Dear All, I'm working on splunk db connect app I have configured database input to one oracle database. The table is very big with more than 10 fields and there is more data in each field. When I searched this data, I can see events are properly indexed into splunk. One row of the database has become multiple events is splunk. What might be the problem? I have tried applying [yoursourcetypehere] TRUNCATE = 0 MAX_EVENTS = 10000 But no luck could anyone me out here as soon as possible. Thanks Gajanan Hiroji ... View more

Hello Everyone, i want to check one condition in splunk and if that condition match and then i need to get those events who matches condition else result should be null LAST < sysdate - (1/(2*24)) LAST is one field in splunk and can one help me out here. for sysdate -(1/(2*24)) i have done eval tnow = now() | eval finalvalue=tnow-0.0208333333333333 so now i have to check the LAST < finalvalue I have tried this search string |eval tnow = now() | eval finalvalue=tnow-0.0208333333333333| eval Severity=if(LAST < finalvalue,NODE,null()) | table Severity,NODE when i am doing this if condition doesn't match also it is creating table with first field as null. Can anyone help me out here Thanks   ... View more

Dear All, I monitoring one folder in that folder xml file get created at certain time and it get deleted at certain time so i need to minitor if the file any xml file stay more than 5 min in folder then we need to fire a alert. here is my search query index=test sourcetype=fschangeevents | head 1 | eval newtime=now()-_time | table path,newtime | where newtime>300 this will give me recent one event and check if that event is duration is more than 5 min st that moment. but here there is one problem event might be deleted also added also I Have modified my search because there might be more than one file in folder so cant use head 1 here so i need to monitor each and every file here it is but still facing a problem not able to calculate the time difference index=test sourcetype=fschangeevents | stats values(_time) as intime, count(_time) as totatation by path | convert ctime(intime) | where totatation < 2 | eval newtime=now()-intime| table path,intime,totatation,newtime my query is running good but its not printing newtime could anyone please help me here Thanks Gajanan Hiroji ... View more