is it possible that it's returning lots of data? There is a limit on open transactions that can be returned. Please take a look at this answer https://answers.splunk.com/answers/186106/is-there-a-limit-on-the-number-of-events-returned.html Thanks, Raghav ... View more

Hello @jorell, could you please more info? What i understand is you are looking to create a filed that will hold the INFO,ERROR and WARN values? Is that what you are looking for? You can extract fields always using regular expressions and eval: https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Extractfieldswithsearchcommands. Just to give you an idea, i extracted the Value INFO and assigned it to the Key = Level(Log Level) |gentimes start=-1|eval Event="2016-06-05T19:55:10,144 INFO LoadProperties:225 - LoadProperty - Initial fetch for properties is successfu"|rex field=Event "\s(?P\w+)\s" Please provide more info with an example if this is not even close to what you're looking for. Hope this helps! Thanks, Raghav ... View more

Hello @riotto, To return all the events that are not part of the grouped transactions, use the attribute keeporphans=true More examples: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Transaction Syntax: .....|transactions startswith=Start endswith=Ends keeporphaned=true ....will return loose events. Also, look at the option keepevicted=true from the same docs link. As far as the -2d and -1d questions is concerned, are you missing any large subset of events? Hope this helps! Thanks,, Raghav ... View more

+1 to @jkat54 's answer. I created a script that writes "$Date T O D A Y I S $DAY" and configured the monitored input. Inputs.conf [monitor:///opt/splunk/bin/scripts/test.txt] index=main sourcetype=test In props.conf, [source::/opt/splunk/bin/scripts/test.txt] SEDCMD-replacespaces = s/()/^/g Bounced splunkd and here's the output in search index=main sourcetype=test Output: ^0^8^-^1^9^-^2^0^1^6^ ^T^O^D^A^Y^ ^I^S^ ^M^O^N^D^A^Y^ ^0^8^-^1^9^-^2^0^1^6^ ^T^O^D^A^Y^ ^I^S^ ^T^U^E^S^D^A^Y^ ^0^8^-^1^9^-^2^0^1^6^ ^T^O^D^A^Y^ ^I^S^ ^W^E^D^N^E^S^D^A^Y^ ^0^8^-^1^9^-^2^0^1^6^ ^T^O^D^A^Y^ ^I^S^ ^T^H^U^R^S^D^A^Y^ ^0^8^-^1^9^-^2^0^1^6^ ^T^O^D^A^Y^ ^I^S^ ^F^R^I^D^A^Y^ ^0^8^-^1^9^-^2^0^1^6^ ^T^O^D^A^Y^ ^I^S^ ^S^A^T^U^R^D^A^Y^ ^0^8^-^1^9^-^2^0^1^6^ ^T^O^D^A^Y^ ^I^S^ ^S^U^N^D^A^Y I ran out of suggestions as all the proposed formats work for me. Hope this helps! Thanks, Raghav ... View more

I just tried the following from search, which is pretty much a mimic in props without the """ |gentimes start=-1|eval Space="THIS IS A TEST"|rex mode=sed field=Space "s/( )/^/g" and the output is THIS^^IS^^^A^^^TEST One last try may be? Thanks, Raghav ... View more

wrap that in a shell script and pass it one time. That way you do not have to type it every time. -auth admin:xxxx (Please remove it as soon as your backfill is complete). ... View more

Can you try s/\ /_/g ? That has done trick once for me. Thanks, Raghav ... View more

Correct, keeping the volume of searches aside, that script fill_summary_index.py is designed to execute one search at a time unless asked it to do more. example: ./splunk cmd python fill_summary_index.py -app xyz -name * -dedup true -showprogress true -et -7d -lt now -j 8 -owner admin will run / try to run 8 searches at a time (Whole different story if you do not have 8 cores on you search head....rule is 1 search per core). & if you just not mention -j argument, it will run one search , waits for it to finish and then move on to the next. Hope this helps! Thanks, Raghav ... View more

Hey @terryloar If you are referring to Splunk's built in visualization, You can provide lat and lon settings (paint brush) and ask splunk to populate it with those settings. If it's Geo Heat map, when you edit the panel and click the paint brush, there's an option called "Center". If this is not what you're looking for, could you provide more info or probably a screenshot? Hope this helps! Thanks, Raghav ... View more

Hey @mhuntington, I am afraid to say there's no one answer or a simple answer to your question. You are right about splunk, it changed a lot over the years and now lot of stuff can be done with few clicks / simple configs. Assuming, When you say taking over an existing system, are you are talking about migrating it to a new instance? If so, have you ever thought of converting the old instance as a forwarder to your new instance? That way, only think you have to make sure is connectivity between old and new instances + same indexes / configs should be created on the new indexer. This is simple if the hardware is new and you are now the owner of the legacy hardware. If the hardware is EOL, you are now back to square one If it has to be re-created as brand new setup (Starting everything that use to go to old instance to new instance), i would suggest you to go and ask little more time than two weeks from leadership, set something up parallel to the old setup. Send data from the data sources you've mentioned to both the instances (Old + new Instances) to validate the data and artifacts. Once the data validation is completed, you can simply shut down the old instance. This might be a simple option if Time line is a constraint, ask for professional services to do the work. They would be more than happy to get you migrated. My personal favorites are 1. Convert the old instance as a forwarder to your new instance Or 2. Setup something parallel to the old instance (This instance would be your forwarder/indexers, collecting data from the data sources you've mentioned. Validate, validate and validate...finally shutting down the old instance). Again, there's not going to be a simple answer to your question. We can only post content from our experiences. Hope this helps! Thanks, Raghav ... View more

What version of Splunk? If you 6.3+ you can have splunk use TLV1.2 cipherSuite OR upgrade Splunk to 6.4. Add that in your server.conf and everywhere else (inputs/outputs and web) Hope this helps! Thanks, Raghav ... View more

Hey @mwdbhyat, Can you post the xml? have you tried to edit the padding? .btn-pill { padding: 0 45px;} ? From what i can tell, they auto adjust. Hope this helps! Thanks, Raghav ... View more

🙂 one more splunker collecting data from twitter now...woohoo ... View more

Hello, The search you posted, is that what you are running exactly or did you just type it?Reason i ask, I see a typo in there Highlighted in Bold. earliest=-1d@d latest=@d index=_internal source=*license_usage.log* type=Usage | stats sum(b) AS Bytes by st | eval GB = (**Bytes/1024/10241024/**) | sort -GB As far as the Bytes to GB calculation, that is absolutely right. I used my 6.4 splunk as well as a calculator and 4693489783100 Bytes is 4371.152989GB I just ran the search on my LURV by sourcetype and GB calculation is correct. I suspect the Bytes value. It's almost like something is forcing the timerange to be much higher than the -1d@d ,@d . Again, mine is 6.4 and not 6.4.2.May be 6.4.2 has a bug to report the Bytes value some extra. Try not putting the earliest and latest in the search, instead use the Time picker and see if it changes (Guess). Hope this helps! Thanks, Raghav ... View more

Hello, If you don't want time picker and yet give pre-defined time ranges to users, add the following xml below <form.......> tag <fieldset submitButton="false"> <input type="dropdown" token="earliestTime" searchWhenChanged="true"> <label>Select a TimeWindow</label> <choice value="-24h@h">24 Hour Window</choice> <choice value="-48h@h">48 Hour Window</choice> <choice value="-72h@h">72 Hour Window</choice> <choice value="-7d@d">7 Day Window</choice> <default>24 Hour Window</default> </input> </fieldset> Then you need to reference the token for each search/panel example: <earliest>$earliestTime$</earliest> etc. And offcourse you can modify the above xml snippet to match your requirements. Hope this Helps! Thanks, Raghav ... View more

Hello, I have the exact same configuration on mine and it's working. What version of splunk are you on? It's compatible only with 6.4 # clustermap viz defaults display.visualizations.custom.viz_clustermap.clustermap.lat = 25.799891182088334 display.visualizations.custom.viz_clustermap.clustermap.lng = -0.52734375 display.visualizations.custom.viz_clustermap.clustermap.zoom = 2 display.visualizations.custom.viz_clustermap.clustermap.tiles = light display.visualizations.custom.viz_clustermap.clustermap.maxClusters = 120 display.visualizations.custom.viz_clustermap.clustermap.markerColor1 = #008cff display.visualizations.custom.viz_clustermap.clustermap.markerColor2 = #ffbf00 display.visualizations.custom.viz_clustermap.clustermap.markerColor3 = #ff0000 display.visualizations.custom.viz_clustermap.clustermap.markerColor4 = #ff00ed display.visualizations.custom.viz_clustermap.clustermap.numberFormat_min_0 = 0.[0] display.visualizations.custom.viz_clustermap.clustermap.numberFormat_min_1000 = 1.1a display.visualizations.custom.viz_clustermap.clustermap.numberFormat_min_10000 = 1a display.visualizations.custom.viz_clustermap.clustermap.numberFormat_min_1000000 = 1.1a Can you try a fresh install from GUI or CLI whichever method you haven't used before? Thanks, Raghav ... View more

Hey @skoelpin, Setting up an alert will help if it's only one forwarder/host/sourcetype you have complains with. It will get cumbersome if you have 1000s of machines doing the same randomly(Especially when you do not know which one might skip/break). Use this query to monitor the forwarder status that are reporting to your instance Run for hosts that are deviated or look suspicious Have that data written to an event Build Alerts on those events. It is not going to be easy 🙂 I have done something similar. Atleast i now know that the triggered alerts are denoting a data forwarding issue. index=_internal source=*metrics.log group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | rename connectionType as connectType | eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder") | eval version=if(isnull(version),"pre 4.2",version) | rename version as Ver | fields connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver | eval Indexer= splunk_server | eval Hour=relative_time(_time,"@h") | stats avg(tcp_KBps) sum(tcp_eps) sum(tcp_Kprocessed) sum(kb) by Hour connectType sourceIp sourceHost destPort Indexer Ver | fieldformat Hour=strftime(Hour,"%x %H") Hope this helps and please do not forget to post if you find a better solution. Thanks, Raghav ... View more

Hello, I completely agree with @twinspop . Control the access by roles (No realtime, no scheduled realtime...can run only xyz MB, can run only xyz searches etc). You are correct, increasing the max historical concurrent limit will not work unless you get the VM specs bumped. I hope you have reservations on your VMs. If not, scale them horizontally or switch to metals. Hope this helps! Thanks, Raghav ... View more

Who's running those realtime searches? Does the user/role has the ability to run realtime searches? If not, you will see an error stating "Skipping searches as xyz does not have permissions etc". Take a look at the scheduler.log and find out. Other reason would be, if there's not enough horse power on the search heads. Hope this helps! Thanks, Raghav ... View more