Hi all, Do we need to enable counter in client sytem to collect in the splunk server? Thanks Sathish R ... View more

Hi All, Cron notation for Bi-Weekly schedule alert in Splunk ? * * */2 * * === Is this works? Thanks Sathish R ... View more

Hi all, I would like to diplay only the row please help ser Captured Processe Co1 col3 col4 .. .. .. Serv01 482 84107 Serv02 497 84162 Serv03 482 84150 Serv04 457 84087 Serv05 500 84175 Serv06 494 84206 Total 2912 504887 .. . . .. . . . .. I need ser Captured Processe Co11 col13 col14 .. .. .. Total 2912 504887 .. . . .. .. . . ... View more

Hi All, Is that possible to view the result in multiple table for single search in Splunk not in dashboard? Thanks Sathish R ... View more

Hi All, Where do we find date of creation for Knowledge objects (Searches and reports, Event types, Tags, Fields and etc....) in splunk? Thanks Sathish R ... View more

Hi All, we had configured splunk to get the perfmon counter data from server (every 5mins). The counter value gets reset frequently. We found that raw data is not coming in the Order (time sorted). And some time the counter value is getting incremented with in second as shown below. we cann't use sort . it limits for 10,000 (as per standard conf). we are receiving more then 10 lak events per day in perfmon data is comes like below per sec Date Server counter Value 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3932 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3929 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3937 Expected : We are expecting as below. Date Server counter Value 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3937 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3932 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3929 We are using Stream stats to calculate the total capture message per day. Query: index=win_srv_perf (object="XXXXXXXXXXX") counter="XXXXXXXXXX" host="XXXXXXXXXX"| eval Time = strftime(_time,"%m_%d_%Y_%H_%M_%S") | streamstats current=f last(Value) as newValue by host counter | eval msgDiff=(if(newValue>=Value,newValue-Value,newValue)) | table Time DumID host counter Value newValue msgDiff | stats sum(msgDiff) as value by host counter ... View more

Hi All, I have data like following in need to get the differents count. Count will get reset in certain time period. Please help Expample Data Time Count Server 1 0 A 1 2 B 1 8 C 1 1 D 2 2 A 2 4 B 2 0 C 2 2 D 3 2 A 3 2 B 3 14 C 3 8 D Result Table A =2 B = 4 C= 14 D= 7 Thanks Sathish ... View more