Yes, standard is, the pieces i want from debug portion remains same ... View more

Any ideas? ... View more

What is the user/role capabilities you have? See if admin has allowed you to access internal indexes. Settings>Access controls>Roles and looks for allowed indexes Also look what role your user id is associated to. Hope this helps, Thanks, Raghav ... View more

I got the same result as using SEDCMD-hash = s/value_key:(\S+), code_key:PASSWORD/XXXXXX/g. Instead of value_key:XXXXXX, code_key:PASSWORD , it replaces the whole line with [XXXXXX]. It started to make sense as this is happening at index time before the event boundaries are marked, or i might have missed the point totally. Appreciate your help. Thanks, Raghav ... View more

I tried [Sourcetype] Sedcmd-xyz = s/regex/####/g and no luck. ... View more

Please accept as answer / leave comments so that it would be easier for others to see the post. Thanks, Raghav ... View more

Hi, The combination would depend on your requirements. Search Heads: CPU Related Indexers: Need good IOPS as here's where the magic of splunk happens Now, what's the user base? if you have too many users, then using two search heads (partial) is a good idea. Considering concurrent, rt searches and the whole 9 yards. I see license is 100GB / day...what's the IOPS ? if it has low IOPS, spreading the load across two Indexers is ideal. Now, what type of data you are going to index? Is it well structured,key-valued data or needle in the haystack? I would suggest you to consider the requirements and that will definitely help you determine the topology 1. Use cases, how many users, concurrent users. 2. Amount of data to be indexed. Type of logs, Specs etc. Hope this helps! Thanks, Raghav ... View more

Oh let's not hijack vikas's post. Cheers! ... View more

Hey ronak, i absolutely do not mind helping. Just want to let you know, there are some Splunk Saints actively answering questions here...We all have been there :). Feel free to siphon through this forum and the chances of you finding better answer than mine are 100% 🙂 Thanks, Raghav Raghav.vicky23@outlook.com ... View more

Like a wise man once said, it happens to the best of us 🙂 ... View more

Yes. Example: Business Objects- where you load the structure/configuration table and drag and drop elements you need. Here in splunk, you have a new feature called Pivot where you pretty much drag and drop fields to create the visualizations. In BI tools, you create reports,views with simple sql like queries and here in Splunk we use SPL (Search Processing Language). similarities are very close. Example BI Query = If(This).Do this.Else.Do That|where This != That Splunk Search: If(This).Do.this.Do That|where This != That Reference Card: http://dev.splunk.com/web_assets/developers/pdf/splunk_reference.pdf Documentation: http://docs.splunk.com/Documentation/Splunk And the best of all: http://answers.splunk.com/ Happy Splunking! Raghav ... View more

Hey there, please take a look at this http://docs.splunk.com/Documentation/Splunk/6.2.1/alert/SendingSNMPtrapstoothersystems Make necessary changes to xyz.pl and put it under Splunk_home$/bin/scripts/ directory. Call the script while creating the alert. Hope this leads you in the right direction. Thanks, Raghav ... View more

Reply to @jbrodsky_splunk I tried to paste it in the comment but char count exceeded. Here's the javascript. require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { // Row Coloring Example with custom, client-side range interpretation var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { // Enable this custom cell renderer for both the active_hist_searches and the active_realtime_searches field return _(['CentralFlorida','Cleveland','GulfCoast','LasVegas','NorthernVirginia','OklahomaCity','Phoenix','SanDiego','SantaBarbara','BatonRouge','Connecticut','HamptonRoads','Macon','NewOrleans','Omaha','OrangeCounty','RhodeIsland','Roanoke','Tulsa','Wichita','all_markets']).contains(cell.field); }, render: function($td, cell) { // Add a class to the cell based on the returned value //alert(cell); var value = parseFloat(cell.value); // Apply interpretation for number of historical searches //alert(value); //CentralFlorida if (cell.field !== ' ') { if (value >= 99) { $td.addClass('range-cell').addClass('green'); } else if (value >= 98 && value < 99 ) { $td.addClass('range-cell').addClass('amber'); } else if (value < 98 ) { $td.addClass('range-cell').addClass('red'); } } // Update the cell content $td.text(value.toFixed(2)).addClass('numeric'); } }); mvc.Components.get('bixlaxrates').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); // tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row // tableView.$el.find('td.range-cell').each(function() { // $(this).addClass(this.className); // }); //}); // Force the table to re-render tableView.table.render(); }); mvc.Components.get('bizrates').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); // tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row // tableView.$el.find('td.range-cell').each(function() { // $(this).addClass(this.className); // }); //}); // Force the table to re-render tableView.table.render(); }); mvc.Components.get('techrates').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); // tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row // tableView.$el.find('td.range-cell').each(function() { // $(this).addClass(this.className); // }); //}); // Force the table to re-render tableView.table.render(); }); }); ... View more

Could you please provide more on search-switching requirement? There's a simple XML example in 6.2.x dashboard example app called link-switcher. It allows you to toggle for multiple chart views in one panel. ... View more

I second what @ppablo_splunk mentioned. Splunk on Splunk will give the count/search performance /mode/role etc. Install Splunk on Splunk and from the Search menu, select search Activiy. Here's a sample search that's telling me the maximum search concurrency and utilization set_sos_index sourcetype=ps host="Aryahi-PC" | multikv | get_splunk_process_type | search type="searches" | get_search_props | bin _time span= ps_sos_period s | search mode = real-time | stats dc(sid) as search_count by _time user | timechart bucketize_ps_sos max(search_count) AS "Concurrent search count" by user Hope this helps! Thanks, Raghav ... View more

Try bumping up the thruput to max and see. ... View more

try stats max(ETsec) as m_LOG ,max(ETms) as m_PERF by URI,Service,_time | table URI, m_LOG, Service, m_PERF thanks, Raghav ... View more

Hey There, there are tons of posts on how to achieve this functionality. http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/ by Jon Webster There is an app called Time Wrap in the splunk app base. Hope this will walk you in the right direction. Thanks, Raghav ... View more

Couple of things you could do. On splunk web, click on settings> System>Licensing > Usage report Here you can figure out the max license user by sourcetype, host, index etc Once you find the outlier, using s.o.s app, look for inputs.conf of the host and verify monitor stanzas, like debug logs etc....you'll figure it out then. Hope this helps, Thanks Raghav ... View more