Hi, I have a weird issue with a bunch of files that I have recently started indexing. A whole bunch of these will end up in the index with missing events (typically missing 1 or 2 events). For these files I'm seeing reports like: 09-27-2012 11:08:05.908 +0300 INFO WatchedFile - Will begin reading at offset=253 for file='/path/to/file.log' Why does the forwarder skip events like this? ... View more

Hi, I'm getting this warning every hour, on top of the hour, when apparently quite a few scheduled searches are triggered. The system is approaching the maximum number of historical searches that can be run concurrently. current=19 maximum=20 Now, I understand that this does not necessarily cause a problem, since the searches will be slightly postponed. Correct? However, the CPU usage on all cores for both search heads is very close to 0%, constantly. So it seems that increasing max_searches_per_cpu slightly could be appropriate, but I can't find documentation explaining what good values are. The CPU model is Intel(R) Xeon(R) CPU E7- 2870 @ 2.40GHz . There are 4 cores per search head and 8GB RAM. Any opinions? ... View more

Hi, I'm trying to set timestamp recognition for a sourcetype, in order to avoid recognising timestamp in the event's raw data. # props.conf: [my_type] TIME_PREFIX = ^\[a-z]{3}\s* TIME_FORMAT = %b %d %H:%M:%S %Y # Also tried: # TIME_PREFIX = ^ # TIME_FORMAT = %a %b %d %H:%M:%S %Y MAX_TIMESTAMP_LOOKAHEAD = 25 SHOULD_LINEMERGE = False LINE_BREAKER = ([\n\r]+)(?=\w{3} \w{3} \d{1,2} \d{1,2}:\d{1,2}:\d{1,2} \d{4}\) TRUNCATE = 999999 Well, the actual do get recognised correctly, but I'm afraid Splunk also recognises other date strings. Not consistently, though. Sometimes these timestamps are part of an event and sometimes they trigger a new event. Tue Aug 21 23:03:51 2012 ALTER SYSTEM ARCHIVE LOG Tue Aug 21 23:03:51 2012 Thread 1 cannot allocate new log, sequence 10216 Private strand flush not complete 2012-07-22 17:49:47 Thread 1 advanced to log sequence 10215 (LGWR switch) Current log# 3 seq# 10215 mem# 0: /bla/bla/bla/bla 2012-07-22 23:01:51 Archived Log entry 10214 added for thread 1 sequence 10214 ID 0xb9999999 dest 1: 2012-07-22 23:03:51 ALTER SYSTEM ARCHIVE LOG 2012-07-22 23:03:51 Thread 1 cannot allocate new log, sequence 10216 So, in this sample, all of the dates from July (with the YYYY-mm-dd format) SHOULD be part of the event with the time stamp 'Tue Aug 21 23:03:51 2012', but this is not the case. One line does end up in that event, but the rest are split into two different events in July. What am I missing? Whatever I do with TIME_PREFIX and TIME_FORMAT , the forwarder seems to completely ignore these. Update I tried to use the data preview feature, which correctly parsed the events. The resulting props.conf looks like follows: [my_type] MAX_TIMESTAMP_LOOKAHEAD = 25 NO_BINARY_CHECK = 1 TIME_FORMAT = %a %b %d %H:%M:%S %Y TIME_PREFIX = ^ pulldown_type = 1 However, using this in the universal forwarder does not help me one bit... I get the same results. ... View more

Hi, I'm using streamstats to calculate the median for a field and timechart to see the count of events where the field has a value less than a median. ... | streamstats median(bytes) as meby|eval snap=if(bytes>=meby, bytes, "smaller") |timechart count by snap I just want a clarification whether my assumption is correct. My assumption being that meby will contain the median for all the values of bytes from the entire search. Is my assumption correct? ... View more