Hi, I tried to use post search to populate list options: <search id="baseSearch"> <query> <![CDATA[index=application host="myhost*" status<400| rex field=uri "\/(?<deptcode>[^\/]+)\/" ]]> </query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <fieldset submitButton="false"> <input type="time" token="field2"> <label></label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="d_name" searchWhenChanged="true"> <label>Select a department</label> <choice value="*">All</choice> <search base="baseSearch"> <query> stats count by deptcode </query> </search> <fieldForLabel>deptcode</fieldForLabel> <fieldForValue>deptcode</fieldForValue> </input> </fieldset> However, using single search works as expected: <input type="dropdown" token="d_name" searchWhenChanged="true"> <label>Select a department</label> <choice value="*">All</choice> <search> <query> <![CDATA[index=application host="myhost*" status<400| rex field=uri "\/(?<deptcode>[^\/]+)\/" | stats count by deptcode ]]> </query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <fieldForLabel>deptcode</fieldForLabel> <fieldForValue>deptcode</fieldForValue> </input Post search in panels in the same form also not working. Would anyone please help? Sorry for the newbie question. Thanks a lot. Regards, /ST Wong ... View more

Hi, I have 2 stanza in inputs.conf: [monitor:///data3/caa/caa7/] whitelist=access.*gz ignoreOlderThan=1d disabled = false followTail = 0 [monitor:///data3/radius/timpani] whitelist=radius.log*gz ignoreOlderThan=1d sourcetype=radius_log disabled = false followTail = 0 When I do a "splunk list monitor", found that all files (access.*gz) are listed in "Monitored Directories": /data3/caa/caa7/ /data3/caa/caa7/access.20120101-140525.gz /data3/caa/caa7/access.20120102-140525.gz /data3/caa/caa7/access.20120103-140525.gz /data3/caa/caa7/access.20120104-101251.gz /data3/caa/caa7/access.20120105-013825.gz /data3/caa/caa7/access.20120105-174037.gz /data3/caa/caa7/access.20120106-142004.gz while filenames are not listed for the 2nd stanza and only the directory is shown: /data3/radius/timpani I'm afraid if i've anything missed. Would anyone please help? Thanks and rgds /ST Wong ... View more

Hi all, We encounter Splunk server running out of disk space issue in past months. I tried to reduce maxTotalDataSizeMB and frozenTimePeriodInSecs from time to time for squeezing disk space. Currently it looks like the following: ------------ cut here --------------- [main] maxTotalDataSizeMB = 20000 coldToFrozenDir = /usr/local/splunk/var/frozen/main frozenTimePeriodInSecs = 864000 [p0f] maxTotalDataSizeMB = 20000 coldToFrozenDir = /usr/local/splunk/var/frozen/p0f frozenTimePeriodInSecs = 432000 ------------ cut here --------------- Seems default of frozen data processing is to delete them. However, raw data is still there and eats up a lot of disk space, e.g. in /usr/local/splunk/var/frozen/p0f for the p0f index, there are log of db_* folders: ls -l db_1415393077_1415384845_1994/rawdata/ total 112132 -rw-------. 1 splunk splunk 114815328 Nov 8 2014 journal.gz I daren’t deleting them manually. Would anyone please help? Sorry for the newbie question. Thanks and regards /ST Wong ... View more

Hi all, I tried to find log entries of same mail using queue id from sendmail log. However, for the same time span, following search gives different results. e.g. Gives all records at all time: source="/tmp/sendmail.txt" from="<userA@my.domain.hk>" | fields qid | reverse Only returns part of the records, with those at earlier time slots are missing: source="/tmp/sendmail.txt" [search source="/tmp/sendmail.txt" from="<userA@my.domain.hk>" | fields qid ]| reverse Would anyone please help? Thanks and rgds, /ST Wong ... View more

Hi, I'm trying to monitor new syslog events and send email when seeing new log entries. I tried to schedule search like following every 5 mins: * | eval interval = now() - _indextime | search interval <= 300 But seems to be clumsy. Is there any better and more accurate way to do so? thanks a lot. ... View more

Hi, I'm trying to create a view looks like following: [input ipaddr] [dropdown list] [input username] [Time selector] I add following code, but all boxes are in the same line. I tried <br></br> or <br/> but didn't work. <input type="text" token="ipaddr"> <default>*</default> </input> <input type="dropdown" token="bool"> <label></label> <choice value="OR">OR</choice> <choice value="AND">AND</choice> <default>AND</default> </input> <input type="text" token="username"> <default>*</default> </input> <input type="time"> <default>Last 7 days</default> </input> </fieldset> Would anyone help? I'm new to Splunk and web programming. Sorry for the newbie question. Thanks a lot. ... View more