I would use oneshot from the cli. The web interface doesn't support multiple files. Just run oneshot from any forwarder configured to send to your indexer. http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/MonitorfilesanddirectoriesusingtheCLI ... View more

What is c? per_minute is a only available as a timechart function, but your eval is implemented incorrectly. per_minute(value) should be treated as a column/field name not a function. You either have to use the quotes or the as command. sensor | timechart span=5m per_minute(Value) | eval rectsum=("per_minute(Value)"/c OR sensor | timechart span=5m per_minute(Value) as per_min | eval rectsum=(per_min/c) ... View more

I would recommend looking at the simple_xml_examples app by Splunk i demonstrates how to incorporate other visualization into Splunk. ... View more

If you are trying to make a chart interactive you can use jquery to bind objects to event listeners such as click. I've done that for a few charts. ... View more

What i think you want is the per_minute(x), per_hour(x), per_day(), or per_second(x) available in the timechart command. ... View more

The name attribute is not used in the nav bar. The nav bar use the label tag within the dashboard xml to display within the Navigation. <dashboard showsource="false" script="contents.js" stylesheet="contents.css"> <label>Examples FooBar</label> </dashboard> Example FooBar will be the text with the nav bar. ... View more

Shouldn't have to as it imported when the class is called on line 8. ... View more

On the licensing master you could set up a summary index on for the saved searches which drive the license master UI. Then using event forwarding and routing send the summary to your indexers. This would require a transforms and props. Another alternative is to have a script which will poll the license master API with a limited read user and then you index the event on your indexers. ... View more

with Splunk 6.2 you have the distributed management console which can be setup on a remote host as management server. It really replaces SOS and Splunk Deployment Monitor for most cases. The Licensing stats are gathered via rest api using the rest command | rest splunk_server=youSplunkLicenseMaster.local /services/licenser/pools. Read more @ http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/ConfiguretheMonitoringConsole. This view is only available to admins. As a side note if you add your License Master as a search peer to your search heads the rest command which make up the Licensing page will work. ... View more

It looks like you have multiple json event in one line. Try this with a break before {"filter_level ... View more

Does your forwarder run as different user other than system? If so you may have permission issue. Other wise post a input stanza. ... View more

I am not too familiar with the ldap search command, but you could try running a sub search or the mulitsearch command | ldapsearch search="(&(objectClass=user)(&(objectClass=computer)))" attrs="cn,objectCategory" basedn="OU=W8_et_UnblockAllowed,OU=Win8,OU=Workstations,OU=Machines,DC=global,DC=company,DC=com" | append [ search | ldapsearch | basedn="OU=W7_te_UnblockAllowed,OU=Win7,OU=Workstations,OU=Machines,DC=global,DC=company,DC=com" ]| table cn OR | multisearch [search | ldapsearch search="(&(objectClass=user)(&(objectClass=computer)))" attrs="cn,objectCategory" basedn="OU=W8_et_UnblockAllowed,OU=Win8,OU=Workstations,OU=Machines,DC=global,DC=company,DC=com" ] [ search | ldapsearch | basedn="OU=W7_te_UnblockAllowed,OU=Win7,OU=Workstations,OU=Machines,DC=global,DC=company,DC=com" ]| table cn Those should work the difference between these two search is that multiple search simultaneously and the first is a sub search which run serially. Hop this helps. Dont forget to accept answer to help with with similar questions. ... View more

You can use the the deployment server to manage your Splunk Forwarders. Though this is done via a subscription model which only manages the inputs and other setttings. If you are looking to manage the service you will have to use remote wmi/powershell for windows and commands via ssh for linux using a script. There is the remote-cli for splunk, but it doesnt allow for remote start and stop, if you stopped the service their would be no service listening for the start command. As for the Splunk memory size, the memory will grow in size based on the number of inputs/monitors you have enabled. I seen 120MB for running just about every windows monitor under the sun. ... View more

I would also consider using a combination of maxTotalDataSizeMB, homePath.maxDataSizeMB, and coldPath.maxDataSizeMB to control indice size. ... View more

If you have more more than 10 results you will have to use the maxsearches argument. The map command is essentially a loop command. If you have a dynamic range of results 10 sometimes 100 and set maxsearches to 100 it may miss results if you get 110 result occasionally. ... View more

If you post a sample it might help ... View more

You should install you config under the $SPLUNK_HOME/etc/apps . If you want to find out why your configs are not work correctly. Run the following $SPLUNK_HOME/etc/bin/splunk cmd btool --debug inputs list This command will out put debug statement will out the final inputs.conf file as applied with your server/machine. It will include which file is override each stanza and settings. ... View more

You do know what splunk take look at sar, netpmon, tprof, or mpstat. Also you are only giving Splunk 4 CPUs I wouldn't use anything less than 8 CPUs. How many search jobs are running and process if you installed free apps. ... View more

I very aware and Splunk does not do particularly well with virtualization especially if resources are over subscribed. with LPAR and other virtualization Splunk likes to occupy cores and does not do well when hypervisors do resource shuffling. Splunk is always working and is waiting for resources. If you have 24 physical procs 2 splunk hosts with 12 cpu Splunk host and lets say 6 hosts with 2 procs. You end up with cpu scheduling issues. Take a look at how long Splunk is waiting for access to physical resources. ... View more

Are you running Splunk on an LPAR with other LPARS? ... View more

I have jenky way of doing this with sub searches and using the return command. This first search is used to get the number of return values needed, since return require you to enter a number value else it will return only one value. index="raw_internet_cartonista" programa="WNHC" tipo="E" | stats dc(idlogon) as c | return $c Next you use this as a sub search with an identical search. The result is idlogon=<value1> OR idlogon=<value2> OR idlogon=<value3> OR idlogon=<value4> and so on. index="raw_internet_cartonista" programa="WNHC" tipo="E" | return [search index="raw_internet_cartonista" programa="WNHC" tipo="E" | stats dc(idlogon) as c | return $c] idlogon Finally you use the resulting in your main search. index="raw_internet_cartonista" programa="ILCL" tipo="I" [ search index="raw_internet_cartonista" programa="WNHC" tipo="E" | return [search index="raw_internet_cartonista" programa="WNHC" tipo="E" | stats dc(idlogon) as c | return $c] idlogon] | stats count(info10) by idlogon Option two you can use mvcombine and return. index="raw_internet_cartonista" programa="WNHC" tipo="E" | table idlogon | eval idlogon="idlogon="+idlogon | mvcombine delim=" OR " idlogon | return idlogon Finally, but this method does max char/lines per field limits which i cant remember. index="raw_internet_cartonista" programa="ILCL" tipo="I" [ search index="raw_internet_cartonista" programa="WNHC" tipo="E" | table idlogon | eval idlogon="idlogon="+idlogon | mvcombine delim=" OR " idlogon | return idlogon ] | stats count(info10) by idlogon I've used this to find GUIDs that have generated errors and then using the found GUIDs find all matching events/transactions that took place. Hope this helps. Don't forget to vote and accept answers. ... View more

contact [email protected] they normally get back to you in 24hrs. ... View more