created an add-on which will call python script with result file. you should have python/shell script in the bin directory to be called by this script with results. I will post this add-on to splunk base soon. ... View more

Hi, Please find below link has more info. https://answers.splunk.com/answers/655954/why-am-i-unable-to-configure-microsoft-oms-modular.html ... View more

Yes, Its index parellelization. ... View more

yes you are right. I dont think we can control timestamp of event using inputs.conf. ... View more

if there is any exception in this scenario , that would be described in the doc. ... View more

try https://splunkbase.splunk.com/app/2748/ ... View more

what if there is no data for 1 full hour.I am not sure this time will be considered. if empty hours also consider then no need of | makecontinuous ... View more

still, you can install and give a try. Most of the times apps/add-ons will support higher versions of Splunk Enterprise. ... View more

as per the document, during restart ,If the file or directory is not present on start, Splunk Enterprise checks for it every 24 hours from the time of the last restart. yes, as per the document file will be ignored until next check. not tested. if you are monitoring the existing directory, newly created file under this monitored directory will be monitored immediately. ... View more

Hi, Try something like below, index=index host=splunk-test sourcetype=sample | makecontinuous _time span=1h | timechart span=1h sum(value) | fillnull value=0 ... View more

index=index host=splunk-test sourcetype=sample | makecontinuous _time span=1h | timechart span=1h sum(value) | fillnull value=0 ... View more

what if there are two values for the same hour. how do you aggregate them? do you want sum the values which are there in the same hour or count ? ... View more

exactly. that's correct ... View more

try span=1mon ... View more

what is the time range you are taking from time picker? span will split from the time chosen from time picker. so, if you chose the correct month in time picker, you will see average for the chosen month. ... View more

fixed this. this is issue with proxy. Found this useful. If you are behind a proxy, set it correctly in npm. >npm config set proxy http://proxyhost:proxyport >npm config set https-proxy http://proxyhost:proxyport Notes: For SSL/https proxies, the protocol in URL should be http not https I had set https-proxy with https. it was supposed to be http. ... View more

Hi jconger, getting below error while running npm install as part of TA configuration. npm WARN package.json [email protected] No repository field. npm WARN package.json [email protected] No README data npm ERR! Linux 3.10.0-693.2.2.el7.x86_64 npm ERR! argv "/usr/bin/node" "/usr/bin/npm" "install" npm ERR! node v0.10.46 npm ERR! npm v2.15.1 npm ERR! code ECONNRESET npm ERR! network tunneling socket could not be established, cause=read ECONNRESET npm ERR! network This is most likely not a problem with npm itself npm ERR! network and is related to network connectivity. npm ERR! network In most cases you are behind a proxy or have bad network settings. npm ERR! network npm ERR! network If you are behind a proxy, please make sure that the npm ERR! network 'proxy' config is set properly. See: 'npm help config' npm ERR! Please include the following file with any support request: npm ERR! /opt/splunk/etc/apps/TA-Azure_Monitor/bin/app/npm-debug.log ... View more

Thank you. I had forgotten this. ... View more

I could see the number of events which I have collected and indexed using collect command in hot db using dbinspect command, this is confirmed based on the sourceCount and eventCount. This means events are written to db folder? ... View more

Check the msi file which you downloaded is 32 or 64 bit. ... View more

There could be already splunk installed on the machine. Check your installed softwares if its found installed. Please uninstall and reinstall with new version. ... View more