I want to precise my search. Initially I want to run a custom search and based on this search I want to display all result within time range. e.g. sourcetype="TAFC_LOG_LINE" COREDUMP_BEGIN OR COREDUMP_END | reverse Above search will return something like this 1 6/12/12 12:23:46.278 PM E0612 12:23:46.278826 62213 tafc_logger_c.cpp:45] jrunADebug.c:6689 COREDUMP_BEGIN 2 6/12/12 12:23:46.281 PM E0612 12:23:46.281303 62213 tafc_logger_c.cpp:45] jrunADebug.c:6694 COREDUMP_END Now I want to search all results between above two events. Thanks Manoj ... View more

I created a Dashboard from following search sourcetype="TAFC_LOG_LINE" MANAGER | table _time _raw TransactionUUID | rename TransactionUUID as UUID | streamstats range(_time) as Duration by UUID | where Duration > 0.0 Now in Dashboard there is two option UUID Duration When I click on duration I got above error with below message PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'streamstats' command Here is the XML for Dashboard <?xml version='1.0' encoding='utf-8'?> UUID Chart UUID UUID line ... View more

Simple question - I don't want to display all lines starts with "E or I or W or F" what's wrong with above regular expression? Display all lines start with "E or I or W or F" sourcetype=TAFC_LOG_LINE | regex _raw="^[IEWF]" Don't display all lines start with "E or I or W or F" sourcetype=TAFC_LOG_LINE | regex _raw="[^IEWF]" even with below regex I am always getting lines starts with E sourcetype=TAFC_LOG_LINE | regex _raw="[^E]" or Am I doing wrong? ... View more

Hi I have installed another forwarder in Windows 7 machine with default setting and a directory name for monitor log files. after installation Splunk start send data to main instance. Now question is where is default configuration(monitoring directory path) saved? Thanks ... View more

I want to exclude all files that contain some keyword from splunk forwarder, I have added an entry in prop.conf. [monitor:/home/default/log] blacklist = (WARNING|FATAL|ERROR$) but still my search result return some file that contain WARNING keyword in the file name. can you please tell me what is the wrong here? ... View more

Is there any way to ignore first three line from my text format log? ... View more

My log file is similar to below and search is I0530 14:28:10.394402 29432 tafc_logger_c.cpp:42] demoprogram.b:9 [manoj] [MYCOMP] [DEMO] End Transaction - End Message ... ... I0530 14:28:06.406689 29432 tafc_logger_c.cpp:42] demoprogram.b:2 [manoj] [MYCOMP] [DEMO] Start Transaction - Some Message Now I have two question 1. How to convert this log information in to table? Table format should be like this Date Time User Component Message How to calculate time difference between two events? from above log I want to calculate time difference Transaction Time = 0530 14:28:10.394402 - 0530 14:28:06.406689 Thanks ... View more

What is the difference between Choose a Data Type and Choose a Data Source. I want to monitor only directories that contains some log file and log format is simple text. If there is no difference then why there are two option to add data and id there is difference then what is the difference? Thanks ... View more

I had setup a forwarder to monitor the directory and didn't specify any source type. Splunk automatically create some sourcetype in search app. I don't want these source type and now I want to delete all of them but I am getting some error while deleting. I am trying to execute below command. sourcetype=log-too_small | delete I am getting below error Error in 'delete' command: You have insufficient privileges to delete events. While I am logged in as a 'Admin' any clue what is wrong??? Thanks Manoj Jangid ... View more

I am struggling to send data from remote machine to Splunk server due to lack of quality documentation. can anyone tell me how to activate forward server? C:\Program Files\SplunkUniversalForwarder\bin>splunk.exe list forward-server Active forwards: None Configured but inactive forwards: 169.254.131.1:9997 Thanks ... View more