Yes, you can setup for timezone for each log in different ways. In props.conf, you can set TZ attribute for the particular sourcetype. In inputs.conf, you can set _tzhint field for the particular log monitor stanza. ... View more

Metadata query are not time dependent, but tstats queries are. Also if you want to find a sourcetype that had stopped reporting last week, then the time range for tstats command has to be greater than 7days. Metadata queries are faster in this respect, but they can also be slow if you have huge number of results(sourcetypes or hosts). ... View more

I tested with your data this way and it is working for me this way - basesearch | rename "Stop Date/Time" as EndDateTime,"Test Name" as EVENT | eval EndDateTime=round(strptime(EndDateTime,"%m/%d/%Y %H:%M")) | eval TRANID=if(like(EVENT,"Launch"),1,0) | streamstats sum(TRANID) as TRANID | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(EndDateTime) | eval start_time=if(like(EVENT,"Launch"),EndDateTime,0) | eval end_time=if(like(EVENT,"Open"),EndDateTime,0) | stats list(EVENT) as EVENTS,sum(start_time) as start_time,sum(end_time) as end_time by TRANID | eval diff=end_time-start_time ... View more

Try this way - | rex max_match=0 "function2.+string\"\>(?<parameter>[^\<]+)" ... View more

Can you provide few sample data for a single transaction? ... View more

My bad, in the last eval mistakenly gave "=" instead of "-" index="myindex" sourcetype="mysourcetype" "Launch" OR "Open" | eval TRANID=if(like(EVENT,"%Launch%"),1,0) | streamstats sum(TRANID) as TRANID | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(EndDateTime) | eval start_time=if(like(EVENT,"%Launch%"),EndDateTime,0) | eval end_time=if(like(EVENT,"%Open%"),EndDateTime,0) | stats list(EVENT) as EVENTS,sum(start_time) as start_time,sum(end_time) as end_time by TRANID | eval diff=end_time-start_time ... View more

Have the list of members in a lookup and then form a query like this - Lookup - teammembers_lookup.csv user,status user1,active user2,active Query - sourcetype="WinEventLog:Security" eventtype="msad-successful-user-logons" | stats count by user | lookup teammembers_lookup.csv user OUTPUT status | fillnull value="-" status | search status!="active" ... View more

Yes, you have to blacklist the sdk files in the first stanza and it should work. blacklist = ((.+sdk_trace.+|\.(tar|gz|bz2|tar.gz|tgz|tbz|tbz2|zip|z)$) ... View more

If you can form a query to identify new error and populate required fields, you can have another search running to update your lookup file with these fields using outputlookup command. basesearch | lookup mylookup col1 , col2 , col3 OUTPUT col4 | search NOT col4=* This will give you where there are no matches in the lookup and the fields that may have to be updated. ... View more

Sure.. no problem 🙂 ... View more

You can try creating a TRANID manually and get the difference - index="myindex" sourcetype="mysourcetype" "Launch" OR "Open" | eval TRANID=if(like(EVENT,"%Launch%"),1,0) | streamstats sum(TRANID) as TRANID | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(EndDateTime) | eval start_time=if(like(EVENT,"%Launch%"),EndDateTime,0) | eval end_time=if(like(EVENT,"%Open%"),EndDateTime,0) | stats sum(start_time) as start_time,sum(end_time) as end_time by TRANID | eval diff=end_time=start_time ... View more

You need configure your line breaking properly, so that Splunk doesn't detect each line as an event and detects the whole event. Example sourcetype in props.conf - [IBM:AUT:TAM] TIME_PREFIX =^\[ MAX_TIMESTAMP_LOOKAHEAD = 29 TIME_FORMAT = %FT%T.%3N LINE_BREAKER = ([\n\r]+)(?=\[\d{4}(\-\d{1,2}){2}) SHOULD_LINEMERGE = False Please accept an answer once you have a solution and upvote any other solution that helps. ... View more

These look like error logs and stack trace. If you don't want these events, add blacklist to filter out these logs or specify exact logs you want in monitor stanza. Like if you want only info logs then specify this way - [monitor:///opt/IBM/middleware/user_projects/domains/Test/servers/cl_server*/logs/(info.out|info.log)] Or add in blacklist the logs you want to ignore - blacklist = ((.+error\.log.+|.+systemerr\.out.+)|\.(tar|gz|bz2|tar.gz|tgz|tbz|tbz2|zip|z)$) ... View more

You could try extracting all these fields and then get count- | rex max_match=0 "(?<Product>payload\.productName\d+)" ... View more

I think you should read the Distributed Deployment Manual - http://docs.splunk.com/Documentation/Splunk/6.5.3/Deploy/Distributedoverview This will help you understand how to configurations are to be deployed in clustered and non-clustered environments. ... View more

The like function searches for the pattern in the field you provide(here you are searching if "abc" is part of the _raw event, if yes then set as 1 and else set as 0. So if there are no "abc" events from a host, the max value of exists field would be 0. Check if the text is enclosed with "%" when you add in like function. ... View more

The problem is the base search has "abc" in it. So it won't provide the hosts where the event is not present. Try the search I have provided. index=... sourcetype=... | eval exists=(like(_raw,"%abc%"),1,0) | stats max(exists) as exists by host | where exists<1 ... View more