same problem here can any one help us with above question ... View more

what is the file type csv or text file ? ... View more

index="dlp" sourcetype="intel:dlp" OR index="msad" sourcetype="ActiveDirectory" add double quote ... View more

index=dlp sourcetype=intel:dlp OR index=msad sourcetype=ActiveDirectory Try this ... View more

use double quote when for sourcetype=intel:dlp ---- sourcetype="intel:dlp" ... View more

#Version 6.5.1 #DO NOT EDIT THIS FILE! #Changes to default files will be lost on update and are difficult to #manage and support. #Please make any changes to system defaults by overriding them in #apps or $SPLUNK_HOME/etc/system/local #(See "Configuration file precedence" in the web documentation). #To override a specific setting, copy the name of the stanza and #setting to the file where you wish to override it. [tcpout] maxQueueSize = auto forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = _.* forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry) forwardedindex.filter.disable = false indexAndForward = false autoLBFrequency = 30 blockOnCloning = true compressed = false disabled = false dropClonedEventsOnQueueFull = 5 dropEventsOnQueueFull = -1 heartbeatFrequency = 30 maxFailuresPerInterval = 2 secsInFailureInterval = 1 maxConnectionsPerIndexer = 2 forceTimebasedAutoLB = false sendCookedData = true connectionTimeout = 20 readTimeout = 300 writeTimeout = 300 tcpSendBufSz = 0 ackTimeoutOnShutdown = 30 useACK = false blockWarnThreshold = 100 sslQuietShutdown = false [syslog] type = udp priority = <13> dropEventsOnQueueFull = -1 maxEventSize = 1024 ... View more

thanks you very much ... View more

No 2 stanzas are not pointing to the same source ... View more

index=index_name date_wday="monday" OR date_wday="tuesday" OR date_wday="wednesday" OR date_wday="thursday" OR date_wday="friday" l stats............... I had experienced equal will work faster than not equal So use this query for faster results ... View more

I have the same question data is appending but old data and new data will be same some time so i am seeing less than 1,000 rows in MS sql live db and 10,000 rows in splunk which means 1000*10=10,000 but there should be 1,000 rows only as it is in ms sql i mean mirroring !:) ... View more

you can exclude below query and use UI option for Commas as it is available in 6.5.1 isn't it! | fieldformat Declined=tostring(Declined, "Commas") ... View more

index=A | where NOT like(field1, "%H%") ... View more

index=A | where like(Field, "%something%") ... View more

try join type=outer ... View more

i never see time taking for creating index always for it was less than mill seconds in UI ... View more

you mean loading data ? ... View more

Question not clear please explain more ... View more

That's cool we are running the dashboard which contains 10 query's but what is the solution to run more than 10 query to increase the capacity to run 20 query! ... View more

Hi Rich, Thanks a lot but nothing is happening with your query. Cannot insert the value NULL into column 'city_cd', table 'HotelHubServices.dbo.pb_custmastclntsync_mc'; column does not allow nulls. INSERT fails. The statement has been terminated. :: at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) at System.Data.SqlClient.SqlDataReader.TryConsumeMetaData() at System.Data.SqlClient.SqlDataReader.get_MetaData() at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString) at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite) at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean asyncWrite) at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method) at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method) at System.Data.SqlClient.SqlCommand.ExecuteDbDataReader(CommandBehavior behavior) at System.Data.Common.DbCommand.System.Data.IDbCommand.ExecuteReader(CommandBehavior behavior) at System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) at System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) at System.Data.Common.DbDataAdapter.Fill(DataSet dataSet) at TCT.DbConnect.Getrs(String SpName, SqlParameter[] SpParameters, Int32 TimeOut, Boolean ConnectLogDatabase) ... View more

thanks a lot ... View more

sorry it was very simple i have got this after posting here forgot to upfdate ... View more