Hi 82padarthi, well reading the docs about DBX inputs.conf http://docs.splunk.com/Documentation/DBX/1.1.6/DeployDBX/inputsspec I cannot find anything mentioning a [batch] stanza, that's why it is ignored. Never did that though, so try any other method mentioned in the docs. Hope this helps ... cheers, MuS ... View more

and I add my two cents: in addition to the field URL add also a field called action and get POST and GET into this field. This way get not only the URL count but also what kind of action was done against this URL...like this: ... | stats count by URL, action | ... cheers, MuS ... View more

Why you're using a subsearch at all? You could use the inputlookup with append=t anywhere in the search pipeline and compare that to your events ... View more

Hi ksolanki88, take a look at limits.conf http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Limitsconf within this file you can change subsearch limits. cheers, MuS ... View more

Try this regex here, see above ↑ ... View more

try my below provided regex, this will stop at the . ... View more

try this : sourcetype="CEF" | rex "\smsg\=(?<msg>.+?)\." | table cat, msg ... View more

this is because your field msg only contains Network use the rex like this: sourcetype="CEF" | rex "(?i)msg=(?P<msg>.*)" | table cat,msg ... View more

no, this sets the default time range for the view named search see the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Ui-prefsconf for details ... View more

correction of small typo, it should be [search] not [Search] ... View more

Okay, may I ask why you want to do this? If you do it because you want to backup see the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Backupindexeddata and most important this part of it: Important: It is ordinarily not advisable to roll hot buckets manually, as each forced roll permanently decreases search performance over the data. As a general rule, larger buckets are more efficient to search. By prematurely rolling buckets, you're producing smaller, less efficient buckets. In cases where hot data needs to be backed up, a snapshot backup is the preferred method. What happens if you try to roll the _internal index like this: splunk _internal call /data/indexes/_internal/roll-hot-buckets -auth admin:changeme ... View more

Is your Splunk running and working? run splunk status also check splunkd.log ... View more

Hmm, CJOS wants to know how he can be sure that a forwarder configured to monitor the file foo has read everything in the file and sent it to the indexer.....the indexer itself can do event hashing to handle this. But how can we be sure a forwarder did read everything and did not discard any events for what ever reason? ... View more

Hi splunker12er, It is I again 😉 Does your License master, where you run this search, have any search peers configured? Check in the UI http[s]://YourSplunkHostName:YourSplunkPort/en-GB/manager/search/search/distributed/peers or by using this REST command on the license master: | REST /services/search/distributed/peers cheers, MuS ... View more

Hi, please mark this as answered if it answers your question...you're not only helping others by marking this as answered, but you will also get some karma as well 😉 ... View more

Hi, please mark this as answered if it answers your question...you're not only helping others by marking this as answered, but you will also get some karma as well 😉 ... View more

to answer this shortly... no, they will not consume license volume your _internal events will be forwarded by default to index _internal 3a. Use the license_usage.log index=_internal source="*license_usage.log" or change the setting for metrics.log ( http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Limitsconf ) 3b. This way you can search all the internal logs from the search head for troubleshooting reasons or any other use case you need to search any of the others Splunk instances logs. ... View more

out of pure curiosity, how would you do an regex on an epoch time for those online hours? ... View more

Check the Job inspector where or why this fails ... View more

Hi horst.poehlmann, look at your events in reverse order, so your first event is this one: Jan 7 11:14:11 mailserver sm-mta[11642]: a070yZwR021222: from=, size=1210, class=0, nrcpts=41, msgid=<[email protected]>, proto=DEANA, daemon=MTA, relay=guogcagiv01 [10.005.12.107] Assuming your msgID would now be msgID=a070yZwR021222 and all the sendmail transaction related to this msgID will not be longer as one minute, you can try to run a transaction on the events like this: sourcetype=syslog host="relay" process=sm-mta | transaction "msgID", "to" startswith="from=" endswith="postmaster-mail.sh" maxspan=1min This will use the fields msgID and to to build a transaction starting with events containing the string from= and ending with events containing postmaster-mail.sh which does not take longer as one minute. Maybe you need to adapt some options, but it should give you something to start with. cheers, MuS ... View more

not an real answer to your question but nice anyways https://github.com/yorokobi/vim-splunk ... View more

Hi, since you only provided the example for the default index, this is hard to solve. Take a look at the docs about routing and filtering, which contains an example on how to filter events and send them into the darkness of digital universe or the null queue http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues cheers, MuS ... View more

or starting from Splunk 6.2 you can use the splunk> Distributed Management Console . Find it in the UI under settings or use the URI http[s]://yoursplunkserver:splunkport/en-GB/app/splunk_management_console/Overview ... View more