Hi, I am creating a splunk alert trigger script which parses the output csv file. I am having a problem because the result file keeps disappearing. The trigger passes in the full path to csv file as one of the parameters. Sometimes my script is fast enough to read the file before it disappears, and sometimes it results in file not found. Why is that happening? C://Program Files//Splunk//var//run//splunk//dispatch//rt_scheduler__admin__search__RMD5d51449b036e37dfe_at_1367973103_9662.290//results.csv.gz Thanks ... View more

I have a field extracted from log entries, containing time values in GMT. Can I convert the field to PST time? If so, how can I accomplish that? stats values(SearchUser) as User values(SearchStartDate) as "Start" values(SearchEndDate) as "End" by Project, SearchID SearchStartDate and SearchEndDate need to be converted to PST. ... View more

I am creating a failed login report from WMI security log entires. My temporary search command looks like: sourcetype="WMI*Security" Type="Audit Failure" Account_Name=* | stats values(Account_Name) values(Client_Address) values(Client_Port) by _time Client_Address values are IP addresses, and I would like them to be displayed as the host name. How can I accomplish that? FYI, I have already read the article on Lookup command to resolve IP to Host. http://docs.splunk.com/Documentation/Splunk/4.2.2/Knowledge/Addfieldsfromexternaldatasources And I am having trouble understanding how to set it up and make use of it in my search. Really appreciate any help. Thanks! ... View more

Hello: My system log files are in GMT, as well as the Splunk forwarder and Splunk server. They are all in GMT (or UTC) However, my Splunk users are in PST time zone. So, I would like the splunk searches, reports and alerts to display the charts and tables in PST time. How can I accomplish that? Thank you! ... View more

I have a silly question. I found this from docs.splunk.com but how do I configure it so that Splunk can get event logs from all hosts? Right now it's just grabbing security events from the forwarder but not any other servers. [WinEventLog:Security] disabled = 0 start_from = newest evt_dc_name = evt_dns_name = evt_resolve_ad_obj = 1 checkpointInterval = 5 ... View more

I extracted the host names wrong, and now I have extra names in my Splunk. Example: Server01 vs. Server1 and Server02 vs. Server2, etc. What's the best way to fix this so I only have Server01, Server02, etc.? Delete? Rename? Any suggestions? Thanks! ... View more

I would like to draw a line time chart that shows both real values and avg values of Search Time. When I do timechart avg(SearchTime) values(SearchTime) only avg works. When I do table _time "SearchTime" only real values show. How can I put them together on a chart? Thanks! ... View more

I have extracted a field that represents how long a process takes. The values looks like 1.0435, 2.242, 234.23435, etc. Using rex, the values are stored as string, so I use convert auto(timetaken). Though it seems to convert it to number, I couldn't get the where clause to work. I searched for where timetake>1, and I got much fewer results than I expected. Please help. Thanks. Here is my search syntax. sourcetype="Engine Logs" done save | rex field=_raw ".*in (?<TimeTaken>[0-9\.]+) seconds.*SERVER\.(?<Server>.*)\.Engine" | convert auto(TimeTaken) | stats values(TimeTaken) as TimeTaken by Server | search TimeTaken>1 ... View more