or in the UI Settings » Forwarding and receiving » Forwarding defaults Store a local copy of forwarded events? Yes No ... View more

Okay, follow the docs and add this in your outputs.conf indexAndForward = [true|false] * Index all data locally, in addition to forwarding it. * This is known as an "index-and-forward" configuration. * This attribute is available only at the top level [tcpout] stanza. It cannot be overridden in a target group. * Defaults to false. ... View more

nice, this ends in transforms.conf as default_match default_match = <string> * If min_matches > 0 and Splunk has less than min_matches for any given input, it provides this default_match value one or more times until the min_matches threshold is reached. * Defaults to empty string. ... View more

take a look at the docs about the transaction command http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Transaction it has all the details Yes, you don't need maxevents. ... View more

HeHe, well done 🙂 ... View more

check as well in $SPLUNK_HOME/etc/apps for any inputs.conf where $SPLUNK_HOME is the path where you installed the Splunk UF. ... View more

well, it is not important but most of the searches using join can be done with stats and will be therefore much faster 😉 ... View more

what happens if you take out ipAddress="*" as well in the search? ... View more

Hi HeinzWaescher, you could setup an eval-based statement in props.conf : EVAL-<fieldname> = <eval statement> * Use this to automatically run the <eval statement> and assign the value of the output to <fieldname>. This creates a "calculated field." * When multiple EVAL-* statements are specified, they behave as if they are run in parallel, rather than in any particular sequence. For example say you have two statements: EVAL-x = y*2 and EVAL-y=100. In this case, "x" will be assigned the original value of "y * 2," not the value of "y" after it is set to 100. * Splunk processes calculated fields after field extraction and field aliasing but before lookups. This means that: * You can use a field alias in the eval statement for a calculated field. * You cannot use a field added through a lookup in an eval statement for a calculated field. The eval could look like this: EVAL-amount = if(isnull(amount), "100" , amount) This is untested so maybe you need to adapt it to your needs cheers, MuS ... View more

Hi Cosmoon, okay, the missing fields in your second search come from either a different index or sourcetype, because your subsearch in the join will search through all indexes and sourcetpyes which are available to you. Basically you can identify the sourcetype for the missing fields and add it in the base search like this sourcetype=txt ipAddress="*" OR sourcetype=<ForTheMissingFields> | ... and leave the join... out of your search. Take a look at this two answer to get an idea how it can be done: http://answers.splunk.com/answers/185829/how-to-create-a-custom-macro-function-inside-the-s.html#answer-186115 http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html The first link is something similar to your use case, a time over time comparison search which was originally build by using multiple sub-searches....the second link is about the topic how to compare fields from different sources, sourcetypes or indexes. hope this gets you started ... cheers, MuS ... View more

sorry but this makes no sense, having empty fields because you don't use a | join [search] ... so where are these filed coming from if not from your base search? other index? So please: put your actual search here and if possible some actual events and the expected result - thanks 🙂 ... View more

Okay, now we have a question and immediatly two questions pop-up in my head: why do you have a | join [search] in your search and do you know the timewrap app https://apps.splunk.com/app/1645/ ? This will do time over time comparison for you ... View more

You must make sure to have a _time field available after the stats or the timechart will fail, do as I said or do as @somesoni2 said 😉 ... View more

Hi MayankSplunk, after the stats you don't have _time available for timechart, so do something like this: | stats list(score) as score, list(Id) as Id by Type, _time | timechart .... cheers, MuS ... View more

HeHe, the über-spam-fighter gets block by anti-spam rules 🙂 ... View more

now this is spooky, where are all my comments and answers?!?? ... View more

do you see my answer? looks like it's lost in space 🙂 ... View more

Why would you need a batch script for this? The Splunk UF can read a txt file directly. ... View more