I have a Splunk license usage report scheduled on a monthly basis, (usage by host on a daily basis) Usage details per host: index=_internal source=*license_usage.log* type=Usage | eval s=if(s=="","unknown",s) | eval h=if(h=="","unknown",h) | timechart span=1d sum(b) AS volume_b by h Great. Here, I am able to get the Splunk License usage consumption per host on a daily basis, but I do see for some days, the values are blank (neither '0'). Does this mean: The hosts haven't connected to the license master ? The hosts haven't sent any logs to the indexer for indexing ? Your kind reply is much helpful. Thanks. ... View more

I have configured a firewall device (Cisco) to send logs to my splunk indexer . I receive events in the device timezone (Eg: Timezone : JST (Japan) each events have timestamp) I am searching events in splunk search head (indexer,search head in UTC Timezone). say Last 15 min -- which means splunk server time last 15 min. i.e. UTC . where i will not see the device logs here. Later I re-configure my cisco device to UTC timezone. Now , I can search logs for the device in UTC timezone. Does the older logs in JST time is still remains in same format (JST) OR it configures to UTC timezone ? ... View more

I am using a Heavy Forwarder to monitor cisco-asa logs. I have 10 cisco-asa firewalls, writing their logs to 10 different syslog files (using syslog log server Eg: 10.0.0.1.log , 10.0.0.2.log ,etc) I am monitoring all the files, using inputs.conf (monitor stanza) Only 3 devices logs are monitored. I am unable to search the other logs from the search head. I'm seeing the error below on the heavy forwarder -splunkweb (Tcp output pipeline blocked. Attempt '1400' to insert data failed.) Files are continually open for writing. Files grow to a certain size and then roll to .tgz format. New files are open for writing. ... View more

I was just trying to use the same example javascript and css with different search query, but i'm not able to get the rows colored. Please help in this. Trial.js require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { // Row Coloring Example with custom, client-side range interpretation var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { // Enable this custom cell renderer for both the Age and the State field return _(['Age', 'State']).contains(cell.field); }, render: function($td, cell) { // Add a class to the cell based on the returned value var value = parseFloat(cell.value); // Apply interpretation for number of historical searches if (cell.field === 'Age') { if (value > 2) { $td.addClass('range-cell').addClass('range-elevated'); } } // Apply interpretation for number of realtime searches if (cell.field === 'State') { if (value > 1) { $td.addClass('range-cell').addClass('range-severe'); } } // Update the cell content // $td.text(value.toFixed(2)).addClass('numeric'); } }); mvc.Components.get('Trial').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row tableView.$el.find('td.range-cell').each(function() { $(this).parents('tr').addClass(this.className); }); }); // Force the table to re-render tableView.table.render(); }); }); Trial.css /* Row Coloring */ #highlight tr td { background-color: #c1ffc3 !important; } #highlight tr.range-elevated td { background-color: #ffc57a !important; } #highlight tr.range-severe td { background-color: #d59392 !important; } #highlight .table td { border-top: 1px solid #fff; } #highlight td.range-severe, td.range-elevated { font-weight: bold; } XML: <dashboard script="Trial.js" stylesheet="Trial.css"> <label>Trial</label> <row> <table id="Trial"> <title>Trial</title> <search> <query>source="Trial.csv" host="10.0.255.247" sourcetype="csv"|table Timestamp User Age State</query> <earliest>-24h</earliest> </search> <option name="drilldown">none</option> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </table> </row> </dashboard> ... View more

WARN: Search filters specified using splunk_server/splunk_server_group do not match any search peer. Possibilities : relax the primary search criteria -> (index=* doesnt work) widen the time range of the search ->(time range chosen in 'all time') check that the default search indexes for your account include the desired indexes -> (admin role -> using default settings) what could be the cause ? Splunk version: Splunk 6.0.4 (build 207768) Role : License master servers Slaves version: Splunk 6.2.1 (build 245427) ... View more