Can you post the script up here as it's likely something in the way the script is capturing the application name. ... View more

Are you verifying the search in real-time the same way you are scheduling it? I wonder if real-time can't keep track that far out. ... View more

Not to dig up old stuff, but I am at a loss as to what changed since I posted this. I found that the automatic lookup was set to global and changed it to this app only and now it works fine within the app and doesn't throw errors in other apps. I know that I have not upgraded since my original post, so perhaps it was just an oversight on my behalf. ... View more

In this particular example it is just determining the transaction duration, and even in martin_mueller's response to the following thread it still seems to create a new view of the data which I'd modify to my taste... http://answers.splunk.com/answers/133288/transactions-grouping-actions-and-matching-on-multiple-fields.html something like; | stats range(_time) as duration first(myfield) as myfield by transactionID But I don't see a way to then search that for the string "hello". You may have to use the transaction command if you want to do post-transaction searching. Hopefully someone can correct me on that and show us both how to use the stats command to do so. ... View more

The transaction command is a start, though I think there's a more efficient way to do it. index=myindex <other search terms> | transaction id | search hello While this will work, the problem as you can see is that the first search has to gather all matching events before handing off to the transaction command, which then has to be searched again. ... View more

Disregard, just read further on that link and found why. Now to figure out how to use that masterLegend property I guess. ... View more

And I'm even further confused as I just looked at another panel on the same dashboard which shows a different order being picked up. <option name="charting.legend.labels">["Other Bad Stuff","Other Good Stuff"]</option> <option name="charting.seriesColors">[0xDF0101,0x088A08]</option> ... View more

A slightly less blinding green & red (more Christmas'y) <option name="charting.legend.labels">["Bad Stuff","Good Stuff"]</option> <option name="charting.seriesColors">[0x088A08,0xDF0101]</option> Oddly I am confused on why the order of the labels doesn't match the order of the colors? I just copied that directly from a dashboard (redacting only the verbage) and it shows "Bad Stuff" as 0xDF0101 (slightly dark red). ... View more

I'm curious on this one. I've never been able to index anything into splunk aside from via the admin user. I've even created a role (back in 4.2.2) and granted it every permission available and still not been able to upload anything that way. I'd think summarizing into an index would follow suit as it's uploading data to the index. ... View more

Heh, I wasn't even paying attention to what the example data was. Yeah, you probably don't want to remove that line totally. A SEDCMD regex could be used to zap the ^M characters without burning the whole line from the event. But, your other answer below looks like a good route to explore first. ... View more

As an aside, I usually see the ^M character show up in files written by Windows systems and transferred to Unix. I get rid of those characters using a dos2unix command (i.e. dos2unix ctrlmfile newfile). Is it possible to do that before you index the file? If not, if you are planning to discard the events with ^M characters totally, then you'll need to employ a props.conf/transforms.conf config change to route these items to nullQueue. See the following answer which may help guide you. http://answers.splunk.com/answers/108326/regex-and-nullqueue-problem.html ... View more

Yes, there is. You can receive over TCP or UDP ports. http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports ... View more

Have you looked at addtotals or addcoltotals? I'm not 100% sure how they react inside of a transaction though. It might work for the duration, but for Value1 it looks like you'd really need a subtractcoltotals which doesn't exist. ... View more

I'm not sure if I missed it, but what version of Linux? ... View more

What @ppablo_splunk stated would plot the count of SubZoneName over 5 minute increments regardless of the value of SubZoneName. I think @a212830 is looking for duplicates of the values in SubZoneName during a 5 minute window. Perhaps a transaction command coupled with linecount>1 search would work. index=euc_vcdata sourcetype=VCSZoneInfo | transaction maxspan=5m SubZoneName | search linecount>1 ... View more

The first two are constant (splunkd -p 8089...). The third looks like a maintenance process and might not be there all the time. I'd go with 2 minimum for your process monitor (i.e. greater than 2 = good). ... View more

Seems to me that you can, the documentation here doesn't seem to specify only heavy's http://docs.splunk.com/Documentation/Splunk/6.1.4/Security/Aboutsecuringdatafromforwarders ... View more

I'd say you'd want to setup your inputs.conf on the server where you are getting these .err files such that you index all the files using a regex "*" in place of the unique directory. [monitor:///path/to/files/*/*.xml] ... [monitor:///path/to/files/*/*.err] ... Then you can extract that unique directory using rex expression. You can then put those together in a transaction and search for the failure string from the .err file and extract the values you need base search | rex "\/path\/to\/files\/(?P<transID>[\w\d]*\/.*" | transaction transID | xmlkv | table field1 field2 SENDID GFM ... View more

I believe it does narrow the search results with each one via a map & reduce function. Johnathon Cervelli described this stuff to me in a SplunkLive a few years back and I believe it does a search where it finds the first term (map), then using that subset (reduce) it performs a search with the second term (map) and narrows the field down further (reduce), then repeats for each term. The one way to slow it down is to put it all in quotes where it then has to do a couple additional searches to ensure the terms are in order specified in your quotes. ...edit - oops, I meant for this to be a reply to your last message ... View more

This is an interesting use case. I'm not aware of any way to tell splunk only to index the files if it sees a .err file. You can index all of them, then alert based on the presence of the error message. You would need some kind of transaction ID that is shared between the 2 xml & 1 err file in order to get the specifics you need. Perhaps the unique directory name could be used as that transaction ID. You would then use the xmlkv command to extract the SENDID and GFM values extracted into your report also. ... View more

If you can't do SoS, then here's a simple search against the _internal index that works for me; index=_internal sourcetype=splunkd version source=*metrics.log | table hostname os version build ... View more