Mark it as answer please ... View more

Got it now, you extracted the field as (? d+) tnsping and you are comparing with TNSping which doesnt even exist. Makes sure you always use the exact field name 🙂 ... View more

where are you running this query? ... View more

best bet check with sendmail command to those IDs. If they are reaching well and good. For confirmation you can send it to one of your personal ids if allowed. ... View more

Dear friend, there is no access or account related permission which is need to forward a simple email. Did you configure the smtp gateway on splunk instance or you are only using a custom cofig in alert_action.conf? Test with sendmail command to the other email ids if they are getting it or not. The email id's if they are not getting check the smpt server log. _http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Sendemail ... View more

aelliot is correct, Founders explained it _http://www.splunk.com/view/SP-CAAAGBY ... View more

could you paste on of your savedsearch.conf settings for your alert? The above assumption is not correct, there is something wrong somewhere else.. ... View more

The condition is wrong sourcetype[| metadata type=sourcetypes |where recentTime > now() - 60 | eval LastIndex = strftime(recentTime, "%F %T") | fields + sourcetype]|where sourcetype=your_sourcetype AND field_name like "%event:message.in%" |eval a=1| stats count|where count =0 you can replace the your_sourcetype and field_name. Thanks ... View more

Moreover, whichever jobs are not required you could set dispatch.ttl parameter to as low as possible. ... View more

It's not correct. Your email gateway which is configured in splunk should send them to anyone you like. It doesn't depend on any user email id. Does anyone get any mail? ... View more

Hello, Are you able to install it normally without configuring the domain user? you can configure the service later. Another verification: Check if the service account/account has permission to log on as a service. Local Security Policy->Local Policy->Users Rights Assignment-> Log on as a Service. Ad your account in there, then try it. Thanks ... View more

Where do u use the email id's? How is the user in LDAP users related to alerts and creating local users? ... View more

Obvious, but are they placed in indexers? ... View more

Can't you use outputlookup and keep all the records rather than updating it? index and Dedup all the records to get the latest record. But you need to add new columns you specified to keep track of them.. ... View more

Who updates the lookup file? ... View more

Yes best think to do, it's waste of resource to do that in splunk.. ... View more

this is not a good approach, rather than writing this you can count the number of "|" pipes and group them in rex command e.g."tel:001001(? ((\d+|)){60}. But i agree splunk will be slow with this much regex processing. ... View more

Activating the question 🙂 ... View more

should be fields instead of field ... View more

I have updated the answer could you check now? ... View more

Now it's upon you. No one has provided any simpler way to go with a scripted mailing. Everyone has done on their own. The alert parameter "%SPLUNK_ARG_8%" which gives you a results.csv.gz can be extracted and manipulated to give you result you want. you can refer sendmail.py file to convert into html or you can take a look at the below. the logic will be the same using any of the language you know _http://www.ctroms.com/blog/code/python/2011/04/20/csv-to-html-table-with-python/ ... View more

What is the value are you getting? i had the same issue while doing same sort of calculation. Splunk doesn't provide you correct time difference as it always calculate on epoch time format. I had some help earlier _http://answers.splunk.com/answers/98294/epoch-time-to-conventional-time ... View more

its the aggregate functions which are not filling zeros, which i think is correct. i tested with index=_internal | bin _time span=1h | stats count by _time sourcetype | makecontinuous _time span=1h | timechart span=1h count(count) by sourcetype limit=500 it still gives zero. For other cases you need to use FILLNULL. ... View more

if you bucket, the stats will have very less data to compare, I have done it in some of my graphs where the granular level details doesn't really affect the final outcome very much. e.g.consider on 17th you may have 1000 events. if you do a stats then it will go through each timestamp to findout which is the min and max rather the first and last. But if you bucket it to 1 hours and considering 50 events per hour the stats input will become only 20 events which is faster right? this is what i understand and in my dashboard it takes way less when i compare monthly data. ... View more