Hi, I have logs coming into Splunk from our Mainframe server for a long time. I noticed that Splunk is suddenly not showing any logs on 25/04/2016 and there were partial results on 24/04. Although it is working fine now, I still don't see logs for only 25/04. What might be the possibilities for such discrepancies and is there something I need to check on my end? Thank you.. ... View more

This is my query and it looks fine to me, but I do not see any output. It just tells me "No results found". Can someone tell me what's wrong with this? curl -k -u user:pass https://Splunk Server/services/search/jobs/export -d "search= search index=production email1@xyz.com email2@abc.com "earliest=-12h" | stats count by Email_ID" -d "exec_mode=oneshot" -d "output_mode=csv" \\destinationserver\Reports.csv Thanks ... View more

Hi, I have a search similar to the one below which gives the total count of emails sent out. Here, when there are no emails sent out from a particular email id say email1@xxx.com , I need to display the count as zero under the table. Can someone help me here? index=xyz "email1@xxx.com" OR "email2@yyy.com" OR "email3@zzz.com" OR "email4@abc.com" OR "email5@xyz.com" "ready" "MID"|stats count, last(_time) as "EmailSent" | convert ctime("EmailSent") as time | table count, time Thanks in advance. ... View more

I have a scheduled report that runs daily producing a PDF document. Till now, the report was running well and the PDF was generated, but since the past few days, I am getting following error: An error occurred while generating the PDF. Please see python.log for details. And the logs say, ERROR __init__:477 - Socket error communicating with splunkd (error=The read operation timed out), path=xxxxx 2015-08-21 11:31:32,453 -0400 ERROR pdfgen_endpoint:223 - Exception raised while trying to prepare "test report " for rendering to PDF. Splunkd daemon is not responding: ('Error connecting to /xxx/xxx/search/search/parser: The read operation timed out',) 2015-08-21 11:31:32,453 -0400 ERROR pdfgen_endpoint:229 - No views prepared without exceptions. Bailing out of Integrated PDF Generation. 2015-08-21 11:31:32,481 -0400 ERROR sendemail:964 - An error occurred while generating a PDF: Failed to fetch PDF (status = 400): Unable to render PDF. Can someone please help me solve this. Thanks, Navanitha. ... View more

I have a search which gives the total count of emails sent out from 5 different mail ids. I use a scheduled report for this and the report has the output - Count and last email sent. Now my requirement is along with the total count, I also need the count of emails sent from individual mail id's in my report. So the report looks something like, total count, last email sent mail sent from email1@x.com=10 mail sent from email2@y.com=15 mail sent from email3@z.com=20 and so on... can someone tell me how to do this. Thank you.. ... View more

Hi, Can someone help me in writing the regex for following string 20141128082428PAASSUB 00.?9CDPCI8I USER ACTION TITLE 295211P3055E464 01Q0009000054146746SAHEER SHAIK12 20141202054437PBSALAK 00.94_VCT90U Windows security event logs P43833244199105 02P8758878262824579SAI LAKSMII I need to extract the last string and name it as user. eg: user=SAHEER SHAIK. Also extract the digit "P43833244" and name it as ID. ... View more