Hi deadbot, looks like this was hard coded into splunkd for security reasons. I would suggest, that you run this as a normal script for user root and trigger it by crontab. The script then writes the scan result into a log file which then will be taken in by Splunk. See the nmap docs about nmap output options hope this helps ... cheers, MuS ... View more

Yes, I did notice some change 😉 ... View more

Hi albyva, You don't need to change anything in the start script nor in /etc/rc.conf. What happens if you re-run the enable boot-start or run the /etc/rc.d/splunk script? Cheers, MuS ... View more

Use timechart with option useother=f ... View more

I already answered this question, but here would be the next answer to the next question. Remember this is also only valid if there was no splunk clean all done. So here would be the equal search to the UI approach: | rest /services/data/indexes | search title=main | table title minTime splunk_server In this example uses only index=main and bear in mind, that on a search head you will get results form all search peers were as in the UI you will get even on a search head only the local index report. cheers, MuS ... View more

Hi felix_fxm, using the delete command will not remove the events, there are only hidden from search. Also, Splunk will not forget about this already indexed file. If this is a test setup and you're just starting, use the splunk clean all command which will remove the events and also clean up the so called _fishbucket this is where splunk keeps track of already indexed files. hope this helps ... cheers, MuS ... View more

This would be related to the metadata still available for this host. When your deleted data (buckets) gets frozen/deleted, this host will no longer be listed. As @yannK wrote, you can manually delete buckets but this is potentially dangerous. ... View more

Hi sw5269, if you want to kick off a script running splunk reload deploy-server -class anyway, why not simply run a nightly cron jobs which runs for example rsync -au etc/apps/ etc/deployment-apps/ and then kicks off splunk reload deploy-server -class . This way you know exactly where to check if the deploy to the final UF's fails. You could even output the result of this script into splunk> ... cheers, MuS ... View more

More a work around than a fix: split the files into 10 directories, run multiple instances of the UF each monitoring one directory and distributing to the 10 indexers. ... View more

Just as addition: you can add localhost:8089 as search peer. But it will through some errors in splunkd.log: splunkd.log:09-12-2014 07:19:36.480 +0200 WARN DistributedPeerManager - Unable to distribute to peer named somehostname.FQDN.here at uri https://localhost:8089 because peer has status = "Duplicate Servername". ... View more

What just came up my mind: can a search head be its own search peer? In other words, what will happen if you add localhost:8089 as search peer on this search head? ... View more

no the regex matches this format nicely. I can add some debugging feature to the script tomorrow if you need. ... View more

see my update ... View more

If you want it to be filtered on the indexer follow this docs about Filter event data and send to queues. This way you can nullQueue unneeded events. ... View more

Hi royimad, you can use SpunkIT for exactly this kind of performance benchmarks. Another approach would be bonnie++, but the results are some kind tricky to interpret .. cheers, MuS ... View more

can you try either | inputlookup append=t or | lookup local=true ... View more

Not exactly. date_hour starts at 0 (midnight to 1am) and ends with 23 (11pm to midnight). So using date_hour>8 starts at 9am and date_hour<18 ends at 5pm. use this run everywhere command: index=_internal date_hour>08 AND date_hour<18 NOT ( date_wday=Saturday OR date_wday=Sunday ) series | bucket _time span=1d | streamstats first(date_hour) AS first_hour, last(date_hour) AS last_hour by series,_time | eval diff=first_hour-last_hour | chart span=1d values(diff) AS diff over _time by series this will calculate the diff for first hour to the last hour seen each day per series. ... View more

You're welcome 🙂 ... View more

Hi karthikTIL, Each event has a field called date_hour which has the hour of the day as value, maybe this is of help in your case. Something like this just to give an example on how to use date_hour : Your base search date_hour>08 OR date_hour<18 | your next cammond UPDATE: Basically you can just add the date_hour and date_wday to the base search like this : source="file.csv" date_month=august date_hour>08 AND date_hour<18 NOT ( date_wday=Saturday OR date_wday=Sunday ) | bucket _time span=1d | eval epoch_A=strptime('start_TIME',"%d/%m/%Y %I:%M:%S %p") | eval epoch_B=strptime('close_TIME',"%d/%m/%Y %I:%M:%S %p") | eval total_TIME=(('epoch_B'-'epoch_A') / 3600) | table start_TIME,close_TIME,total_TIME This way you will only get back results for this time range ( 9am to 5pm ) and only on weekdays Mo - Fr. You can decide if you need the bucket or not, this will group all events into per day slices, which will be used in timechart or chart for example. For the public holidays you would have to use a lookup. Cheers, MuS ... View more

Login to splunkstorm.com, select your project, click the data tab, under network data click select, then click authorize your IP address - done ... View more

Hi kobie, take a look at this http://answers.splunk.com/answers/73268/search-for-hosts-in-a-lookup-but-not-in-splunk and you will see an example on how to search for something in a lookup file but not in Splunk. Hope this helps ... cheers, MuS ... View more