that's a nice one as well and I was typing for to long 🙂 ... View more

Hi adityapavan18, the following searchFu are example and you need to match them to your events, but you could do something like this: ... | rex field="_raw" "CallDuration: (?<hours>\d+)h:(?<minutes>\d+)m:(?<seconds>\d+)s" | eval CallDurationInSeconds = ((hours*60*60)+(minutes*60)+(seconds)) or something like this if you have duration over or under one day: ... | rex field="_raw" "CallDuration: (?<dur_day>[0-9]+)?d? *(?<dur_hour>[0-9]+)h?:(?<dur_min>[0-9]+)m?" | eval connduration=(if(dur_day=="",0,dur_day)*1440*60)+(dur_hour * 60*60)+(dur_min*60) hope this helps ... cheers, MuS ... View more

this is really a nice approach! have to write it down on the ThingsICanDoBetterNextTime List 😉 ... View more

Hi SplunkBaby, try something like this: host=ABC | eval Sales_Month=strftime(now(), "%B") | ... this will return the field Sales_Month as march as of today 03/27/2014. Yes, the field name Sales_Month and "Sales Month" are the same, because Splunk tends to replace spaces in field names with a _ . hope this helps and thanks for voting 😉 cheers, MuS ... View more

Hi cmiles416, I'm honest, I don't fully understand your request...but let me show you a run everywhere example in which I 'group by xxx' and use concurrency after that. First I run this: index=_internal series=* | eventstats count by series | delta _time AS timeDelta p=1 | eval timeDelta=abs(timeDelta) | concurrency duration=timeDelta | timechart span=1h max(concurrency) by series This will search in index=_internal for all series , then the eventstats will group it for you and keeps all other fields as well. What happens next is some SplunkFu Magic to setup some dummy duration field with delta , eval and concurrency and in the last step I use timechart by series to display max values of concurrency for each series over a _time span of one hour. hope this helps ... cheers, MuS ... View more

You're welcome, please mark this as answered by clicking the tick and/or up vote the answer - Thanks ... View more

Hi SplunkCSIT, I don't know what your problem is or why things are happening, but here is something you must know about re-indexing data. Splunk keeps track of what was indexed and therefor does not re-index the same data again .... unless you do some work. The radical method is to clean the fishbucket index. That will remove the memory of every files, be warned it will re-index all data. on an indexer splunk clean eventdata -index _fishbucket on a forwarder by removing the folder $SPLUNK_HOME/var/lib/splunk/fishbucket You could selectively forgot a single file from the fish bucket like this: splunk cmd btprobe -d $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db --file $FILE --reset You could manually re-index each file with the oneshot option splunk add oneshot "/path/to/my/file.log" -sourcetype mysourcetype You could modify the first line of the files to re-index, by default Splunk checks the first 256 chars of a file to differentiate them. If you had a simple comment on the first line it wil reindex it You could change the crcSalt, create a new input for a new folder, add all the correct sourcetypes, etc... add the option crcSalt=<SOURCE> then move or copy the files to be re-index to the folder. hope this helps ... cheers, MuS ... View more

Hi tunix, So here is our co-anser 🙂 MuS suggested this: index="idx_MYINDEX" | bin _time span=1d | stats count as Views by _time,View_Name | timechart span=1d avg(Views) as avg_Views by View_Name this should give you the result you expect tunix replied and used this: Thanks for help - this works for me.. index="idx_MYINDEX" | bin _time span=1d | stats count as Views by _time,View_Name | stats avg(Views) as avg_Views by View_Name | sort - Views Cheers, MuS ... View more

looks like your install is messed up. I can reproduce this on my two servers like this in the $SPLUNK_HOME/bin directory ... good server, Splunk works cd bin/ bin]$ source setSplunkEnv bin]$ bad server, simply deleted almost everything in /opt/splunk cd bin/ bin]$ source setSplunkEnv -bash: eval: line 38: unexpected EOF while looking for matching `'' -bash: eval: line 39: syntax error: unexpected end of file Since this a new setup I suggest to download a fresh copy of Splunk and re-install Splunk. ... View more

Hi Jananee_iNautix, On the Email alert settings Settings page, you can define the Mail server settings (the mail host, security type, username, password, and so on) and the Email format (link hostname, email sender name, email subject header, and inline results format). In other words, you specify the Message Transfer Agent (MTA) or mail server your Splunk server will use to send out alert emails. In *nix this is per default localhost , if it is not localhost enter the hostname and if needed some credential to authenticate to be able to send emails. hope this helps ... cheers, MuS ... View more

Hi chengyu, the .conf files look good and it seams you did follow the docs on this. The most common reason for such 'errors' like transforms and props not being honored are that your sourcetpye is not matching. The sourcetype in props.conf must be 100% exact, so if you have it like MySourceType in the events it must be MySourceType in the props.conf - double check this. Also remember the inital restart of Splunk after the first setup of this kind of transforms. Afterwards you can reload the transforms and/or props be doing this search in Splunk: | extract reload=T hope this helps ... cheers, MuS ... View more

and is your datetime.xml really in /etc/system/local or in $SPLUNK_HOME/etc/system/local/ ? ... View more

S.o.S is usually installed on every Splunk install, so to check the SH best thing to do is install S.o.S on them as well ... View more

Hi ajaysamantbms, the problem with this kind of question is always the same: if this will work in your setup with your data must be tested by yourself and therefore only you will be able to answer if this will work for you or not. the conf files look ok and the regex matches your XML data. So go ahead and test it 😉 cheers, MuS ... View more

did you enable the cpu.sh input? ... View more

nevertheless you can try this regex Label\":\"(?<myLable>(\w|\s)+) this picks up all labels from the provided data. ... View more

hmm looks like JSON....have you tried the spath command on the data? This will take care of JSON key value extraction out of the box. http://docs.splunk.com/Documentation/Splunk/6.0.2/SearchReference/Spath ... View more

Just saw that your Charset is A in inputs.conf instead of props.conf and B is wrong. It should be charset not Charset . See docs about binary file error http://docs.splunk.com/Documentation/Splunk/6.0.2/Troubleshooting/Binaryfileerror ... View more