I came across that post when I was looking for a solution for missing logs due to high rate of logging. The solution discussed there was to use the time_before_close attribute. My logger doesn't produce logs continuously. It logs a large chunk of data into the log files every 10 minutes. So I will have to keep the time_before_close to a value slightly more than 10 mins to get good results. Also there are other use cases where I may end up loosing logs even after setting this attribute. That was the reason why I decided to index the zipped files as well. ... View more

Hey, I'm indexing .gz files as well. So if add crcSalt=SOURCE , then I will get duplicate events as every .gz file will be identified as a new file. ... View more

I made a better explanation of my situation here. http://answers.splunk.com/answers/223263/why-is-a-gz-file-created-by-log-rotation-indexed-a.html#comment-223267 As described in the link mentioned above, I think I don't even need to have the crcSalt attribute option as I assume the first 256 bytes of the .log and .log.1.gz are the same and so splunk should skip indexing that .gz file. I have also explained the reason why I have to use crcSalt in the same comment. ... View more

You are right, I asked the wrong question. Even if I don't add crcSalt to this attribute, it shouldn't index the .gz files as I would assume the first 256 bytes of the .log and .log.1.gz are the same. There are couple of things, I think I was not clear about in the question. 1) I have to monitor the zipped (gz) logs as well. This is because I have huge of chunk of data getting logged in test_logs.log and at times the test_logs.log gets rotated even before those events are indexed. Looking into all the zipped files will help prevent the issue of missing logs to a larger extend. 2) Why I included the crcSalt here ? I have another log file called new_log.log (under another monitor) which has the same first 256 bytes as test_log.log. I added crcsalt=new_log for that monitor and crcSalt=test_log in the above monitor as I don't want to miss any one of those logs as splunk can skip indexing the file because of the same first 256 bytes. Even after removing the crcSalt I still see the same issue. ... View more

Thanks for the response. Following is my inputs.conf [monitor:///Users/myusername/Desktop/splunk_monitor_logs] disabled = false followTail = 0 index = my_index sourcetype = test_source crcSalt = test_log ... View more

I'm trying to build a dashboard that performs some operations on the URL en-US/app/app_name/ and I want this dashboard to work on all the apps without trying to change the app name. ... View more

Exactly what I was looking for. Thanks ... View more

Your solution solved my problem. But please do let know if you have a better way to get this done. ... View more

I'm using a splunk app which has a variable that accepts some data in the form of a JSON object (eval app_variable=new_var). What I was trying to do is to convert the data in to a JSON format. Please let me know if you have a better way to do this. ... View more

Thanks MuS, I found a similar post that helped me get into the solution. http://answers.splunk.com/answers/148651/how-to-get-top-2-mb-users-per-website.html ... View more

I think I found a solution to the problem. ...| streamstats count by USER |table ID,CALCULATED_NUM,USER,count| sort by USER,-CALCULATED_NUM| where count<=10 Please let me know if there is straightforward way of doing this. ... View more

I'm not exactly sure why cont didn't work well for me. I solved this issue by doing a sub search that returns the earliest and latest time and use that as the earliest and latest values for the parent search. ... View more

So that is my question. What is the best way to throw an error message ? Following pipe commands shouldn't be executed once the error message is thrown. ... View more

I'm actually more curious to know if there is a way to display the error message. Editing time.conf and a dropdown is not a solution in my use case. ... View more

Thanks for you answer martin I was trying the search string and it looks like streamstats count current=f is adding number in sequential order. ie start_time1: 0 end_time1: 1 start_time2: 2 end_time2: 3 start_time3: 4 end_time3: 5 and not 0's and 1's alternatively. ... View more

Can you please explain what you are trying to do here. ... View more

It will be dynamic. ... View more