helge, I updated the answer to discuss using persistent queues. Hopefully this is what you were looking for. ... View more

Also, this is pretty much the same thing but you can try this as well. mysearch | timechart sum(base_grand_total) as sum_total span=1d |eval date=strftime(_time, "%b %d") | table date, sum_total ... View more

can you run it with out the table on the end and see what the time is for the duplicate rows? ... View more

You can't sort on _time because that field is no longer there after the stats command. I would write this search like this: index=myindex sourcetype="mysourcetype" | bucket _time span=1d | stats sum(base_grand_total) as sum_total by date_month, date_mday,_time | sort - _time |table date_month , date_mday, sum_total I think most of it is pretty close to what you had but you can see I used the bucket command to group the results into one day bins. Then I include _time in the stats command so that I can sort based on it and then just show the fields we want with the table. You could probably just use _time and format that the way you want rather than including date_month and date_mday but that is really up to you. ... View more

If these are on the SH I don't think they are report acceleration summaries. See Luke Murphey's answer.. ... View more

have you tried sending data to the indexer by setting up a monitor on the forwarder? Also, have you done a search for index=_internal and seen what results are returned for host? You should see the forwarder's host. ... View more

First assumption, when you say you are getting wifi router logs on a remote machine I assume you mean you are sending the wireless logs to a syslog collector? That would be a good thing because then you can use forwarders to monitor files. How can I configure a remote log to splunk ? If my assumption is correct, you should use a universal forwarder on the remote machine to send the logs to the splunk indexer. This link will describe more about forwarding: http://docs.splunk.com/Documentation/Splunk/6.0/Data/Usingforwardingagents How to set particular log to an particular app ? Most apps will describe what index and sourcetype your data should come in as to make setup as easy as possible. You should download the app and follow any instructions on the app page or in a readme supplied by the developer. For example, say you were wanting to use the Cisco app with a Cisco ASA device. You would want the data to go to "index=firewall sourcetype=cisco_asa" in order to have the searches and dashboards work out of the box. What are the useful apps available for Wi-Fi log monitoring ? Your best bet here would be to go to splunk-base and search for you wireless device vendor. If it is not there, ask for the specific device on answers and sometimes someone can share some things to get you started quickly. Finally, I want to let you know that you do not necessarily have to use apps in order to get value out of Splunk. Apps are just templates with some predefined searches and dashboards to get you started quickly. They help but are not always necessary. Splunk out of the box will provide you with full text search across the events and adding fields at search time is trivial using the field extractor or even manually writing them if you are comfortable with regex. Then all you need is some imagination to see what type of questions you want to ask of the data. Have fun and please ask questions if you get stuck! ... View more

I suspect you are trying to preview the data. Preview only works with one file. When you want to monitor a whole directory skip the preview: A File or Directory -> Consume any file on the server -> Skip preview Then select the radio button - "Continuously index data from a file or directory this Splunk instance can access" and enter the path in the input box. ... View more

BTW, a bit tangental but a question shows up as unanswered no matter how many answers are supplied until one answer is excepted. ... View more

You can't send it directly to splunk but I guess you could send it to an account on a server and index the mbox file on the server. However, I am not sure this is the best technology fit. Usually people use Splunk to monitor everything at the mail server rather than sending messages directly to it to index. ... View more

Unfortunately there is no easy way to do this outside of having a naming convention for your views. See this answer: http://splunk-base.splunk.com/answers/12744/navigation-menu-xml-match-help ... View more

Ah, so I just realized that the matching appears to happen in order. So for example, unless you move the "view source=unclassified" down below the Cerner match you will still see them once at the top and once in the matched group. ... View more

The code looks good...I am surprised that is not working. You have done a restart and clear out your browser cache? ... View more

Are you running enetprise security, PCI, or one of the newer releases of our apps? Certain apps are now using TSIDX stats to offer better search acceleration than is possible using either summary indexing or report acceleration. One thing you might want to do is search through your schedule searches and look for tscollect. This is what is populating that directory. http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Tscollect ... View more

My past experience has been when it matches it should show up only under the matched collection. Are you seeing something different? ... View more

Can all search peers use the same replication port? Yes peers should have the same replication port Does the cluster master need to communicate on this port? No, this is configurable but usually the same as the management port (8089 by default) What about a search head? 8089 by default Is communication Bidirectional? I believe the answer is yet but the peers will initiate connections with the master. maybe others can fill in more info here. Is the protocol TCP? Yes Don't forget your forwarder receiving port which is often set to 9997. ... View more

Dan, I think I understand what you are looking for now. I think that a combination of the transaction command the duration command may be more what you are looking for? http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Concurrency ... View more

Unfortunately I do not know of a way to do this based on a lookup. One thing I would say though is that sometimes it is easier to fix this on the way in rather than trying to fix it in Splunk. Many times people will have their syslog receiver split out the syslog into different directories based on hosts and then you would just configure the SPlunk forwarder to map these directories to source types. ... View more