do you the see the new outputlookup file in the lookup directory? ... View more

configure the [dbmon-dump://..] to load the whole Table at once. Then configure the DB-tail to monitor it , but you wont be able to change the events once they are indexed. ... View more

where do you check for the file? Manager » Lookups » Lookup table files Choose the application under which you are running the search. lookuptable.csv with full path will be mentioned ... View more

Hello Heinz, When you do outputlookup the file goes to system dir in the splunk etc dir. The inputlookup sees the file in your app/lookup folder in the app context. Everything is correct what you are doing , you need some more param. your desierd query: | dbquery mysearch | outputlookup createinapp=true lookuptable.csv then try the inputlookup createinapp Syntax: createinapp=<bool> Description: If set to false or if there is no current application context, then create the file in the system lookups directory. See the documentation : http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Outputlookup Thanks, L ... View more

Try Chart instead of timechart |bucket _time span=30m|chart avg(Value) by _time,counter,host |bucket _time span=30m|chart avg(Value) over host by counter have not tried it myself but this is the way to go. Check out chart overlay in the documentation Thanks, L ... View more

pyhton.log will actually show you if the script is triggered or not. If not it will show you the error why! moreover if you are using arguments to take the csv file path for the search double check if it is the right argument. enable logging for your python script to see if it even going inside it or not ... View more

DO look at search head pooling documentation. Deployment server you have to use no other option for you when you are having more than 1000 forwarders 😉 ... View more

As i see you "Dont want to create the lookup table.". And even you run on million records there will be only one value which is the latest A. And as i see you require the A from dynamic set of record not static lookup will help. You may need to calculate the latest A on basis of day or hour and use |outputlookup and append the values to lookup file. Then you use the inputlookup to find B. or you may also MAP command to achieve the same ... View more

Hello Yu, Try the below one. index=xxxx [|search index=xxxx | stat latest(A) as A]|table _time,B Thanks ... View more

First step before migrating between platform is to check the network connectivty Ping alpputl018 telnet alpputl018 "receiving_port/9997" new server will not be having the receiving configured. Check it right away. Check the forwarder logs what is the issue if is not able to connect. Thanks, L ... View more

by any chance is it a forwarder installer? 😄 ... View more

if you have some org specific email id which deviates from our general email format you may take a look at the below answer. Splunk has mentioned a specific email id format. http://answers.splunk.com/answers/124873/alert-email-address-doesnt-allow-our-domain Thanks ... View more

if the file modification time can be assigned to the splunk event then it will work. |stats latest(_time) as LastModified|where LastModified < now()-600 ... View more

same, easiest way to filter the required value is to tell which are the one not required. e.g. (index=a AND fieldA!="xyz") OR (...) OR (...) OR using lookup (index=a AND ([|inputlookup lookup_file.csv|table fieldA]) OR ... While using subsearch keep in mind there will be truncation if you have more than the defined limit (limits.conf) ... View more

Hi Yu we could use a little specific information. The fields you want to use in the join sub searches can be filters as per your desired value. If all of them are having common fields then you can do a search like index=a OR index=b ...|stats (fuction) by A ... View more

I am not sure about the search . But processes.log will become your throttling field name. As once you receive it you don't want to get an alert until next 24 horus. ... View more

as @davidpaper suggests it does the change on a global basis. ... View more

@w-1d would take ... View more

yeah that is correct not a problem. check the dbx.log file what it says , any error recognizing the time field. Could you contact me on my mail id on profile, would take a look on team viewer. It's really weird it still doesn't work for you! 😞 ... View more

your configuration is wrong. the source name is wrongly mentioned. just keep the below in your props.conf [PostedOrders] MAX_DAYS_AGO = 5000 TIME_FORMAT=%s check for the oldest event after you index the records. sourcetype=PostedOrders|stats last(_time) as last_time by sourcetype|convert ctime(last_time) if you see 2005 timestamp that's it!!! All the best ... View more

por_POSTING_DATE if it is your datetime field it should be in epoch time format. You should set it as TIME_FORMAT=%s . and add this as well in props.conf MAX_DAYS_AGO = 5000 . it should give you the exact date as your DB record. Hope it finally does the trick. ... View more

does your dbquery return any records? eval should be placed after your parent query. ... View more

...|eval dbconnector=xxx|fields + dbconnector |stats count by dbconnector ... View more

...500 | stats dc(WEB_IP) as TEST2 by _time | eval TEST1=WEBURL." ".TEST2 | timechart count by TEST1 ... View more