Hello, can you provide more information like where exactly are you facing trouble. Did you ingest applogs into splunk and can't see them? OR Do you want help with how to ingest applogs into splunk? ... View more

Yes. Use throttling to suppress alert triggering for a specific time period. Save your search SourceName="MyAppLog" Message="Data Sync Error" as alert and configure Throttle under "Trigger Conditions". Any notifications after the 1st one will be suppressed for 5 minutes. ... View more

Hello @dhirendra761, Here you go. Add below settings in props.conf. To extract more fields, use/tweak the regex a little. For example, to extract onlineAvailabilityData use, EXTRACT-onlineAvailabilityData = \S+onlineAvailabilityData\\?\"?\:\\?\"?(?<onlineAvailabilityData>\w+) [your_sourcetype] EXTRACT-deliverableType = ^\S+deliverableType\\?\"?\:\\?\"?(?<deliverableType>\w+) EXTRACT-docType = \S+docType\\?\"?\:\\?\"?(?<docType>\w+) EXTRACT-docId = \S+docId\\?\"?\:\\?\"?(?<docId>\w+) ... View more

It worked for me in 6.5.3. Please be sure to make the change under $SPLUNK_HOME/etc/system/local/ui-prefs.conf file. Changes made anywhere else will have low precedence. ... View more

No. These settings disables metadata searches in the landing page ONLY. ... View more

I see ya. I've been there couple of times:) Happy Splunking! ... View more

Hi there, I found two errors in your search query. You have an extra closing ) in the 6th eval statement - | eval PROD = if("TAF-P"==substr(Computer,1,5),Duration,0)) You have an extra closing ) in the 8th eval statement - | eval SP = if("TAF-SP"==substr(Computer,1,6)),Duration,0) ... View more

You can make use of splunk docs, blogs and answers community. Exploring Splunk is also a good goto book available for free. Please note that, you can't write any splunk certification exams without taking official training offered by Splunk. You can find more info about certification paths here. ... View more

Unfortunately, I can't access G-drive links due to security reasons at my work place. But, I will guide you through the steps to extract fields using Interactive Field Extractor (IFX) . Access the field extractor: Click Extract New Fields from the bottom of the fields sidebar. Select sample event: In the event list, select a sample event that has one or more values that you want to extract as fields and click next. Select Method: Click Delimiters and use , as the delimiter and click next. Rename fields: Click on fields that you want to rename and enter the desired field names. Validate your field extraction: Review the event list table to see which events match or fail to match the field extraction. Review and save: Here, name your extraction setting (ex. REPORT-custom_json) and Set Permissions to App to make this extraction available at app-level and click save. To manage the field extractions which you just created, please navigate to "Settings -> Fields -> Field Extractions". To have a look at the extraction in the back-end, navigate (thru CLI) to $SPLUNK_HOME/etc/apps/app_which_you_used_in_final_step/local/props.conf and transforms.conf Please review the docs if you're struck. HTH! ... View more

Great. Please accept the answer if it helped you. ... View more

Is it giving any error? Are able to see ROUTEORDER field under interesting fields section? Also, can you paste a screenshot of data along with your search. ... View more

Whenever a file is created or modified, splunk will monitor it immediately. ... View more

Sure. But can you give me the exact sample data. The reason I ask is, the sample data above and the data in your screenshot doesn't match. Use 'code sample' function (the one with 101010 or use ctrl+k option) to paste text as is. ... View more

Hi there, Please look at splunkd.log file (located at $SPLUNK_HOME/var/log/splunk) for errors or warnings and provide some data to further assist you. ... View more

You can add this schedule_window = auto to the savedsearches.conf under $SPLUNK_HOME/etc/users/local. But please read these points before doing that: * Defaults to 0 for searches that are owned by users with the edit_search_schedule_window capability. For such searches, this value can be changed. * Defaults to "auto" for searches that are owned by users that do not have the edit_search_window capability. For such searches, this setting cannot be changed. More info is available in savedsearches.conf.spec file under schedule options section. ... View more

If the object types are private, then you should get admin_all_objects (admin role has this) capability assigned to you in order to view object types owned by other users. If the object types are shared globally, and you have a power user role, then you should be able to see them. I have admin role and I can see Macros and Lookups under 'All Configurations'. Hope this helps! ... View more

Only users with the Admin role can reassign knowledge objects to new owners. You can find more info here. ... View more

It specifies that "window" of time (in minutes) a search may start within. For example, let's say you scheduled your alert to run at 9:00 AM with a schedule window of 2 (minutes), the scheduler will keep 2 minute window open for the alert to run. Meaning, if scheduler is busy at 9:00 AM, it will still try to run your alert at 9:01 AM or 9:02 AM. From docs: schedule_window = <unsigned int> | auto * When schedule_window is non-zero, it indicates to the scheduler that the search does not require a precise start time. This gives the scheduler greater flexibility when it prioritizes searches. * When schedule_window is set to an integer greater than 0, it specifies the "window" of time (in minutes) a search may start within. + The schedule_window must be shorter than the period of the search. + Schedule windows are not recommended for searches that run every minute. * When set to 0, there is no schedule window. The scheduler starts the search as close to its scheduled time as possible. * When set to "auto," the scheduler calculates the schedule_window value automatically. + For more information about this calculation, see the search scheduler documentation. * Defaults to 0 for searches that are owned by users with the edit_search_schedule_window capability. For such searches, this value can be changed. * Defaults to "auto" for searches that are owned by users that do not have the edit_search_window capability. For such searches, this setting cannot be changed. * A non-zero schedule_window is mutually exclusive with a non-default schedule_priority (see schedule_priority for details). ... View more

Hi there, Can you tell me how did you deploy this app to your search heads. Using a deployer or manually installing it on each search head. ... View more

Try looking for information in splunkd_stderr.log and splunkd_stdout.log . These log files contains some information about startup process. PS: File path is same, /opt/splunkforwarder/var/log/splunk/ ... View more

As stated by @DalJeanis, if the assumptions are correct, then your search would look something like this: Your_basic_search | rex field = _raw ".+finance\S+\;GET\s(?<URL>\/\w+\/\w+\/\w+\/)" | rex field = URL "\/\w+\/\w+\/(?<TransactionName>\w+) | rex field = _raw ".+\;(?<avg_Responsetime>\d+)\;\"\-\"" | eval TransactionName=upper(TransactionName) | stats count by TransactionName as Hits | table URL TransactionName avg_Responsetime Hits | outputlookup foo.csv Note: If your search heads are clustered, then use outputlookup command, otherwise use outputcsv command. ... View more

Are all these events coming from 1 source/host? Also, why do you want to forward each event to each index. ... View more

Can you provide some sample events with values which you want to route. ... View more