If you're overwriting the host field with the value from the syslog message, then no (for an HF). splunk_server will contain the indexer name, but I'm assuming you have an HF collecting syslog and sending to them an indexing tier. ... View more

Shoot splunk support a link, they hopefully will send you an old tar. However, I strongly recommend 3.1.3 over 3.1.1 What problems are you experiencing with 3.1.3? ... View more

It would help if you posted a sample event, as I think you're being a needlessly complex with the timestamp wrangling. That said, what I think you should do is create a field for the day-hour and a field for the day, then throw in a couple of eventstats to get the average per day. Here's a run anywhere example | gentimes start=01/01/2017 end=12/30/2017 increment=1h | eval dow_hour=strftime(starttime,"%a-%H"), dow=strftime(starttime,"%a") | fields dow dow_hour | eventstats count as total_events | eventstats count(eval(match(dow_hour,"00"))) as dows by dow | eval avg=total_events/dows | stats count as events_by_dow_hour max(avg) as average_events_by_dow max(dows) as dows max(total_events) by dow_hour dow These will more or less all be the same because I've just done one event per hour - but throw that at your data and you should see something relevant. Note eventstats can get hairy on large events sets - you may be better off appending multiple stats searches together. If the result set is not to large its perfectly safe. ... View more

How many databases are you talking about? Running a separate HF should be a feasible workaround, even as a separate splunk instance on the same host. EG, a virtualised HF with 4GB of ram and 2 cpus can pull from a 1000 db inputs with no trouble. ... View more

I was hoping that was going to work. I suppose what is happening is that because ojdbc7 is 12.2, and ojdbc6 is 11.2, that because you can specify a max version ojdbc7 is getting used for both connections. I suppose the only way this is going to work is if you could hack the serviceclass name in the driver. I'm not sure if you can open up the jar file to do so - if you know a friendly java dev they might be able to help you? ... View more

Two things there. cron_schedule should look like this: */15 * * * * If you look in your scheduler logs you will probably see a complaint about "invalid cron" or something. Also your time range is: dispatch.earliest_time = -2d@d dispatch.latest_time = +1d@d @d snaps to the nearest 12AM. So even if you run the search every 15 minutes the search will be looking at the same time range until the day advances Fix both of those and you should be good to go! ... View more

What does the savedsearch.conf entry look like? ... View more

What part is not working? Do ApixRes and RestRes show the correct values? Assuimng they do.. if($component$="APIX")... will probably evaluate to false every time, if $component$ is not a quoted string. For example, if you are just passing the value APIX, then you will end up with: | eval result=if(APIX="APIX", ...) . Unless you have a field called APIX that also has the value "APIX", then it will evaluate false. Try quoting the token like so $component|s$ . That will make the eval statement | eval result=if("APIX"="APIX", ...) which will eval to true. ... View more

I would start here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX For general guides definately run through the search tutorial http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial ... View more

That should be fairly straightforward. What have you already tried? The parts you're getting stuck on will be greatly illuminating as the answers to your questions are going to be "it depends" without more information on the structure of your events and how frequently they come in. ... View more

While I haven't done this myself, the solution is most likely to create a new db connection type. Try copying the [oracle] stanza from $SPLUNK_HOME/etc/apps/splunk_app_db_connect/default/db_connection_types.conf into $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/db_connection_types.conf. Then change the stanza name and modify the supportedVersions key [oracle_ojdbc6] supportedVersions = 11.2 displayName = Oracle serviceClass = com.splunk.dbx2.OracleJDBC jdbcUrlFormat = jdbc:oracle:thin:@<host>:<port>:<database>jdbcUrlSSLFormat = jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS(PROTOCOL=tcps)(HOST=<host>)(PORT=<port>))( CONNECT_DATA=(SERVICE_NAME=<database>))) jdbcDriverClass = oracle.jdbc.OracleDriver database = XE port = 1521 connection_properties = {"oracle.net.authentication_services":"(TCPS)","oracle.net.ssl_cipher_suites":"( SSL_DH_anon_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA)"} Then create another stanza in /local/db_connection_types.conf for [oracle] and to stop the original connection type using the older driver like so: [oracle] supportedVersions = 12.0 See https://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/databasespec for more details, and check out #dbconnect on the slack for more help Another alternative would be to have a separate heavy forwarder instance running dbconnect. ... View more

OK - I don't see any of those terms in your data, so I'm not sure if they are a field extraction or a lookup. It may be that someone made a lookup for the data and it has broken somehow. Have you contacted your Splunk admin? ... View more

Missing parameter would indicate that is having some difficulty with the checkpoint value. Is there a checkpoint file for this input? Does it contain valid data? ... View more

I'm pretty sure you can use a trailing \ as a line break character. For example: [stanza] key = value line 1 \ value line 2 That said, it seems unusual that vi would enforce line wrapping as line BREAKING. Can you post your actual config stanza? ... View more

So the regex I have there will create a field called Telco with the value 'telco', if the event contains the string telco. This is unlikely to be what you want. Can you perhaps describe your search in more general terms? ... View more

Are you testing questions for the new Architect exam? ... View more

Can you post two of your searches? ... View more

Finally we can stop being lorded over by Tasmanians ... View more

Yeah I don't think its supported as an input. But if definitely works - you just can't set it up through the GUI ... View more

You probably overwrote some of the 7.0 settings with 6.3.3 ones, breaking splunk. The correct procedure would be to move the entire $SPLUNK_HOME to the new server, and then upgrade to 7.0.1 (http://docs.splunk.com/Documentation/Splunk/7.0.1/Installation/HowtoupgradeSplunk) ... View more

As per the docs, it is not supported on Solaris. It doesn't mean it won't work, but Splunk will not provide any help for you if you run into problems. I would give it a go if you can get the correct JDK and jdbc drivers. ... View more