Sending things to the nullQueue can only happen at parse time. You might consider tuning down some of the "interval" settings in wmi.conf, however ... View more

Looking through limits.conf, I don't see much limiting of the [restapi] group, sadly. ... View more

I'm not sure I understand your question. The REST URL of the target server would be the splunkd port on that server. Accessing it via RESTful call would just be accessing the desired endpoint, regardless of what client you're on. ... View more

Not without more information. The filename would most likely be application.css, but the application context is what I wouldn't know. That depends upon where you created your form, whether as part of the default app set (search and lancher apps are common locations for user-generated content), or as part of your own application. Within that application, there would be an 'appserver' subdirectory, and your changes to the CSS would reside in that directory. ... View more

I wonder whether this is an issue with bundle replication. Try having a look at the questions in this post (i.e., are you seeing the same error message?). You can look for bundles in the target machine's $SPLUNK_HOME/var/run/searchpeers to see if it's arriving there. There should be a .bundle file, as well as an unpacked directory with its contents. ... View more

You'd want to alter the CSS in 'application.css' for the relevant app (e.g. 'search'). Firebug (or other page inspection tools) can help you find which keys to alter. More information can be found here (Splunk.com). ... View more

It might be the \s+ at the beginning tripping up the regex. You might also consider adding a TIME_PREFIX to give Splunk a leg up on guessing the proper format for your events. Another possibility is that your time stamp string might be past the default "how far ahead do I look?" limit. That default is 150 characters, and is set by MAX_TIMESTAMP_LOOKAHEAD in props.conf. Finally, if the event stream for this event contains other events that are in say, standard syslog format, with a timestamp at the leading position in the line, Splunk might "home in" on that timestamp format, preferring it over the one you've specified here. In general, you should try to group events with similar timestamp formats into like inputs. That is, if events A B and C all go into the same file monitored by inputs.conf, and only type C has the "different" timestamps, Splunk choose the format of events A and B, but be confused by C. You might have to resort to a search-time extraction, if this is the case. ... View more

Assuming a client_lookup.csv like: client_id,Name 20006,Client A You could do something like: type="REST" resource="Order" status="FINISHED" | bucket span=1d _time | stats count by client_id, _time | lookup client_lookup.csv client_id OUTPUT Name No join needed. ... View more

So is there some window in which telnet splunkserver 9997 does work? ... View more

Firewalls in play? ... View more

I would use SHOULD_LINEMERGE = true, treat the whole thing as one event, then you can rex it as a single multi-line event. Yeah, that's ugly, and your regex would be something like Message\sContent.*(?<content_containers>\d+)\sof\s(?<content_containers_max>\d+)... ... View more

The original log event looks something like this: Apr 30 00:48:25 "ip_address" Apr 30 2012 00:48:25: %ASA-4-113019: Group = "Group", Username = "User", IP = "ip_address", Session disconnected. Session Type: SSL, Duration: 1h:59m:24s, Bytes xmt: 86659734, Bytes rcv: 4557700, Reason: User Requested By default, Splunk will do automatic Key=Value extraction, meaning that in this case, it will only find Group, Username, and IP. You'll have to write field extraction rules to collect the other values from the log event. ... View more

I've done a bit of digging on this myself, comparing the uncompressed size of the raw data (gzip -dc warm_bucket/rawdata/journal.gz | wc) to the total size of the bucket (du -s), and been able to estimate some per-bucket compression ratios. It's not the easiest answer to get to, since it involves direct shell access, traversing many buckets, and may not be accurate for hot buckets, but it's the best I've been able to come up with. HTH. ... View more

Indexers should always be updated first; they're backward compatible with earlier forwarders, but that may not be true in reverse. ... View more

Based upon feedback I've seen from others, it seems that both strptime and convert mktime() create values relative to the current epoch time. That is, when you're attempting to parse a duration like 1m32s (or so), strptime and mktime interpret that as "1 min 32 sec from now". The value you quoted is an epoch time, representing "Thu May 3 21:02:00 2012 EDT". ... View more

You'll first need to make sure that you're capturing the dotted IP address from the log lines as a field. Let's say you've set it up and have a field called host_ip. (The host field created by Splunk may or may not reflect the IP address of the router device, depending upon whether or not you have the data going over a syslog channel directly into Splunk, or whether there is a syslog receiver and Splunk Forwarder in between....) Once you have a field containing the dotted IP, you're talking about a lookup. Use the Manager > Lookups section to first create a file (with the contents you've provided), then create a lookup definition, to be able to refer to it by name. Let's say you called the file router_ips.csv, and then created a lookup definition router_lookup to refer to that file. Now, in the search bar, you could do: < your search > | lookup router_lookup ip AS host_ip OUTPUT hostname . At this point the hostname field would contain a string like 'Router4'. You can further configure this lookup (again, via the Manager) to be automatic, and not require the extra "lookup" step described above. ... View more

In "regular expression-ese", \d is just a digit. You may have these correct with literal .'s and \If I try to match \d against "1.33", I'm going to get 1. Next, I don't know if you've transcribed your event correctly, or if you cut-and-pasted. It looks like the format of the parenthetical should be int comma float semicolon, and then three more groups like that. The pasted event shows 3,2,2.56; as the second group in that form. Consider testing with RegExr; it'll be faster to triage the problem and then paste into rex in the search bar. Using your input exactly as provided, I wrote the following regex (minus the field names) to match it: JCOConnections:Total=(\d+)\(.*\)=\((\d+),([\d.]+);(\d+),(\d+),([\d.]+);(\d+),([\d.]+);(\d+),([\d.]+);\) ... View more

Note that in order for you to get a \ in the text of what you're providing, you have to escape it. You may well have \d or \., but it's showing up as just d or ., which don't have the same meaning. \d != d. ... View more

In the past I've used eventstats to calculate a total field for a search. Unfortunately, the place to apply it doesn't jump out at me from your example. Maybe something like index="jdbc" sourcetype="BD_PANDORA_PROD" | stats max(nbr_teams) AS max by directorate | eventstats sum(max) AS Total | timechart ... ... View more

Just as an aside, you can do "convert timeformat=%B ctime(_time) AS Time" instead of the rename / eval. ... View more

Oh, and you may find chart more to your liking if you've tweaked with the X-axis (_time) values at all. ... View more

I've done this in the past by converting the time of the events to a string in a given format (stripping away detail), and then the values are just ordered sets over the same X-axis (time) values. Using your example, I'd |convert timeformat="%I%P" ctime(_time) AS my_hour then you can chart by my_hour. This might be over simplifying a bit, but the basic gist is "build the data sets with an overlapping X-axis value, then plot by that value." The trick is to get them to sort in "time" order; I was able to do this with advanced charting properties, so this solution is sadly a bit more involved than you might like.... ... View more

Hmm, noted. It seems that mktime (available in convert) does the same thing. Seconds math it is! ... View more