,247 ERROR ControllerInfoFactory-File Watcher - The following properties [username, password, account, controllerHost, controllerPort, controllerSslEnabled, simEnabled, applicationName, tierName, nodeName] failed to resolve. Please add them to the 'controllerInfo' section in config.yml LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,247 WARN ControllerModule-File Watcher - ControllerInfo instance is not validated and resolved.....the ControllerClient and ControllerAPIService are null LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,247 INFO HttpClientModule-File Watcher - The httpClient is not initialized since the [servers] are not present in config.yml LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,247 INFO MonitorExecutorServiceModule-File Watcher - Initializing the ThreadPool with size 20 LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,363 INFO MetricCharSequenceReplaceModule-File Watcher - MetricCharSequenceReplacer initialized successfully LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,363 INFO EventsServiceModule-File Watcher - Events Service parameters not set for monitor: File Watcher. Skipping LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,363 INFO HealthCheckModule-File Watcher - Running extension health checks LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,363 INFO PathResolver-File Watcher - Install dir resolved to C:\AppDynamics\machineagent-bundle-64bit-windows-22.9.0.3458 LAPTOP-41O4030E==> [pool-10-thread-1] 06 Oct 2022 10:35:58,410 INFO MonitorHealthCheck-File Watcher - Running monitor health checks LAPTOP-41O4030E==> [pool-10-thread-1] 06 Oct 2022 10:35:58,410 INFO AppTierNodeCheck-File Watcher - Starting AppTierNodeCheck LAPTOP-41O4030E==> [pool-10-thread-1] 06 Oct 2022 10:35:58,410 ERROR MonitorHealthCheck-File Watcher - Exception when running com.appdynamics.extensions.checks.AppTierNodeCheck@25abf5aa java.lang.NullPointerException: null at com.appdynamics.extensions.checks.AppTierNodeCheck.check(AppTierNodeCheck.java:54) ~[?:?] at com.appdynamics.extensions.checks.MonitorHealthCheck.validate(MonitorHealthCheck.java:62) [?:?] at com.appdynamics.extensions.checks.MonitorHealthCheck.run(MonitorHealthCheck.java:90) [?:?] at com.appdynamics.extensions.executorservice.MonitorThreadPoolExecutor$TaskRunnable.run(MonitorThreadPoolExecutor.java:113) [?:?] at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?] at java.util.concurrent.FutureTask.run(Unknown Source) [?:?] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) [?:?] at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?] at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?] at java.lang.Thread.run(Unknown Source) [?:?] LAPTOP-41O4030E==> [pool-10-thread-1] 06 Oct 2022 10:35:58,410 INFO ExtensionPathConfigCheck-File Watcher - Starting ExtensionPathConfigCheck LAPTOP-41O4030E==> [pool-10-thread-3] 06 Oct 2022 10:35:58,410 INFO MachineAgentAvailabilityCheck-File Watcher - Starting MachineAgentAvailabilityCheck LAPTOP-41O4030E==> [pool-10-thread-2] 06 Oct 2022 10:35:58,410 INFO MetricLimitCheck-File Watcher - Starting MetricLimitCheck LAPTOP-41O4030E==> [pool-10-thread-2] 06 Oct 2022 10:35:58,410 INFO PathResolver-File Watcher - Install dir resolved to C:\AppDynamics\machineagent-bundle-64bit-windows-22.9.0.3458 LAPTOP-41O4030E==> [pool-10-thread-1] 06 Oct 2022 10:35:58,410 ERROR MonitorHealthCheck-File Watcher - Exception when running com.appdynamics.extensions.checks.ExtensionPathConfigCheck@a7efa1b com.appdynamics.extensions.util.AssertUtils$ValidationException: The ControllerAPIService is null at com.appdynamics.extensions.util.AssertUtils.assertNotNull(AssertUtils.java:31) ~[?:?] at com.appdynamics.extensions.checks.ExtensionPathConfigCheck.check(ExtensionPathConfigCheck.java:57) ~[?:?] at com.appdynamics.extensions.checks.MonitorHealthCheck.validate(MonitorHealthCheck.java:62) [?:?] at com.appdynamics.extensions.checks.MonitorHealthCheck.run(MonitorHealthCheck.java:90) [?:?] at com.appdynamics.extensions.executorservice.MonitorThreadPoolExecutor$TaskRunnable.run(MonitorThreadPoolExecutor.java:113) [?:?] at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?] at java.util.concurrent.FutureTask.run(Unknown Source) [?:?] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) [?:?] at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?] at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?] at java.lang.Thread.run(Unknown Source) [?:?] LAPTOP-41O4030E==> [pool-10-thread-3] 06 Oct 2022 10:35:58,410 ERROR MonitorHealthCheck-File Watcher - Exception when running com.appdynamics.extensions.checks.MachineAgentAvailabilityCheck@7df807ed com.appdynamics.extensions.util.AssertUtils$ValidationException: The ControllerAPIService is null at com.appdynamics.extensions.util.AssertUtils.assertNotNull(AssertUtils.java:31) ~[?:?] at com.appdynamics.extensions.checks.MachineAgentAvailabilityCheck.check(MachineAgentAvailabilityCheck.java:65) ~[?:?] at com.appdynamics.extensions.checks.MonitorHealthCheck$1.run(MonitorHealthCheck.java:75) [?:?] at com.appdynamics.extensions.executorservice.MonitorThreadPoolExecutor$TaskRunnable.run(MonitorThreadPoolExecutor.java:113) [?:?] at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?] at java.util.concurrent.FutureTask.runAndReset(Unknown Source) [?:?] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) [?:?] at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?] at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?] at java.lang.Thread.run(Unknown Source) [?:?] LAPTOP-41O4030E==> [Worker-1] 06 Oct 2022 10:35:58,579 INFO DerivedMetricsModule-File Watcher - The DerivedMetricsCalculator is not initialized. Config: #For shared directories on windows the path should be like # path: "\\\\1.2.3.4\\abc\\def\\ProductI #Use this metric prefix when SIM is enabled. metricPrefix: "Custom Metrics|File Watcher|" # To find the <COMPONENT_ID> in your environment, please follow the screenshot https://docs.appdynamics.com/display/LATEST/Build+a+Monitoring+Extension+Using+Java #metricPrefix: "Server|Component:<Component_ID OR Component_Name>|Custom Metrics|File Watcher|" pathsToProcess: #Matching only the configured directory - displayName: "TestPath2 MA_OLD - Specific Directory" path: "C:\\\\AppDynamics\\\\OLD_machineagent-bundle-64bit-windows-21.2.0.3052\\\\logs" ignoreHiddenFiles: true excludeSubdirectoriesFromFileCount: false recursiveFileCounts: false recursiveFileSizes: true #Matching a specific file - displayName: "TestPath3 Logs- Specific File" path: "C:\\\\AppDynamics\\\\machineagent-bundle-64bit-windows-22.9.0.3458\\\\logs\\\\machine-agent.log" ignoreHiddenFiles: true excludeSubdirectoriesFromFileCount: false recursiveFileCounts: false recursiveFileSizes: true metrics: fileSize: alias: "File Size (Bytes)" multiplier: 1 delta: false aggregationType: "Average" timeRollupType: "Average" clusterRollupType: "Individual" oldestFileAge: alias: "Oldest File Age" multiplier: delta: aggregationType: timeRollupType: clusterRollupType: fileCount: alias: "File Count" multiplier: delta: aggregationType: timeRollupType: clusterRollupType: numberOfLines: alias: "Number of Lines" multiplier: delta: aggregationType: timeRollupType: clusterRollupType: lastModifiedTime: alias: "Last Modified Time" multiplier: delta: aggregationType: timeRollupType: clusterRollupType: available: alias: "Available" multiplier: delta: timeRollupType: clusterRollupType: convert: "true": 1 "false": 0 # A metric to view the count of files in a directory and all its subdirectories. #Set recursiveFileCounts to true for any configured paths to see this metric. Will only work for directories. recursiveFileCount: alias: "Recursive File Count" multiplier: delta: timeRollupType: clusterRollupType: modified: alias: "Modified" multiplier: delta: timeRollupType: clusterRollupType: convert: "true": 1 "false": 0 recursiveFileSize: #Calculates the size of a directory on disk alias: "Size on Disk (Bytes)" multiplier: delta: timeRollupType: clusterRollupType: numberOfThreads: 20 #One thread per base directory + 1 # The sections [customDashboard] and [controllerInfo] need to be enabled for uploading dashboard to the controller UI customDashboard: enabled: false dashboardName: "File Watcher Dashboard" # Update the path to the dashboard file. pathToSIMDashboard: "monitors/FileWatcher/SIMDashboard.json" pathToNormalDashboard: "monitors/FileWatcher/APMDashboard.json" periodicDashboardCheckInSeconds: 300 # If any of the following fields are not set, the values of the specific fields are set from the system properties of the corresponding fields as specified in the comments. # If the system properties are not set for the field, then the data is retrieved from machine agent configFile. Please refer to ControllerInfoFactory for more details. enableHealthChecks: true # If not set, will be retrieved from "-Dappdynamics.agent.monitors.healthchecks.enable=true". Defaults to true.
We have 300 applications. Is there any way we can fetch the reports with following kind of aggregations. Want to run these aggregations at the server side as we are looking at the data for longer dur... See more...
We have 300 applications. Is there any way we can fetch the reports with following kind of aggregations. Want to run these aggregations at the server side as we are looking at the data for longer durations, it may need to process giga bites of data. Is there any way we can configure the config file with these kinds of calculations? max, min and average response times of all the applications for the last six months. Count of different kind of events grouped by even type for the last six months. All the dependent entities at different tiers with entity types. Count of calls to and from the applications, grouped by protocol, type, etc.
Hi, Customer is looking for attack surface management using Splunk. Is there any way around to achieve this if yes how this could be achieved in terms of any app/add-on or 3rd party solution? Your ... See more...
Hi, Customer is looking for attack surface management using Splunk. Is there any way around to achieve this if yes how this could be achieved in terms of any app/add-on or 3rd party solution? Your answer would really be appreciated. Thanks in advance
  How to create an alert that should monitor logs of particular message.
Hi I am looking for query where say for example user=xyz which is present in multiple watchlists [watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv] and not present in watchlist_E... See more...
Hi I am looking for query where say for example user=xyz which is present in multiple watchlists [watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv] and not present in watchlist_E.csv, watchlist_F.csv watchlist have columns [ number, user, date ]      1, xyz, 01022000       2, abc, 02022000   I am looking for query to use multiple watchlist and find value of my search say user=abc when queried should show a table as below  user, watchlistNames If result is present in multiple table it should give me the watclistnames where my search is user=abc and is present in watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv so my query result should be user, Watchlistnames abc,watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv
Hi Splunkers,   How to change the threat intelligence Function  time interval  in Splunk ES. currently , I'm getting the information downloaded every 24h, is it possible to change the time interv... See more...
Hi Splunkers,   How to change the threat intelligence Function  time interval  in Splunk ES. currently , I'm getting the information downloaded every 24h, is it possible to change the time interval of it. And How to check the downloaded history of it.
Hello Splunker! I created below regex from the raw events. And I want to create an alert which show the event in one cloumn only. | rex field=_raw "Site\|\_\_SYSTEM\__(?<ServiceName>[A-Za-z]+)" |... See more...
Hello Splunker! I created below regex from the raw events. And I want to create an alert which show the event in one cloumn only. | rex field=_raw "Site\|\_\_SYSTEM\__(?<ServiceName>[A-Za-z]+)" | rex field=_raw "Message\s\=\s(?<Error_Message>.+\:\s[A-Za-z0-9]+)" | rex field=_raw "failed:\s(?<OrderNumber>[A-Za-z0-9]+)" | rex field=_raw "httpStatusCode\s\=\s(?<ResponseTime>[0-9]+)" | rex field=_raw "ResponseTime\s\=\s(?<Reason>.+)" By using all the fields i want one liner column result like . Please let me know how to concate and use makemv command. And if any other approach then please guide me. ServiceName Error_Message OrderNumber Reason ResponseTime  
Short description: When a consumer orders groceries online, I provide the picker—the individual who picked the foods based on the order—with an estimated box that will be needed for that order and t... See more...
Short description: When a consumer orders groceries online, I provide the picker—the individual who picked the foods based on the order—with an estimated box that will be needed for that order and that data is stored in a database. The functionality of the Estimated box generally works, although occasionally it fluctuates. It may be greater or lesser. Actual box use data will be stored in data if the picker adds more or fewer boxes than necessary for the order. Actual data box never store in database if approximated functionality works. Expected output:  1. I want find out how much Percentage/Average of actual values missing. I am not sure how to evaluate null/defined Actual boxes. This is my attempt not sure is it correct:       | spath path=data{}.actual_totes{}.finalBoxAmount output=finalBoxes | spath path=data{}.estimated_totes{}.box output=estimatedBox | stats sum(estimatedBox) as totalEstimatedBox, sum(finalBoxes) as totalFinalBoxes | eval diff =( totalFinalBoxes - totalEstimatedBox) * 100 / totalFinalBoxes | table diff       This is my data splunk data table image. As you can see in splunk table  some my actual boxes value is null/undefined/emptyObject(not sure).  In splunk JSON, this is how I get actual_totes: { } data: { actual_totes: { }, estimated_totes: { box: 4 } } PS: I'm a rookie with Splunk, thus my grasp of its syntax is limited. Please walk me through how to display the value in a PIE chart. Pie chat had the following value: Estimated Boxes, Real Boxes used, and missing actual numbers in Percentage %. Thank you.
One dashboard was made by me. I'm showing my colleagues my dashboard. Problem: When my coworkers or I access that Splunk dashboard link(clean the cookies), the edit dashboard mood screen immediately ... See more...
One dashboard was made by me. I'm showing my colleagues my dashboard. Problem: When my coworkers or I access that Splunk dashboard link(clean the cookies), the edit dashboard mood screen immediately appears. I merely want to showcase mood; I don't want to edit mood. PS: I alone may provide permission; others cannot.
Hi, I am a student and new to Splunk. I really need help creating a table like this: The goal is to detect different users that authenticated using same clientIP, different httpmethod, different st... See more...
Hi, I am a student and new to Splunk. I really need help creating a table like this: The goal is to detect different users that authenticated using same clientIP, different httpmethod, different status codes, and its equivalent sessionid. I used the below query, which yielded no results.   index=* sourcetype=* httpmethod=* httpstatus=* | table clientip,httpmethod,statuscode,sessionid | eval mv_field = clientip.”,”.httpmethod”,”.statuscode”,”.sessionid | makemv delim=”,” mv_field | table mv_field   clientIP HTTPMETHOD STATUS CODE SESSION clientIP 1 GET POST HEAD 200s 400s 300s 500s sessionid clientIP 2 POST 400s 200s sessionid clientIP 3 GET POST 200S sessionid
Hello I am a bit unclear from the readings the meaning of  'latest_day and 1 day_ before'. I have attached a screen shot where I am comparing a particular event that occurred over 7 days.  N... See more...
Hello I am a bit unclear from the readings the meaning of  'latest_day and 1 day_ before'. I have attached a screen shot where I am comparing a particular event that occurred over 7 days.  Now if I want to compare say   'latest_day and 1 day_ before'. : is latest like yesterday and 1day_ before is the 4th October? I am confused. My query:  index="AB" earliest=-8d@d latest=@d | search status="OTP_REQUIRED" | timechart span=1h count | timewrap d |  fields _time latest_day, 1day_before ( when I want to compare days) Thankyou
We are new to splunk and we are trying to find about all the vast capabilities that splunk offers. So here is the scenario. We have a repository that contains100s of zip files that are accessible t... See more...
We are new to splunk and we are trying to find about all the vast capabilities that splunk offers. So here is the scenario. We have a repository that contains100s of zip files that are accessible through a network share. Within these zip files contains a csv file that contains the data we need to ingest. So the question is, is it possible for splunk to ingest just the csv within these individual zip files without having to unzip the entire archive first.
I'd like to save splunk dashboard with mouseover effects (it shows the data when I hover over the graph). How can this be done? When I save it as HTML using chrome and 2 other chrome extensions ... See more...
I'd like to save splunk dashboard with mouseover effects (it shows the data when I hover over the graph). How can this be done? When I save it as HTML using chrome and 2 other chrome extensions (save page we, save page offline), it doesn't have the mouse over effect:    Note: when inspecting the page, it doesn't show any console errors.
Hello, I have to manipulate some data from an api, and send those events to splunk. One set of the api has to go to a normal index, but a subset of the data has to go to a metrics index, which is d... See more...
Hello, I have to manipulate some data from an api, and send those events to splunk. One set of the api has to go to a normal index, but a subset of the data has to go to a metrics index, which is defined as an input in the add-on configuration.   However, when I try to send events to the metrics, I don't get anything showing up there. I have tried the following: Prepending "metric_name:" to the field name for the metric Making a new add-on to only send data to metrics (very simple create an event and send it) In that same add-on, create the event, and send it to the index defined in the config, and defined my metrics index in that config None of these worked. Is there a special way to send these to metrics indexes?