Sure there is, join should be considered as last resort not as first choice. Take this run everywhere example which compares the first day of last week with the first day two weeks ago: index=_internal earliest=-2w@w sourcetype=splunkd date_mday=1 OR date_mday=8 | bucket _time span=1d | stats last(_time) AS last_time count AS per_day_count by _time, host, sourcetype | eval weeks = if(last_time > exact(relative_time(now(),"-2w@w")) AND last_time <= exact(relative_time(now(),"-1w@w")) , per_day_count ,"0") | eval week = if(last_time > exact(relative_time(now(),"-1w@w")) AND last_time <= exact(relative_time(now(),"-0w@w")) , per_day_count ,"0") | where NOT weeks = week | stats max(last_time) AS _time, values(sourcetype) AS sourcetype, max(week) AS 1w_ago, max(weeks) AS 2w_ago I had to build this on weeks because of the 30 days retention time on index=_internal so adapt it to your needs... cheers, MuS ... View more

Hi snehal8, run this search: index=_audit host=YourHostName action=alert_deleted the result will look like this: Audit:[timestamp=02-12-2015 10:39:21.783, user=TheBadGuyHowDeletedTheAlert, action=alert_deleted, sid="scheduler__AnyUserName_REFfUkNQX0xEQVA__RMD5d4292166408c9a03_at_1423733700_18910", trigger_time=1423733705, deleted=1][n/a] Hope this helps ... cheers, MuS ... View more

Could you provide the search and if possible some sample data? ... View more

I assume, that the file will be indexed at the end of the upload/preview but i must admit I never used it before ... I'm doing it the old fashioned vi edit config files way. ... View more

Hard to say. I would start troubleshooting by increasing the log channels of TcpInputConfig TcpInputConn and TcpInputProc in log.cfg http://docs.splunk.com/Documentation/Splunk/6.2.1/Troubleshooting/Enabledebuglogging ... View more

Hi arjangoos, on the forwarder run this command to check if the the config is applied correct: $SPLUNK_HOME/bin/splunk cmd btool --debug inputs list tcp Output looks something like this and yours should have a persistentQueueSize /opt/splunk/etc/system/default/inputs.conf [tcp] /opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunk/etc/system/default/inputs.conf acceptFrom = * /opt/splunk/etc/system/default/inputs.conf connection_host = dns /opt/splunk/etc/system/local/inputs.conf host = VirtualBox /opt/splunk/etc/system/default/inputs.conf index = default Also check if the queue directory has been created, it should be at $SPLUNK_HOME/var/run/splunk/tcpin/pq__8088 in your case. Check as well splunkd.log of your forwarder for any error messages. Hope this helps ... cheers, MuS ... View more

My favorite link related to this topic: http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html ... View more

Hi Venkat_16, this is possible, look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Transaction in the section Filter string options it says: <filter-string> Syntax: <search-expression> | (<quoted-search-expression>) | eval(<eval-expression>) Description: A search or eval filtering expression which if satisfied by an event marks the end of a transaction. <search-expression> Description: A valid search expression that does not contain quotes. <quoted-search-expression> Description: A valid search expression that contains quotes. <eval-expression> Description: A valid eval expression that evaluates to a Boolean. This means running something like this will work: transaction startswith="A OR B" endswith="C OR D" <yourfield> Don't forget to use a field that will be used to build your transaction. Hope that helps ... cheers, MuS ... View more

Okay even the Splunk Master Mind Stephen Sorkin has answered that way back in time, here are some simple test to show that it is not possible either using a negative epochtime nor with a string. this will work: index=_internal | head 1 | eval foo="386380800" | eval baz=strftime(foo, "%F %T") | table foo baz because it is using a valid epoch time and the strftime() . this will not work neither for strftime nor strptime , because of the negative epochtime used: index=_internal | head 1 | eval foo="-386380800" | eval baz=strftime(foo, "%F %T") | table foo baz index=_internal | head 1 | eval baz=strptime("-386380800", "%F %T") | table baz cheers, MuS ... View more

This from the dashboard example app https://apps.splunk.com/app/1603/ where you can see how it is done using a sparkline, but this will work on a chart as well. <table> <title>Basic Sparkline w/ Max Value Indicator</title> <searchString>index=_internal | chart count sparkline by sourcetype | sort -count</searchString> <earliestTime>-24h@h</earliestTime> <latestTime>now</latestTime> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">5</option> <!-- Set sparkline options here; make sure that field matches field name of the search results --> <format type="sparkline" field="sparkline"> <option name="lineColor">#5379af</option> <option name="fillColor">#CCDDFF</option> <option name="lineWidth">1</option> <option name="maxSpotColor">#A2FFA2</option> <option name="spotRadius">3</option> <option name="height">25px</option> </format> </table> ... View more

After some googling I learned that cflowd is a flow analysis tool that was used for analyzing Cisco's NetFlow enabled switching method So, if it uses netflow you can check out any of the netflow apps https://apps.splunk.com/apps/#/search/netflow/page/1 maybe they can be of help in this case ... View more

Sorry, but I don't. Maybe you can use urldecode on it? http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/CommonEvalFunctions ... View more

the REINDEXMEPLEASE worked so far for me, never had troubles. Take a look at this post about cleaning the _fishbucket http://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html this applies to an indexer and an universal forwarder. ... View more

Hi bjoernjensen, there is another option for crcSalt which is very useful - funny this is not in the docs?!? you can use the crcSalt = REINDEXMEPLEASE option in any inputs.conf stanza to get this input re-indexed. Add it to the stanz, restart the forwarder and let it do the work. After that, don't forget to remove the entry again .... Hope this helps ... cheers, MuS ... View more

Hi carlpier, Something like this sould work: index="imwaccesslog" OR index=nbdrest-performance sourcetype="IMWAccessLog" OR sourcetype="PerfNBDCustomTSV" URI=/nbd-rest/rest/mch/inquiry/Inquiry/recuperaProfiloUtente OR Service=DBDisposizioniServiceImpl.recuperaProfiloUtenteBOL | stats count Max(ETms) Max(ETsec) Hope this helps to get you started ... cheers, MuS ... View more

Hi luxiaobin, Take a look at the docs about how timestamp assignment works http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/HowSplunkextractstimestamps Hope this helps ... cheers, MuS ... View more

... and the winner in the category 'best feedback ever....' is alacercogitatus - once more 🙂 !!! ... View more

Good one! Knowing his weakness, is a way to strength .... or something like that ..... Yoda would said have 🙂 ... View more