Hi, It seems log file contains CTRL-M character will cause duplicate parsing in splunk indexer so I would like to filter all events contain this character. Please advise on how to set it up in props.conf Thanks in advance! e.g. <?xml version="1.0" encoding="ISO-8859-1"?>^M <DATA>^M ... View more

Hi, When I run a search query in Splunk, it can be saved as Report or Alert. What's the difference between them? I looked at the stanza at savedsearches.conf but they are almost identical. Is there a systematic way to find out the number of reports vs alerts in all the saved searches? Thanks in advance! ... View more

Hi, In Splunk 6, I can see the peers, search heads and index names from the master GUI. I am trying to find the equivalent info in REST API http://mysearchmaster:8000/en-US/manager/system/clustering?tab=searchheads http://mysearchmaster:8000/en-US/manager/system/clustering?tab=indexes http://mysearchmaster:8000/en-US/manager/system/clustering?tab=peers I looked at the online doc http://docs.splunk.com/Documentation/Splunk/6.1.2/RESTAPI/RESTcluster#GET_cluster.2Fconfig but still can't find e.g. all search head name and status. Please advise if anyone has done the same thing before. Thanks in advance! ... View more

Hi, I get the user_id info from web log and would like to enrich data from the connected DB in Splunk. I tried the search query below but it didn't work. Can anyone provide the right syntax? index=web_access_log | table user_id | RENAME user_id AS web_user_id [ search dbquery USER_SQL_DB "select web_user_id, user_type, user_email, user_phone from user_profile_view_all where web_user_id=$web_user_id$ "] ... View more

Hi, My log event is in xml and the timestamp is in epoch format e.g. <timestamp>1399909145002</timestamp> How can I define this in props.conf so the event timestamp will be correctly indexed in splunk? Thanks in advance! ... View more

Hi, I would like to join or append 2 dataseries and try the function append/ join. However, the result is not really what I want. Please advise the right query to achieve the goal below. Thanks in advance! source="cpu_load" host="myhost" | timechart span=30m avg(cpu) as cpu_average | append [search sourcetype="server_hits" host="myhost" | timechart bins=300 minspan=30m sum(requests) AS req] Result _time cpu_average ser 1 3/21/14 10:00:00.000 AM 10.087604 2 3/21/14 10:30:00.000 AM 10.734093 3 3/21/14 11:00:00.000 AM 10.539557 4 3/21/14 10:00:00.000 AM 1244 5 3/21/14 10:30:00.000 AM 1501 6 3/21/14 11:00:00.000 AM 1931 Ideal Goal _time cpu_average ser 1 3/21/14 10:00:00.000 AM 10.087604 1244 2 3/21/14 10:30:00.000 AM 10.734093 1501 3 3/21/14 11:00:00.000 AM 10.539557 1931 ... View more