Is the Forwarder via outputs.conf connect to the indexer? In case Yes, check the internal log for this forwarder and the log level "error". Is the folder changed? ... View more

input at a dashboard are equal filter 😉 ... View more

Save the search of the reports as dashboard panel edit the dashboard add a input in the config of the Input rename the token to filter1_tok or a name_abc_tok or..._tok connect the Input with the Visualization: Button "magnifying glass" edit search --> time range score --> select your token ".._tok" finish Look here too: http://docs.splunk.com/Documentation/Splunk/6.6.0/Viz/Aboutthismanual ... View more

That could help: http://docs.splunk.com/Documentation/Splunk/6.6.0/Deploy/Componentsofadistributedenvironment or http://docs.splunk.com/Documentation/Splunk/6.6.0/Deploy/Datapipeline ... View more

Know you the matching capability? ... View more

We have the similar problem, check that the package sysstat is installed at the operation system. ... View more

Which distribution is it? ... View more

check with " | inputlookup name_lookupfile " is the file correct readed. ... View more

We had the same problem, in the sourcetype vmstats were data. In the sourcetype cpu or df were no data. Verify that the os sysstat package is installed. After that we had data in both sourcetypes. ... View more

If I user the UDP input the packets are correct readed, each 100 ms. But only if I send direct to Splunk. If I transmission between source and sink and I hear on the channel, the UDP packet is not recognized correctly. ... View more

My Problem seems to be similar. My customer send every 100ms a new stream off UDP packets. Splunk Stream App is unable to break the events after this time. I wrote a test client with a thread sleep 100 ms. I try in the config file streamfwd.xml the configuration: 1 The unit is seconds, I need milliseconds. Somebody have a after solution or idea for this problem? import java.io.BufferedReader; import java.io.InputStreamReader; import java.net.DatagramPacket; import java.net.DatagramSocket; import java.net.InetAddress; import java.text.SimpleDateFormat; import java.util.Date; class UDPClient { public static void main(String args[]) throws Exception { System.out.println("Start UDPCLient"); BufferedReader inFromUser = new BufferedReader(new InputStreamReader(System.in)); BufferedReader durationFromUser = new BufferedReader(new InputStreamReader(System.in)); InetAddress IPAddress = InetAddress.getByName("192.168.1.10"); byte[] sendData = new byte[1024]; byte[] receiveData = new byte[1024]; String sentence = null; System.out.println("Test time in Secondes?"); String timeStr = durationFromUser.readLine(); long durationInMs = 120000L; if (timeStr != null && !timeStr.isEmpty()) durationInMs = 1000L * Long.parseLong(timeStr); long starttime = System.currentTimeMillis(); long duration = starttime + durationInMs; SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.S"); String startTimeStr = df.format(new Date(starttime)); System.out.println("Starttime: " + startTimeStr + " Duration: " + durationInMs); DatagramSocket clientSocket = new DatagramSocket(); int i = 0; boolean stoptimeOK = false; long controltime = 0L; int byteSize = 0; while (!stoptimeOK) { sentence = "UDP_Msg_"; sentence = sentence.concat("" + df.format(new Date(System.currentTimeMillis())) + " "); sendData = sentence.getBytes(); byteSize = byteSize + sendData.length; DatagramPacket sendPacket = new DatagramPacket(sendData, sendData.length, IPAddress, 9875); clientSocket.send(sendPacket); Thread.sleep(100); controltime = System.currentTimeMillis(); if (controltime >= duration) { stoptimeOK = true; } } clientSocket.close(); String finishTime = df.format(new Date(controltime)); System.out.println("EndeTime: " + finishTime + " ByteSize " + byteSize); System.out.println("Finish"); } } ... View more

Has anyone found a solution? ... View more

the folder is empty. ... View more

Hi, the folder bin/boot ist not deployed via Deplayment Server. What ist the problem? ... View more

You need the App Splunk DB Connect. https://apps.splunk.com/app/958/ ... View more

Check the permissions on the field and the dashboards. Check the time interval of the data, may be the search is out of time. ... View more

My Solution is: I delete in the Manager, External Databases the connection. Next Step is create a new Connection to the Oracle DB, but disable the icon "Validate Database Connection". After this you can save the connection whitout errors. the second step ist change the config-file database.conf to the result: [INEK_ORACLE] database.sid = true database = INEK host = 'full-host' password = password port = 1521 readonly = 1 type = oracle username = SPLUNK FINSIH ... View more

Hello, my configuration is Splunk Version 5.0.3, Build 163460, Splunk DB Connect Version 1.0.11. I connect to a MySQL DB all works fine. I trying connect to an Oracle DB 11g. I setup the driver ojdbc6.jar in the folder //&SplunkHome/splunk/etc/apps/dbx/bin/lib. In the File &splunk_Home/splunk/etc/apps/dbx/local/databases.conf i setup database.sid = true, the Connection Manager tell no errors, if i'm select something, a error appear: command="dbquery", Error getting database connection: Listener refused the connection with the following error: ORA-12514, TNS:listener does not currently know of service requested in connect descriptor Where is my mistake? The database.conf file: database.sid = true [INEK] disabled = 0 database = INEK host = 'full-host' password = passowrd port = 1521 readonly = 1 type = oracle username = SPLUNK [MySQL ] database = splunk host = hostname password = password port = 3306 readonly = 1 type = mysql username = splunk ... View more