I want to change the Splunk> logo present it every page. I want it to be as DEV-Splunk> . Can you plesae tell me where this logo resides? ... View more

In splunk NIX TA they have used a script named iostat.sh. In the script the command got used is iostat -xk 1 2 i.e. it is providing the IO statistics extensively and running in every 1 sec for 2 times. Now when I am running this particular command in my linux server it is providing me the r/s and rkB/s value as 0.00 in every 2nd second whether it has some value in the first second. So whenever I am trying to retrieve the data for sourcetype=iostat it is showing me r/s and rKB/s as 0.00. Why the data is 0.00 in every 2nd second??? Is there any thing that I am missing??? ... View more

I have two search string: index=os source=Perfmon:LocalMainMemory | where like(counter,"% Committed Bytes In Use") | stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" by host index=os sourcetype=Perfmon:LocalProcessor | where like(counter,"% Processor Time") | stats avg(Value) as "avgCpuPct", max(Value) as "peakCpuPct" by host How to merge these two with out using JOIN. We can use OR. I have tried index=os source=Perfmon:LocalMainMemory OR sourcetype=Perfmon:LocalProcessor | where like(counter,"% Committed Bytes In Use") | where like(counter,"% Processor Time") | stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" avg(Value1) as "avgCpuPct", max(Value1) as "peakCpuPct" by host But is it not giving any value. Looks like I cannot use Value1. Can anyone help me!! ... View more

I have a search string index=os source=vmstat | multikv fields memUsedPct memTotalMB memFreeMB | stats avg(memUsedPct) as avgMemPct max(memUsedPct) as peakMemPct avg(memUsedMB) as avgMemMb max(memUsedMB) as peakMemMb by host | join host [ search index=os source=cpu | multikv fields pctIdle | search all | eval Percent_CPU_Load = 100 - pctIdle | stats avg(Percent_CPU_Load) as avgCpuPct max(Percent_CPU_Load) as peakCpuPct by host Now is there any way that I can get the same result without doing join?? ... View more

Is there any thing wrong with the below search string????? index=os source=df |multikv fields Filesystem Avail UsePct | search Filesystem=/dev/mapper/system-root | eval availPct=(100-UsePct) | stats avg(Avail) as availDisk avg(availPct) as UsePct by host ... View more

When executing the search "index=os source=df" it is gvng me the data for /dev/ammper/system-root and /dev/sda...is there is a way that I can get the data only for /dev/mapper/system-root???? ... View more

I have written the below search string: index=os source=interfaces | multikv fields RXbytes, TXbytes | eval firstRXBytes=first(RXbytes) | eval lastRXBytes=last(RXbytes) | eval Received_Bytes=round((last(RXbytes)-first(RXbytes))/300), 2) | stats values(Received_Bytes) as RXBytes/sec by host But is it providing me an error "Error in 'eval' command: The 'first' function is unsupported or undefined." Help!!! ... View more