Hi splunker12er, the docs provide nice examples http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Configurerule-basedsourcetyperecognition#Examples about rule based sourcetype assignment. Related to your example this means, if 75% or more of the input lines match the regex, then this sourcetype will be used. Cheers, MuS ... View more

Awesome, again 🙂 ... View more

Hi BP9906, you could use the date_zone field which contains the time zone offset from GMT in minutes and do some reporting on it ... like your search to get all universal forwarders | stats count by date_zone, host hope this helps ... cheers, MuS ... View more

From the docs http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Specifyinputpathswithwildcards#Wildcards_and_whitelisting : When you specify wildcards in a file input path, Splunk Enterprise creates an implicit whitelist for that stanza. The longest wildcard-free path becomes the monitor stanza, and Splunk Enterprise translates the wildcards into regular expressions, as listed in the table above. Additionally, Splunk Enterprise anchors the converted expression to the right end of the file path, so that the entire path must be matched. ... View more

When you specify wildcards in a file input path, Splunk creates an implicit whitelist for that stanza. The longest fully qualified path becomes the monitor stanza, and the wildcards are translated into regular expressions. This means your whitelist is being clobberd by your use of * expressions in the stanza. ... View more

Hi koudis, your whitelist for audit.log should be like this: whitelist=(audit\.log$|audit\.log\.1$) cheers, MuS ... View more

Hi ben363, IE8 is no longer supported, see docs about Browser_support cheers, MuS ... View more

you're welcome please mark this as answered - thx ... View more

Hi Isaias.Garcia, most commonly this is a permission problem and the account that runs splunk (on *nix Systems mostly splunk ) has no read rights in /var/log . Also what can happen, is that your test log is too small. You can run this search as Splunk admin user: index=_internal source="*splunkd.log*" TailingProcessor myscriptlog.log and see if the is anything related to your log file. hope this helps ... cheers, MuS ... View more

Okay, this is not a problem of the timechart command, it is related to the chart graph and therefore cannot be fixed by any command. Have a look at the docs about AdvChartingConfig-LayoutData maybe you will find a hint in there. ... View more

There is no difference if you use your base search here | eval myTime=ltrim(DURATION, "ms") | timechart span=1h avg(myTime) AS Duration or your base search here | eval DURATION=ltrim(DURATION, "ms") | timechart span=1h avg(DURATION) AS Duration The first uses a newly created field and the second always uses DURATION as field name. ... View more

Like @somesoni2 wrote, this is because the current hour will have not events. If you blank out the latest time you will get results in the timechart. ... View more

a monitor in inputs.conf will monitor continuously the defined folder, if you want to have a cron like check use scripted in inputs. Why is it not working? check the permission on the folder, check splunkd.log for errors related to this path. btw followTail = 0 is not needed in your case. ... View more

Just found another answer which could be helpful: http://answers.splunk.com/answers/23504/determine-currently-logged-in-username ... View more

Hi responsys_cm, sure, have you seen the saved search REST API docs? There are also some examples in the SDKs available: For Java - http://dev.splunk.com/view/java-sdk/SP-CAAAEKY#runsavedargs For C# - http://dev.splunk.com/view/csharp-sdk/SP-CAAAEQF#runsavedargs hope this helps ... cheers, MuS ... View more

Hi ateterine, this because of your time range modifiers you did use, the @h as latest will snap to 03:00pm in your case not 04:00pm. If you want to snap to the current hour you should use this +h@h instead. This can be tested in the UI time range picker, in the Advanced section also the docs have some good examples about Specify time modifiers in your search. Also, you should check the chart graph formatting how it will display 0 or no results; as gap, as zero or connect hope this helps ... cheers, MuS ... View more

Sure, this will work for each month the search runs ... View more

I assume you only search the last 10 minutes if your run your timechart search at this interval? like: you base search earliest=-10m | ... ... View more

Hi karambaz, try something like this: your base search earliest=-6mon date_hour<=06 this will return all events between 12AM and 6AM, this is because 12AM is searchable as date_hour=00 within Splunk. hope this helps ... cheers, MuS ... View more

Hi dominiquevocat, you should have a look at this blog post http://www.georgestarcher.com/splunk-alert-scripts-automating-control/, in Step 10 @starcher is using a this: Our alert script inherits the path to the search results from the arguments, and it uses the session ID which is keyed to the alert script user account to make a REST API call back into Splunk to request the saved credentials we want via my Python class maybe you could use this as example and adapt it to your needs? cheers, MuS ... View more