You need to edit these query according to naming of the field names in your data. ... View more

index=your_index status=succes OR status=unsuccessful | stats values(srcip) by users status If you give me sample event and field names associated with it I can give you proper query. ... View more

There are many ways to do it . Try this as well index=your_index | stats max(Amount) as Amount by Name date_year date_month| stats sum(Amount) As total_count by date_year date_month | eval date=date_year+"-"+date_month | fields date total_count ... View more

can you tell me how is your timestamp look like in an event? and where it is specified ? is it specified at the beginning or in between? ... View more

Try this index=your_index | rex field=_time “?P<month>\d{4}\-\d{2}”| stats max(Amount) as Amount by Name month | stats sum(Amount) As total_count by month Let me know if it works for you!! ... View more

Try this index=your_index | rex field=_time “?P<month>\d{4}\-\d{2}”| stats max(Amount) as Amount by Name month | stats sum(Amount) As total_count by month Let me know if it works for you!! ... View more

If it is a script then you can run it by searching a file from /etc/app/appname/andlookfilesshellscript There might be a script which you need to trigger in order to process configuration. You have to search for that shell script ... View more

Let me know if it works! ... View more

Sometimes I see errors like this if Splunk was started/stopped by root, when it normally runs as a different user. Some of the files become owned by root and then odd things don't work. In Linux, there is a simple fix. Assuming that Splunk is installed in /opt/splunk Splunk should run as user splunkit you are signed in as a user with sudo privileges cd /opt sudo chown -R splunkit splunk Of course, the problem could be something entirely different... ... View more

what is the impact of this error on your system? ... View more

hey @Kwip you are welcome, You can accept my answer as well if you think the answer is relevant to your question. ... View more

Remove this setting from inputs.conf forwarder [default] host = n01aplXXX.XXX.YY.PPPP.GGG [splunktcp://9997] connection_host = none Just write [monitor:///opt/app/test/testlog/testLog.log] index= np_test sourcetype = 3dev1 also, have you configured forwarder correctly? in order to send the data to indexer you need to run cd /opt/splunk/bin ./splunk add forward-server index_ip:9997 refer this doc for forwarder configuration: http://docs.splunk.com/Documentation/Forwarder/6.5.3/Forwarder/Configuretheuniversalforwarder refer below doc for how to forward data to indexer: http://docs.splunk.com/Documentation/Forwarder/7.0.0/Forwarder/HowtoforwarddatatoSplunkEnterprise also, you can check for forwarder logs to troubleshoot on the forwarder go to vi /opt/splunkforwarder/var/log/splunk/splunkd.log check for this link it might help you: https://answers.splunk.com/answers/465/ive-set-up-a-forwarder-but-im-not-receving-any-events-on-the-splunk-indexer.html Let me know if it works! ... View more

It should be field=value pair host is your field and value is your host IP Or else you can directly write index=_internal "host_ip" NOT StreamedSearch Let me know if it works! ... View more

You can use index=_internal host=Your_host source=splunkd.log In order to get the info about the splund process. ... View more

Try this on SH GUI index=_internal host=your_host You will see info regarding your host On the left side of SH GUI you will see log_level field in which you will see error ,info and warning regarding your host so you can troubleshoot further. ... View more

The issue seems to be in output of eval errors Can you tell me the output of errors? Is it coming propeR? ... View more

Use this query as a reference to calculate ratio: basesearch | stats count(eval(if(action!="success",1,null))) as count1 count(eval(if(action="success",1,null))) as count2 | eval ratio=round(count1/count2,2) | fields ratio Let me know if it works! ... View more

try using stats command with latest and earliest option Refer this doc http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Stats#Event_order_functions Let me know if it works ... View more

Use where instead of search Try this | NOOP | stats count|eval var1=2.1|eval var2=2.0| where var1 > var2 ... View more

If your job is just to stop the forwarder then you really do not need to write ./splunk status. Instead just type ./splunk stop In other words, you do not really need to run the ./splunk status when stopping a forwarder ... View more