Hello, We are looking to install a splunk universal forwarder to collect a debug log from an AD domain controller and the log can see peaks around events around 5,000 eps. Will the forwarder be able to handle this and what is the max number of events it can handle/can the indexer keep up? ... View more

Hello, We have the following search in a chart but the dates are sorting alphabetically rather than numerically. ie Aug 1, Aug 2, Jul 29, Jul 30 and not Jul 29, Jul 30, Aug 1, Aug 2. index=reporter | dedup TKT_NUMBER | eval time=strftime(_time, "%b %d") | bucket time span=1d | chart count over NOTIFY_GROUP by time useother=f | rename NOTIFY_GROUP AS Group ... View more

Hello, We have the Splunk windows app setup to monitor the system eventlogs on our citrix server and it appears to be pulling in the wrong information for task category. Below is an example of the event in splunk and the actual event on the server where the TaskCategories do not match up. Any ideas on where it would be setting this incorrectly? Thanks! ... View more

Hello, We have the following table with this search but would like to drill down to a table with just the ticket detail for that particular day we select rather than the raw events. Which advance xml or guide should we reference to help with this? Here is the search: index=reporter | dedup TKT_NUMBER | eval time=strptime(LASTOCCURRENCE, "%b %d %Y %I:%M%p") | bucket time span=1d | convert timeformat="%b %d" ctime("time") | chart count by NOTIFY_GROUP, time | rename NOTIFY_GROUP AS Group ... View more

Hello, We have the following chart which displays current ticket counts over the last 7 days for different groups but need to be able to sort on the count for the last day. In this case we would need to sort on Jul 30 but it would need to be dynamic and always sort on the most recent date in the chart. Here is the search we have: index=reporter | dedup TKT_NUMBER | eval time=strptime(LASTOCCURRENCE, "%b %d %Y %I:%M%p") | bucket time span=1d | convert timeformat="%b %d" ctime("time") | chart count by NOTIFY_GROUP, time | rename NOTIFY_GROUP AS Group Is this possible? ... View more

Is there a way to pass a timechart span variable to a saved search being called from a drop down? Is there a way to pass it strictly through the xml? ... View more

Is it possible to define field extractions on the indexer and allowing the search head to use the extractions? Or can they only be defined on the search head? ... View more

Hello, We have a database that we would like to do a trailing input on based on the incrementing ID. Once it is indexed into Splunk via the query, if that record on the database is updated will Splunk pickup that change and update the indexed record? If not should we use the dump option? My only concern with the dump option is duplicate records and how to overcome that. ... View more

Has anyone integrated Splunk v5 with netcool omnibus? I found previous posts on sending SNMP traps via a perl script and we have this setup and sending events but they do not seem to have all the data we would ideally like. For example, we are monitoring all our nix syslog data and have an alert that fires when a particular AIX ERRPT message comes across and sends an email and an snmp trap. Ideally, we would like in the trap, to contain the host that the message happened on and the particular ERRPT message that appeared but rather the data that comes across is almost meaningless. If we receive host data and messages in the trap we can build out logic on the netcool side to create tickets to the appropriate groups and their severity. If this idea is not possible are there other ways to integrate alerting to netccol? We could probably send an email and have netcool extract from that or perhaps write a custom script. Any help is appreciated! ... View more

Hello, We have the following format of a log starting with the first message in the log as Status_AdvCorrServerSerial = 0 then the last line of the event as RawCaptureTimeStamp = #, which we set at the timestamp. After the event in the format below there are 2 spaces between each event then it goes into the same format again. Status_AdvCorrServerSerial = 0 50 Some lines of material... RawCaptureTimeStamp = 1373987459 -new line- -new line- Status_AdvCorrServerSerial = 0 50 Some lines of material... RawCaptureTimeStamp = 1373987459 Here is our props.conf but it does not seem to properly break on all events: [ncpmonitor] NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true BREAK_ONLY_BEFORE=Status_AdvCorrServerSerial = TIME_PREFIX=RawCaptureTimeStamp = Is there something additional I should add to account for the 2 spaces between events or does this props.conf entry look alright? Thanks! ... View more

Hello, We are having difficulty finding the xvfb package or rpm. Does anyone know where we can find this for a RHEL 6 64bit server so we can install for our PDF server? ... View more