Can you enclose your fields with " "? ... View more

Try searching across "All Time" (also "All Time Real Time" if you are continuously sending data) to check if it's a timestamp issue. This might sound trivial...however I have found this to be the issue many times in my experience. ... View more

You could write a data collector script. This script would connect to your vCenter, using the vSphere API, collect the logs using PropertyCollector object, use a callback to check for tasks/events as they are generated (WaitForUpdatesEx), finally use the Splunk SDK to send those logs to your Splunk Instance. At least that's what I did. I used pyvmomi which is a python wrapper around the vSphere SDK. The folowing github page has some helpful examples to get you started: https://github.com/vmware/pyvmomi-community-samples The following link has an example which shows how to use the Splunk SDK for Python to send data into Splunk: http://dev.splunk.com/view/python-sdk/SP-CAAAEE6 This may be sub-optimal. I used this approach a couple of years ago. I am not sure if this is the best way to go about it. -sk ... View more

Have you tried running the command ./splunk reload auth on your search heads and logging in again. Sometimes changes to AD take time to propagate. You might try after a while to see if it works. In any case, try reloading the auth before you try. ... View more

I am not sure if instrumentation at that resolution is possible/enabled. ... View more

Could it be a timestamp issue? Did you try searching over all-time to see if you see any results. This might sound silly...but It has happened many times. ... View more

Thanks for this answer. It was indeed frustrating to debug...thankfully I dropped by your answer. ... View more

I meant a slightly different diff from what you mentioned. I meant diff between last TWO weeks and just last week. Kind of akin to (AUB)-B in set notations. A = current week's hosts, B = last week's hosts, A U B = hosts in the last two weeks. (AUB) - B = hosts in A that weren't present in B. Hope this works out for you. ... View more

Thank you, Kind Sir. This turned out to be trickier than I expected. ... View more

Have you tried using set diff between last two weeks data and last week's data? ... View more

If you have an indexer cluster -> You should have all this info in the Distributed Management Console on the Cluster Master. ... View more

You could extract the log level in a field (if it isn't being done automatically). You could use the Interactive Field Extractor for this, or specify your own props/transforms. Having done so, you could search for log_level = INFO|WARN|ERROR. For version 6.4.0 -> Settings -> Fields -> Field Extractions -> Open Field Extractor You can also search for the events, click on the left most row expansion button, and select "Extract Fields" from the "Event Actions" menu. This should get you started. ... View more

If it's a linux server, Did you disable THP? It's one of the main reasons for slow searches over time. Although it shouldn't result in high cpu (afaik) Ref: https://answers.splunk.com/answers/188875/how-do-i-disable-transparent-huge-pages-thp-and-co.html ... View more

how are you getting the data? Are you getting the data using Splunk App for Windows Infra and hte related addons? In that case, the addon's expect those indexes to be present. If you want to change that behavior, you need to make changes to the add-ons. specifically, the inputs.conf in the addons which specify the index that the data needs to be sent to. If not, please give us more information about how your logs are being collected. ... View more

It means your logs are coming in with a timestamp greater than your local time. You could specify the TZ in props.conf for your sourcetype like so: props.conf [<your sourcetype>] TZ = <time zone of the logs> Ref: http://docs.splunk.com/Documentation/Splunk/6.4.1/data/Applytimezoneoffsetstotimestamps For Time-zone identifiers: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones Also, this is a common issue: https://answers.splunk.com/answers/1650/why-are-log-sent-to-splunk-in-gmt-displayed-in-the-future.html ... View more

what's the format of your logs? can you show some sample events with fields? ... View more

Have you looked at this app? https://splunkbase.splunk.com/app/2665/#/overview ... View more

Did you try sorting by JOBNAME at the end of the populating seach? Just a thought. ... View more

Try this: rex field=<your_field> "([A-Za-z0-9]+_){2}(?<extracted_field>[^.]+.[^$\n ]+)" Disclaimer: This is a lousy regex.Someone will surely swoop in and save the day with an optimal regex. ... View more

You could use the search mentioned in the following answer to create a lookup. https://answers.splunk.com/answers/127844/how-can-i-generate-a-list-of-users-and-assigned-roles.html ... View more

Did you try | transaction PREMISE startswith="ACPwrLoss" endswith="ACPwrLossRes" | timechart avg(duration) by PREMISE ... View more

Getting the obvious out of the way - Are you running the search over the correct time range? Also, you don't really need AND v2>5000 later in the search (I'm guessing it is just an artifact of trail and error). ... View more

Also this from the docs could be an issue since you have > 3 header fields but only 3 fields in each row. Splunk Enterprise only indexes header fields whose rows contain data ... View more