I hope that one works (you'd change span value to something smaller/bigger) host=myserver JobWrapper | transaction keepevicted=true jobid | where job="provisioningJob" | timechart span=10m max(duration) by jobcallerref ... View more

To get one entry per host you can do: sourcetype=syslog "CPU Temp" | dedup host | table host CPU_Temp The avg command is not doing something special - only math like: 100dg, 100dg, 1deg = avg67deg. It may look no concise enough, but is fully ok! You get that empty chart on the first or second command? Have you tried to play around with the time (last 15mins, all time, etc) ? ... View more

sourcetype=syslog "CPU Temp" | stats avg(CPU_Temp) by host | sort -avg(CPU_temp) | head 100 or, if you want to have more like a timechart (although by 100 hosts, it might be not that nice) sourcetype=syslog "CPU Temp" | timechart span=10m avg(CPU_Temp) by host ... View more

It's a misconfiguration of the package depend file. The file is used to define prerequisite for the package itself (eg. reference packages which needs to be installed, before/after installing this package) See also man depend You'll find the file and its entries here: /var/sadm/pkg/splunk/install/depend @splunk-package-maker: Please, update the depend file - thanks However, it's fine to continue since there is no impact at all ... View more

I'm not that familiar with this topic, but is that even possible (latest=_time)? The docu itself doesn't mention that! I guess you more have to use something like earliest=-1w@h latest=-0w@h ... View more

That error means you already configured that path for monitoring then. There is no reason to configure it twice. Can you double check, if you entered that path before ... View more

Since nobody answered yet, I'll try to give you a possibility - although I don't know SAP at all! First you need to know, what's all (warnings/errors, transactions, logins, etc. etc.) being logged by SAP and where (how many logfiles, locations, etc.) is it being stored in Think of something exciting you want to monitor or report eg. failed user logins on your SAP boxes eg. successful transaction by user per hour eg. billing reports eg. net profits or losses etc. etc. The variety on reports is so vast, but all it depends on your logfiles. When you figured out what all is in your logfiles and what kind of things you wanna see, than you may be able to ask more specific on how to do reports etc. Splunk itself can pretty much do ANYTHING with your logfiles what you want/need - but you need to know what you want! btw: to correct myself - with logfiles, I mean any readable fils, and not only logfiles ... View more

Hard to guess what the problem could be since a part got forwarded though! Can you investigate following: in the directory you're monitoring: create a new "dummy" file wich consist eg. "Hello World" (does that work - is it being indexed - can you see it on the receiver box) modify one of the existing file with a new entry check splunkd.log netstat -a (although that should work 😉 ) ... View more

Note: the same on Solaris10 x86 ... View more

Hi David, Have a look right here: Min. Requirement or here: Capacity Planning In your case, some 1 CPU (2-4 Core) and 4-8 GB RAM do the job for both. The more cores/RAM you have, the better of course 😉 Note: Don't forget to have a look on your disks (RAID 10) as well! ... View more

Basically, you do: Server 1 (Indexer - MASTER) Manager » Data inputs » Files & Directories » Add New --> */var/log/httpd/access_log* Manager » Forwarding and receiving » Receive data » Add New --> 9997 Server 2 (Forwarder - CLIENT) Manager » Data inputs » Files & Directories » Add New --> */var/log/httpd/access_log* Manager » Forwarding and receiving » Forward data » Add New --> < ip.from.your.master:9997 > Please, read through following docs as well: http://www.splunk.com/base/Documentation/4.1.7/admin/AboutForwardingAndReceiving http://www.splunk.com/base/Documentation/4.1.7/admin/Enableforwardingandreceiving ... View more

Yes, it's possible! And you can run SETI as well 😉 ... View more

It depends what you all have configured - as you saying you "only" have a search head connection to index server I reckon, you open 8089. Here a little list which may help: Application Port ----------- ---- Splunk UI 8000 Distributed Search 8089 Forwarder/Receiver 9997 Further, you may have a look on your system what ports you listening to: netstat -a ... View more

Maybe one of these can help you: http://www.splunk.com/base/Documentation/4.1.7/Admin/authorizeconf http://www.splunk.com/base/Documentation/4.1.7/Admin/Addusersandassignroles If not, you probable going to compare the roles/capabilities between non-admin and admin user and try to figure out that way, which capability is needed for your action. Quite possible one of this three capabilities is needed for your non-admin's: schedule_search, search, rtsearch ... View more

I'd download the *nix app. Is the easiest & quite a good way in my opinion. Tab "CPU" offers you eg. CPU (load) consumption. http://splunkbase.splunk.com/apps/All/4.x/App/app:Splunk+for+Unix+and+Linux ... View more

Yes, a VM is fine. It doesn't need lots of resources since files only get deployed and nothing else is being done on it. Maybe in future with thousands of indexers some HW should be considered, but I guess you gonna see how it'll perform than. ... View more

Splunk itself has no performance stats (as far as I know). You have too meet splunk's system requirements to achive certain/satisfying results: http://www.splunk.com/base/Documentation/4.1.7/Installation/SystemRequirements My main question to yours is: What performance statistics are you looking for? And compared to what? Other tools? ... View more

This question could be similarish to the question I had recently. Since you are looking for the search performance & hyperthreading, I reckon hyperthreading is no option for that: http://answers.splunk.com/questions/12027/single-multi-threading-cpu ... View more

http://splunkbase.splunk.com/apps/All/4.x/App/app:FireEye ... View more

deepti123: Do you read the comments? Close this thread, and open a NEW one! ... View more