Hi ben_leung, I did write exactly such an App for a costumer, but the costumer denied it to be published 😞 cheers, MuS ... View more

check in etc/users/<yourusername>/search/local/ and I'm using a Exchange/Outlook mail service currently ... View more

could you please provide more details like the search used, your savedsearch.conf entry for this alert and the splunk version used? I did a test on 6.0.x and this just works fine.... Search used: index=_internal | stats count list(source) Result: count list(source) 72200 /opt/splunk/var/log/splunk/splunkd_access.log /opt/splunk/var/log/splunk/splunkd_access.log /opt/splunk/var/log/splunk/splunkd_access.log ... View more

Hi meenal901, this cannot be answered here; it all depends on your existing infrastructure, your use cases and other requirements like how many concurrent search will run, do you depend on live near real-time data and so on. As a rule of thumb take a look at the docs about recommended hardware which should be good to index about 100Gb/day. cheers, MuS ... View more

your script stanza should be inside inputs.conf not app.conf ... View more

ahh I see, your field is like dT=XXXms ... so remove the ms first and then you can filter 😉 ... View more

take this run everywhere example: index=_internal earliest=-2h@h latest=-1h@h kb | where kb<128 | stats count index=_internal earliest=-2h@h latest=-1h@h kb<128 | stats count both will return the same count. Is this dT field numeric or a string? ... View more

Hi deepthi5, technically this is not a problem to achieve, personally I would find the reason why one host is sending more events than usually and fix that problem. Okay, here is what you can do: Read the docs about Access and use the CLI on a remote server and enable remote login on your universal forwarders. Create a search that returns only the host you want to stop and save it as alert which will trigger a script. Now, here is the tricky part: Splunk will not pass the search result to this script, but you can pass either an URL or a file name where the event result is available to the alert script. So your alert script must ab able to read the host name which you want to stop be able to remote login to this host and stop Splunk via CLI command As I said, I wouldn't do it this way ..... because, if your script or your search go crazy .. bad things could happen, like stopping the wrong host. cheers, MuS ... View more

Hi alladin101, this is another good use case for the timewrap app. Take this run everywhere command and adapt it to your needs: index=_internal source=*metrics.log earliest=-30d@d | timechart span=1w count | timewrap w series=short | eval mean=(s1+s2+s3)/3 | where s0 > mean The timechart will count events for each week, timewrap will group each week into new fields called s0, s1 ...., the eval will calculate the mean of the last three weeks and the where will check if the lastet week event count is higher than the mean. But remember, depending on the event count this can take some time to complete. hope this helps to get you started ... cheers, MuS ... View more

You could do it a bit less awkward if you setup / use a SSO http://docs.splunk.com/Documentation/Splunk/6.1.3/Security/HowSplunkSSOworks for your Splunk server ... View more

Hi premg, make sure your sourcetype matches exactly and your regex (.) looks strange. I assume you want to match everything ( equal to . in regex ) but your regex is matching (.) .. try using a single dot like . instead in transforms.conf. hope this helps ... cheers, MuS ... View more

or this one http://apps.splunk.com/app/570/ ... View more

Hi Mubarish, simply use double quotes around the value like in this run everywhere search command (you must be able to search index=_internal ) : index=_internal "[19/Aug/2014:15* +0200]" This will show all event from today (as it is the 19th of August 2014) 3pm hope this helps ... cheers, MuS ... View more

Hi royimad, take this run everywhere command: index=_internal | head 1 | eval foo="Tue Aug 19 2014 04:47:18,515 EDT DEBUG wmservice.business.mobilehospital - [saveDeviceRead2 - HM10042 - roy.imad] Method invoked with parameters : [username]{roy.imad}[deviceId]{HM10042}[macAddress]{XXXX-xxxxx-xxxxx-xxxxxx-xxx}[readPacket]{(TagID){E0040100206E6349}|(TagID){E0040100206E7BA7}|(TagID){E0040100206E7917}|(TagID){E0040100206E7BF7}|(TagID){E0040100206E7BAF}|(TagID){E0040100206E7967}|(TagID){E0040100206E64A1}|(TagID){E0040100206E90F4}|(TagID){E0040100206E64A9}|(TagID){E0040100206E796F}|(TagID){E0040100206E791F}|(TagID){E0040100206E90FC}}[readMode]{A}[updateEventInfo]{(Disposition){}(RGA){}(PO){}(SO){}(DetailDisposition){}(EncounterID){null}(DestinationID){}(ReturnID){null}(DispositionFlag){false}(RGAFlag){false}(POFlag){false}(SOFlag){false}(DetailDispositionFlag){false}(EncounterIDFlag){false}(DestinationIDFlag){false}(ReturnIDFlag){false}}[createAudit]{true}[auditInfo]{(EndpointID){RU00014GN1}(Signature){}(ImageSignature){null}(SignerName){null}(Comment){}} " | rex field=foo max_match=0 "(?<tagid>\(TagID\))" | stats count by tagid this will return a count of 12 The first line is just to build an event which contains your data, the rex and the stats will do the work. hope this helps ... cheers, MuS ... View more

working on that in your other question 😉 .... ... View more

sure, although there are a lot of search macros in the saved searches. If you look at the searches you will get an idea how it can be done. Otherwise use a lookup file which contains all your forwarder hostnames and check if all of them were seen in the past x minutes. Take a look at this http://answers.splunk.com/answers/73268/search-for-hosts-in-a-lookup-but-not-in-splunk ... View more

hmm, looks like the lookup approach is not the best choice...there are multiple un-answered questions related to this topic: http://answers.splunk.com/answers/99023/time-base-lookup-with-offset-stored-in-lookup-table http://answers.splunk.com/answers/56672/configure-a-time-based-lookup-for-more-than-one-field sorry .... ... View more

Hi ashari, check out the Splunk Deployment Monitor there you can find some nice saved searches related to this topic ... keyword: missing forwarders hope that helps ... cheers, MuS ... View more