Hello, Could you try with this. The sub search needs to have [|search ... ] and the field actually you are comparing. Means the subsearch should return orderID instead of 2 different fields. index=b2bapps "Order not fulfulled" | table OrderID|where OrderID[| search earliest=-40d | rex "String>(?<orderupdate>[^<]*)<" | eval Date=strftime(_time,"%d-%m-%Y") | where OrderID not null]| table transactID, Date, OrderUpdate If you have OrderID from some source type to compare with then you will definitely get the result. ... View more

Hello, Are those splunk instance are with enterprise license? are those having same indexes? If at all you dont have forwarder then you can install them and forward to as many splunk indexer you want. The configuration needs to be done in Outputs.conf where you want to send. If the it's linux machine you can monitor the log using inputs.conf file. [tcpout] defaultGroup=indexer1,indexer2 [tcpout:indexer1] server=10.1.1.197:9997 [tcpout:indexer2] server=10.1.1.200:9997 Reference: _http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Configureforwarderswithoutputs.confd _http://docs.splunk.com/Documentation/Splunk/6.0/admin/inputsconf - > [monitor:// ] ... View more

Mus could you post the same in the answer section. I know this in nothing but error generated by splunk which is handled and send in the email content. Sendmail.py has a block where it catches the error. But we all would be grateful if you could just post your idea and guide us towards the solution. Splunk provided so many things,but it seems many many things the user has to figure out themselves rather any provided splunk functionality. ... View more

No it doesn't take decimal value in cron schedule. ... View more

its not possible if you don't have a reference. you can make a outputcsv host.csv. then in the next search index=main sourcetype=ingest_logs status=error host NOT [|inputcsv host.csv]| head 10 by host | table _time host _raw something like this... ... View more

yeah 10000 is a limit set to control performance not a limitation as far as i think. ... View more

This should be set in bat file. C:WindowsSystem32WindowsPowerShellv1.0powershell.exe -NoProfile -File "E:Program FilesSplunkbinscriptsScript1.ps1" "%SPLUNK_ARG_0%", "%SPLUNK_ARG_1%", "%SPLUNK_ARG_2%", "%SPLUNK_ARG_3%", "%SPLUNK_ARG_4%", "%SPLUNK_ARG_5%", "%SPLUNK_ARG_6%", "%SPLUNK_ARG_7%", "%SPLUNK_ARG_8%" then in ps script $args[i], as per need. ... View more

Edited my answer, Thanks ... View more

Hello Prasant, See this tutorial. http://www.splunk.com/view/education-videos/SP-CAAAGB6 -> please check installing splunk on windows/ any other version. You can go ahead to see splunk site documentation as well. You can install splunk trail version to learn things. ... View more

was the email id with [email protected]. (.) Dot at the last point? ... View more

why not ERROR.+ only? ... View more

But do you have the same data distribution across all the indexers? Connections doesn't really matter from my perspective as they will always be connected due to heartbeat check.Other thing is how the search peer is configured from search head? It may also be possible the data resides under 2nd indexer so it keeps accessing it. Let have some view point from others as well. ... View more

Hello Flle, i saw that your CPU usage is not that much and the searches are fine with 20 instance of them are running. The only thing may happen is the searches are not efficient and usage more where clause. The index size ma be big and searching on the whole will take a toll on IO operations. We have 20/30 searches running but without much problem. If it's possible could you disable some of the searches and see whether performance goes up? if not try to configure some searches rather than realtime to run per minute or two, that would not be much of a difference. ... View more

Will this help? http://answers.splunk.com/answers/74749/fillnull-not-working-on-my-search ... View more

Where did you pass the environment variables? the bat file should contain the "%SPLUNK_ARG_7%", "%SPLUNK_ARG_8%" which passes the csv /search id? I dont know how you are getting the result and emailing but this should be passed to .ps1 script to make any splunk result manipulation. Check with Splunk\bin\scripts echo.bat and try to work again. ... View more

Thanks Martin, So does it mean there is a separate license for giving services if the Sideview Util modules are used in your app? We are not selling anything it may be used for some of our dashboards if required. Does it adhere to the Paragraph 1 which allows us to use between the employees? ... View more

Hello Craig, Are you able to ping the site from your desktop? Try to get use PING and Telnet splunk_server 80. Both will allow you to get the status whether it is reachable or not. If not try to turn off the firewall and connect. Mostly it happens due to firewall or connectivity route. Thanks ... View more

Then how are you going to configure the scripts in inputs.conf? If you are just looking for the directory, a simple vb script to check on the splunk registry to get the installed path. ... View more

Why not declare a environment variable as you know where the splunk forwarder installed. and replace them until \etc. Any reason why it can't happen? ... View more

go to perfmon, check if the counters are present or not. Write the exact names with spaces, or check with my earlier comment restoring the perfmon counters if missing ... View more

It is a column chart. While generation report it comes with no indication of a exact value of the parameter. I had to say there is no functionality in splunk currently to the requesting party :(. Actually i was expecting some magic from you. I don't know how to embed the above suggestion to my implementation. Please guide me. Thanks. ... View more

Hello, I don't think if the field contains only number the arithmetic operations will take them as string, sum / avg should work. How ever you can also use to convert to number : tonumber() isnum() also can be used to check the value if its number or not. ...|Convert num(filed) as Number_Filed also can be used http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/CommonEvalFunctions ... View more