Still this should be like this PERFMON -> Perfmon [Perfmon:CPU] counters = % Processor Time;% Privileged Time disabled = 0 instances = _Total interval = 120 object = Processor index = temp_index restart the forwarder service, lets see what happens ... View more

Depends which version of splunk you are using. Please use the below in inputs.conf in v5+ splunk forwarders [perfmon://CPU Load] counters = % Processor Time;% Privileged Time disabled = 0 instances = _Total interval = 120 object = Processor index = temp_index Remember the stanza definition is case sensitive. ... View more

Hello, It suggests the perfmon configuration in inputs.conf file is wrong, Could you post your stanzas? Thanks ... View more

Hello, Could you try this? ...|eval result=if(match(_raw," C "),"True","False")|... OR ...|eval result=if(match(_raw,"\sC\s"),"True","False")|... Thanks, L ... View more

The below will monitor everything.. [monitor://D:\Roll\DIP\SessionLogs\...\*.xml] index = myindex sourcetype = session_log recursive = true Thanks, L ... View more

Hello, You can use the outputs.conf file to configure the forwarding. It will work as heavy forwarder. But you need to specify the proper whitelist and blacklist parameters to forward correct set of indexed data. Also if you want to retain local copy you need to set up the index_forward mechanism. Please follow the documentation. link texthttp://docs.splunk.com/Documentation/Splunk/6.1.3/admin/Outputsconf Thanks, L ... View more

There is no parameter which we can use in splunk 6 dashbaord. So as a workaround just replace the |loadjob command instead of search string. ->Create the savedsearch and schedule them to run at your desired interval -> Create the dashbaord. -> Replace the search with | loadjob savedsearch="User:search:SavedSearch_name" User: the user which owns the savedsearch SavedSearch_name : this will be savedsearch name ... View more

Hello, This is pretty easy. Use the saved searches. Schedule them for particular or desired period. Use the pre-run data over and over without triggering a new search for multiple users. Thanks, L ... View more

Upgrade to atleast Splunk 5 more so to splunk 6, splunk 6 forwarders wont forward to 4.x indexers. ... View more

I am quite sure that indexer/ search heads at least needs to have a communication every 24 hours. There should not be any issue if there is a temporary disconnection. ... View more

It works. I thought the refresh will work, but the restart did the trick. ... View more

Sorry for getting in late 20140805140704.650149+120,21240,350,21240,60,0,48,12,313651,7277,69124096,41893 888,dtexec.exe /SQL "\APPLICATION_NAME" /SERVER " SERV ER_NAME " The above is one of the sample _raw data(single event). Check the highlighted one(SERV ER_NAME). Can't really post original set of records, but there is no pattern when the newline character is coming.. Props.conf DATETIME_CONFIG=CURRENT MAX_TIMESTAMP_LOOKAHEAD=150 BREAK_ONLY_BEFORE=\d{14}\.\d{6} NO_BINARY_CHECK=1 REPORT-dwh = package_Usage ... View more

Hello, below is the fastest way to get the time and host which is responsible for the data. |metadata type=hosts index=* It shows you the first and latest received event time and number of events. So try this. Thanks, L ... View more

that i was thinking, but there are so much data indexed, if no other option i have to go for SEDCMD. and the newline actually is not coming from the script outout which i can confirm. ... View more

i have to use replace in the search but for filtering it will not work for a larger data set which i can filter out at the source level only if i can remove that newline as a extracted field. ... View more

I am using a script to geneate the data which i am extracting at search time. What splunk is doing in _raw it inserts "\n" character at the end of the line if it is little large. e.g. my data looks like this 123,123,123,0,12,93,cmd "program_name parameter1 parameter2",234324 whats am doing is: i extract each field and program as "program_name parameter1 parameter2" many times i get values "program_name parameter1 para meter2" "program_name parameter1 paramete r2" "program_name param eter1 parameter2" like these ... View more

I have not tried, but can i use a replace in the EVAL-foo for search time extraction @martin_mueller ? i need to replace the newline character in that field but no answers till now 😞 ... View more

you cant change them now, you need to delete them all and re-index if you require single host name. ... View more

more info please. Use | table col1,col2,.... or fields -col1 to remove column or fields +col1 to add column ... View more

Hello Rob, If you are on Splunk 6 @martin_mueller 's answer will help you get the info. http://answers.splunk.com/answers/145995/alert-if-source-stops-indexing Or you can maintain a lookup table and make the comparison with metadata. Thanks, L ... View more

indexQueue is mentioned, so it will be indexed. Refer the document http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Datapipeline ... View more

it works on server 2008 i have tested, could you post your configuration? ... View more

Hello, The below would actually be appropriate in your case. NO_BINARY_CHECK = 1 TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N TRUNCATE = 0 SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE_DATE = true OR NO_BINARY_CHECK = 1 TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N TRUNCATE = 0 SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE =\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} Thanks, L ... View more