Hi, I have logs coming into Splunk from our Mainframe server for a long time. I noticed that Splunk is suddenly not showing any logs on 25/04/2016 and there were partial results on 24/04. Although it is working fine now, I still don't see logs for only 25/04. What might be the possibilities for such discrepancies and is there something I need to check on my end? Thank you.. ... View more

This is my query and it looks fine to me, but I do not see any output. It just tells me "No results found". Can someone tell me what's wrong with this? curl -k -u user:pass https://Splunk Server/services/search/jobs/export -d "search= search index=production email1@xyz.com email2@abc.com "earliest=-12h" | stats count by Email_ID" -d "exec_mode=oneshot" -d "output_mode=csv" \\destinationserver\Reports.csv Thanks ... View more

Hi, I have a search similar to the one below which gives the total count of emails sent out. Here, when there are no emails sent out from a particular email id say email1@xxx.com , I need to display the count as zero under the table. Can someone help me here? index=xyz "email1@xxx.com" OR "email2@yyy.com" OR "email3@zzz.com" OR "email4@abc.com" OR "email5@xyz.com" "ready" "MID"|stats count, last(_time) as "EmailSent" | convert ctime("EmailSent") as time | table count, time Thanks in advance. ... View more

I have a scheduled report that runs daily producing a PDF document. Till now, the report was running well and the PDF was generated, but since the past few days, I am getting following error: An error occurred while generating the PDF. Please see python.log for details. And the logs say, ERROR __init__:477 - Socket error communicating with splunkd (error=The read operation timed out), path=xxxxx 2015-08-21 11:31:32,453 -0400 ERROR pdfgen_endpoint:223 - Exception raised while trying to prepare "test report " for rendering to PDF. Splunkd daemon is not responding: ('Error connecting to /xxx/xxx/search/search/parser: The read operation timed out',) 2015-08-21 11:31:32,453 -0400 ERROR pdfgen_endpoint:229 - No views prepared without exceptions. Bailing out of Integrated PDF Generation. 2015-08-21 11:31:32,481 -0400 ERROR sendemail:964 - An error occurred while generating a PDF: Failed to fetch PDF (status = 400): Unable to render PDF. Can someone please help me solve this. Thanks, Navanitha. ... View more

I have a search which gives the total count of emails sent out from 5 different mail ids. I use a scheduled report for this and the report has the output - Count and last email sent. Now my requirement is along with the total count, I also need the count of emails sent from individual mail id's in my report. So the report looks something like, total count, last email sent mail sent from email1@x.com=10 mail sent from email2@y.com=15 mail sent from email3@z.com=20 and so on... can someone tell me how to do this. Thank you.. ... View more