Hi, Here is an example to show you how to set it: [default] maxWarmDBCount = 200 frozenTimePeriodInSecs = 432000 rotatePeriodInSecs = 30 coldToFrozenScript = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/bin/myColdToFrozenScript.py" I don't advice you to set this attribut: maxHotSpanSecs By defaults it's set to 7776000 seconds (90 days). NOTE: If you set this too small, you can get an explosion of hot/warm ... View more

Hi, It can't work like that, you most make some changes in your source code: <query> ... </query> is not supported in splunk 5.0 For it to work do like this: Changes this: <search> <query> Write your search </query> <earliest>$global_time_input_tok.earliest$</earliest> <latest>$global_time_input_tok.latest$</latest> </search> By this: <searchString> Write your search </searchString> <earliestTime>$global_time_input_tok.earliest$</earliestTime> <latestTime>$global_time_input_tok.latest$</latestTime> ... View more

Ok. try and let me know if there is something else ... View more

No mention. I'm here to help you solve your problems ... View more

Ok guy, Try this with the commande dedup: ...|stats dc(User_id) by ... | dedup USER_id sortby +_time Or this with commande uniq: index=casm_prod sourcetype=smtrace | bucket _time span=1m | stats count by _time, USER_id | sort - count |uniq ... View more

Hi; At the level of choice of the start time and end time of your summary indexing, instead to use this: start time: -6m end time: -1m Use this start time: -6m@m end time: -1m@m ... View more

Hi, when you create your summary indexing use this search code: index=_internal source=the_source_of_your_logs |table status log_level ... ... View more

Hi, If the token of the check box input is called in others modules it will impact them when the value SearchWhenChanged set to true. To resolved that issue remove the token of the check box input of that module in others modules ... View more

Hi, Here is the search code: index=_internal status=failure OR status=success | timechart c by status ... View more

Hello hindoo. To remove an app that you have created online go in this directory: $SPLUNK_HOME/etc/apps/your_app_name Remove the directory of the application that you want to remove and restart splunk. ... View more

Hi, By default, some logs are in index _internal. so you can send logs that you want in another index. To do that, you must know the source of the logs that you want to send and you must create the index that will receive those logs. If you have all ready done that, run this search: index=_internal source=the_source_of_your_logs |collect index=new_index You can create an alert that will run this search during a given periode ... View more

Thanks spsrasru. If you have anys question just come to me. I'm here to help you. ... View more

Cool spsrasru. Don't be affraid it will work. Don't forget to vote and accept mys answer ... View more

Hi, try this index=your_index_name sourcetype=your_sourcetype_name start_time=* end_time=* event=* | table event start_time end_time ... View more

Hi; add this search code at the end of your query: ...|table crashLog ... View more

Hi, How many members have you in your cluster? Firstly, the value of Replication Factor must be lower or equal to the number of your cluster members secondly, make sure that the values of attributes (Replication Factor and Search Factor) in SOS app are less than attributes (Replication Factor and Search Factor) in your deployment ... View more

Hi, Make sure that there is no application installed on your system that use the port 8089. Restart splunkd with cmt if you are on windows or with terminal if you are on linux ... View more

Hi, when you run your search that produce statisticals results, before saving search as report; click on "Visualisation" and select your type of vizualisation that you want to see. Save now your query as report. ... View more

Hi, The answer of somesoni2 is good but i just want to extend his answer. Because there many values of field "log_level" use this query: index=_internal sourcetype=splunkd log_level=* ... View more

Hi, At the end of your query add this: your_statistical_query|SHOWOTHER=f ... View more

Hi, It's possible to assign token on the search query for $host$. Replace your query by this: "search": "index=_internal source=*metrics.log group=pipeline host=$host$ | stats max(cpu_seconds) as cpu_seconds sum(executes) as executes sum(cumulative_hits) as cumulative_hits by processor" ... View more

Hi, I think that you have not uninstalled it very well. Try this: Do a registry search for the word splunk. Removed any reference to splunk shared DLLs and installer keys If it(s not working, do this: On a computer with the Universal Forwarder installed. Click start->Run->regedit Navigate to HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall Edit->Find then enter splunk In that key you will see the UninstallString. Double click and copy that value. Click start->Run-> cmd at cli right click and paste that value. add /qn at the end of that string to silently uninstall. Ex. for ver 5.0.2.149561 Win7 MsiExec.exe /X{73B67D46-99DB-40C8-9E76-9F870C519257} /qn ... View more