Hi pete_charlton, set disabled to 0 not false see docs: disabled = [0|1] * Specifies whether or not the input is enabled. * 1 to disable the input, 0 to enable it. * Defaults to 0 (enabled). If this does not help: Did you restart the UF? Did you search over all time in the index? What is the tailingProcess reporting in $SPLUNK_HOME/var/log/splunkd/splunkd.log on the UF or use this nice script http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ hope this helps ... cheers, MuS ... View more

Hi rubeniturrieta, best thing to set/leave UDP syslog input as sourcetype=syslog because if you take a look at the Cisco iOS TA App, it will re-write the sourcetype for all Cisco iOS events that match. I assume the Cisco ASA App will work the same way (did not use this myself, yet) hope this helps ... cheers, Mus ... View more

Hi dzhariy, looking at your search I was wondering how this could be done by using a stats and some eval tricks and guess what, I found a way to do this 🙂 Let me show you a run everywhere search (assuming you got the permission to search the index=_internal 😞 index=_internal earliest=-5min@min sourcetype=splunkd | bucket _time span=1min | stats last(_time) AS last_time count AS per_min_count by _time, host, sourcetype | eval 5min_ago = if(last_time > exact(relative_time(now(),"-6min@min")) AND last_time <= exact(relative_time(now(),"-5min@min")) , per_min_count ,"0") | eval 4min_ago = if(last_time > exact(relative_time(now(),"-5min@min")) AND last_time <= exact(relative_time(now(),"-4min@min")) , per_min_count ,"0") | eval 3min_ago = if(last_time > exact(relative_time(now(),"-4min@min")) AND last_time <= exact(relative_time(now(),"-3min@min")) , per_min_count ,"0") | eval 2min_ago = if(last_time > exact(relative_time(now(),"-3min@min")) AND last_time <= exact(relative_time(now(),"-2min@min")) , per_min_count ,"0") | eval 1min_ago = if(last_time > exact(relative_time(now(),"-2min@min")) AND last_time <= exact(relative_time(now(),"-1min@min")) , per_min_count ,"0") | eval current_count = if(last_time > exact(relative_time(now(),"-1min@min")) AND last_time <= exact(relative_time(now(),"-0min@min")) , per_min_count ,"0") | stats max(last_time) AS _time, values(host) AS host, values(sourcetype) AS sourcetype, max(current_count) AS current_count, max(1min_ago) AS 1min_ago, max(2min_ago) AS 2min_ago, max(3min_ago) AS 3min_ago, max(4min_ago) AS 4min_ago, max(5min_ago) AS 5min_ago This will produce a table like this, which matches your result: Now let me try to adapt this to your search and something like this should work: index=perfmon host=lena counter="% Processor Time" earliest=-5min@min | bucket _time span=1min | stats last(_time) AS last_time max(exact(Value)) AS Value by _time, host, counter | eval 5min_ago = if(last_time > exact(relative_time(now(),"-6min@min")) AND last_time <= exact(relative_time(now(),"-5min@min")) , Value ,"0") | eval 4min_ago = if(last_time > exact(relative_time(now(),"-5min@min")) AND last_time <= exact(relative_time(now(),"-4min@min")) , Value ,"0") | eval 3min_ago = if(last_time > exact(relative_time(now(),"-4min@min")) AND last_time <= exact(relative_time(now(),"-3min@min")) , Value ,"0") | eval 2min_ago = if(last_time > exact(relative_time(now(),"-3min@min")) AND last_time <= exact(relative_time(now(),"-2min@min")) , Value ,"0") | eval 1min_ago = if(last_time > exact(relative_time(now(),"-2min@min")) AND last_time <= exact(relative_time(now(),"-1min@min")) , Value ,"0") | eval current_count = if(last_time > exact(relative_time(now(),"-1min@min")) AND last_time <= exact(relative_time(now(),"-0min@min")) , Value ,"0") | stats max(last_time) AS _time, values(host) AS host, values(counter) AS counter, max(current_count) AS current_count, max(1min_ago) AS 1min_ago, max(2min_ago) AS 2min_ago, max(3min_ago) AS 3min_ago, max(4min_ago) AS 4min_ago, max(5min_ago) AS 5min_ago The above search is untested due to missing windows events, so if there is any mistake in the search - adapt it to your needs 🙂 hope this helps ... cheers, MuS ... View more

And another way to get some maps at restricted networks is https://apps.splunk.com/app/316/ and it still works great ... View more

Hi hsesterhenn, here is a good tutorial for some other way to get a map using data model: http://www.function1.com/2014/09/extending-the-power-of-pivot tstats would be another command that could be used hope that helps ... cheers, MuS ... View more

Hi BrandSentiment, If I check the wget URL from the download page I get something like this: wget -O splunk-6.2.0-237341-Linux-x86_64.tgz 'http://www.splunk.com/page/download_track?file=6.2.0/splunk/linux/splunk-6.2.0-237341-Linux-x86_64.tgz&ac=test_modal_enterprise&wget=true&name=wget&platform=Linux&architecture=x86_64&version=6.2.0&product=splunk&typed=release' running a test on this works perfect: wget -O splunk-6.2.0-237341-Linux-x86_64.tgz 'http://www.splunk.com/page/download_track?file=6.2.0/splunk/linux/splunk-6.2.0-237341-Linux-x86_64.tgz&ac=test_modal_enterprise&wget=true&name=wget&platform=Linux&architecture=x86_64&version=6.2.0&product=splunk&typed=release' --2014-11-09 10:15:57-- http://www.splunk.com/page/download_track?file=6.2.0/splunk/linux/splunk-6.2.0-237341-Linux-x86_64.tgz&ac=test_modal_enterprise&wget=true&name=wget&platform=Linux&architecture=x86_64&version=6.2.0&product=splunk&typed=release Resolving www.splunk.com (www.splunk.com)... 204.107.141.40 Connecting to www.splunk.com (www.splunk.com)|204.107.141.40|:80... connected. HTTP request sent, awaiting response... 302 Found Location: http://download.splunk.com/products/splunk/releases/6.2.0/splunk/linux/splunk-6.2.0-237341-Linux-x86_64.tgz [following] --2014-11-09 10:15:58-- http://download.splunk.com/products/splunk/releases/6.2.0/splunk/linux/splunk-6.2.0-237341-Linux-x86_64.tgz Resolving download.splunk.com (download.splunk.com)... 204.107.141.44 Connecting to download.splunk.com (download.splunk.com)|204.107.141.44|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 89995592 (86M) [application/x-gzip] Saving to: ‘splunk-6.2.0-237341-Linux-x86_64.tgz’ 100%[=======================================================================================================>] 89,995,592 385KB/s in 3m 57s 2014-11-09 10:19:55 (371 KB/s) - ‘splunk-6.2.0-237341-Linux-x86_64.tgz’ saved [89995592/89995592] cheers, MuS ... View more

Hi walkerhound, this could be related to a proxy issue. If you must use a proxy server to get to the internet, set the http[s]_proxy user env for the user running Splunk like this for Windows: set http_proxy=http://proxy.myproxy.com set https_proxy=https://proxy.myproxy.com For Linux: export http_proxy=http://proxy.myproxy.com export https_proxy=https://proxy.myproxy.com But the error code you get could also point to some trouble resolving the hostname, so check your DNS as well. cheers, MuS ... View more