Refer this http://splunk-base.splunk.com/answers/24470/buckettimechart-and-dedup ... View more

Use transaction to group the results per hour, then apply the dedup. Thanks ... View more

If you want to get rid of the data of the specific sourcetype please use the transforms.conf file to null queue... And yes you can rename the _raw field as well, but its temporary. ... View more

Do you use monitor stanza more for the log monitoring? What all are the parameters being monitored? ... View more

We are running Splunk in VMs but we don't face this issue. It really depends on what task is being done on the system. What is the operation system? I would say there are some unnecessary things which runs in the background, get rid of those. Plan for scheduled jobs which are not real time. Index maintenance take a lot of the CPU as data comes to splunk. You have 8 CPU, if it supports visualization with support for threads then at a single moment 16 searches can run, So i don't see resources are being consumed this heavily. Use the splunk SOS app where the CPU may be consumed and decide.. ... View more

If you can calculate and evaluate the time difference, the search result will come as you want. ... View more

why not use a lookup, that will be easy and will be reliable with more results coming in future. You can also use CASE for this as well. ... View more

So is it working now? Need to install the JAVA SE and make the ENV variable properly... ... View more

It's the basis of creating roles now in Splunk. I would also like to have an option where we can choose option which index is not accessible. while index creation it would be hard to maintain which role it belongs to. ... View more

Jorge do you mean, you want the alert again at 00:00 AM nextday again? If yes it will be hard if you set Throttling. For this you can use cron schedule. I am not sure if we can skip the alert for the same day setting up throttling time. Thanks 🙂 ... View more

For the below requirement i would do stats count only, But will not be able to show other details. I would do a join to just show the count. http_status="500" | stats count by url|join host[http_status="500" | stats count(http_status) as Error_Count]|table server_name,client_address,url,http_status_description, http_method, http_version, user_agent, referrer,count,Total_Error_Count|where Total_Error_Count > 100 this will show you Total_Error_count same for each of the urls/ips. Hope this gives you a hint, but it's not the correct condition for alert to see. ... View more

Hello, i would say like: http_status="500" | stats count(http_status) as Error_Count by url|table server_name,client_address,url,http_status_description, http_method, http_version, user_agent, referrer,Error_Count|where Error_Count > 100 You can also get rid of some fields which are not really required, to keep the result table clean. ... View more

Hello, By using the table we can set the order of the fields to display, if i got the question correctly!! ... View more

Me too, but i guess the question is whether it will only skip the particular day or it will count 24 hours from the alert generated. The answer will be 24 hours from the time its generated if the condition still persists. I hope i understood the paradox written above 😉 ... View more

Rather than limiting search term , a role with specific index access will be a good practice. ... View more

Please accept the answer if it was the solution/helpful!! Thanks ... View more

Use the alert condition "if number of events" > 1 in the Splunk UI. You can also add the below condition to the savedsearch.conf as well: quantity = 1 relation = greater than Thanks ... View more

Using timechart it's not possible as the values sorted will be distorting the time in the chart. Better use the stats function and do the calculation after the eval. Then apply the sort function. Thanks. ... View more

Happy to Help!! 🙂 ... View more

Hello Konstantin, I seems like that _time is converted to the epoch format. But if you want to show it in the conventional format. Please use the strftime() fuction before you do the table eval TimeStamp=strftime(_time,"%d/%m/%y %H:%M:%s %p")|table TimeStamp, Thanks ... View more

It overlooks the existing definition if the index is defined in system folder. If the indexes.conf is defined in the app folders, it depends on the precedence of the app[http://docs.splunk.com/Documentation/Splunk/latest/admin/Wheretofindtheconfigurationfiles -> How app directory names affect precedence ]. I have tested myself, splunk works fine. It only creates a new folders with same index names. But i am not sure about the old data if it's searchable or not. there is a good explanation of it, slightly related to the question http://splunk-base.splunk.com/answers/50881/indexesconf-location ... View more

Was it running before? If you want to start the service go to splunk_home/bin splunk start/restart. And you dont have to worry about the chown command. In windows it's flexible. Run it under administrator/if you have any other account to run under. Thanks. ... View more

How did you add the log? from splunk UI? If the option is not selected to continuously collect data, then it will be monitored only once and you will not get the data anymore if it's deleted. Need to add it again. ... View more

I am not familiar with java script programming as well. But if you hide the filed doesn't mean the field is not there is the resultset, hence relevant column values shows up!! But I may sound stupid for my analysis. ... View more

What's the time interval chosen for the search? as you can see the time in the log will be the index time, it will not be recent data. All other configuration is correct. ... View more