no, you can call your execute.py as input script. place #!$SPLUNK_HOME\bin\python at the first line of execute.py if it still fails, read this http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptWriting ... View more

why are you using a .bat to start a python script? start the python script directly instead ... View more

Hi sjlin, use this as start script for your input: $SPLUNK_HOME\bin\splunk cmd python execute.py arg1 arg2 this way all Splunk relevant environment settings are made and the script will be executed as Splunk user. Or you call/start your execute.py directly and use $SPLUNK_HOME\bin\python as shebang ... like this: $SPLUNK_HOME\bin\python execute.py arg1 arg2 hope this helps ... cheers, MuS ... View more

then try what martin_mueller suggested and try to build a base search which will return the best result for you. Also try streamstats ... View more

use all the known troubleshooting techniques like: is the server up and running? is my PC up and running? is the Splunkd and splunkweb up and running? is there any firewall blocking my requests? is there anything else I'm doing wrong? check all Splunk log file in $SPLUNK_HOME/var/log/splunk/ for any errors..... ... View more

permission troubles perhaps? check splunkd.log for any messages related to this directory and/or those files ... View more

you asked for transforms and the answer for this is, no ... View more

Hi sushma7, You monitor path is wrong, use this instead [monitor://E:\Splunk] Also read the docs on how to monitor files and directories and about monitorNoHandle is special. Cheers, MuS ... View more

Hi HansWurscht, try something like this: ... | transaction maxspan=600s maxevents=2 startswith="request" endswith="response" "host" "transaction" | ... I often get better performance if I put the needed transaction fields in quotes because if a quoted list of fields is specified, events are grouped together if they have the same value for each of the fields. Also if you define a startswith and a endswith and set the maxspan to seconds or minutes it should be faster. hope this helps ... cheers, MuS ... View more

no this must be done in props.conf not in inputs.conf ... View more

Hi bigbeetlefan, you can do this with rex like this: ... | rex mode=sed field=YourField "s/__b/ /g" | ... cheers, MuS ... View more

Hi premg, first make sure your internal logs are forwarded from the universal forwarder towards the indexer, this is only in Splunk 6 UF default for _audit . If so you can search like this for the events on the indexer: index=_audit cheers, MuS ... View more

Hi a212830, this is set per default this way, see the docs about outputs.conf: indexAndForward = [true|false] * Index all data locally, in addition to forwarding it. * This is known as an "index-and-forward" configuration. * This attribute is only available for heavy forwarders. * This attribute is available only at the top level [tcpout] stanza. It cannot be overridden in a target group. * Defaults to false. cheers, MuS ... View more

Hi sushma6, something like this should work: ... | spath | eval myDevision=filesize/transtime | table myDevision This is because when spath is called with no path argument, spath runs in "auto-extract" mode, where it finds and extracts all the fields from the first 5000 characters in the input field which defaults to _raw if another input source isn't specified. If spath really does not work, you could try some regex to get the fields like this: ... | rex "\<filesize\>\s(?<myFilesize>\d+)\s.+\<transtime\>\s(?<myTranstime>\d+)\s" | eval myDevision=myFilesize/myTranstime | table myDevision btw, are you aware that there are some spaces around the numeric values or is this just a copy/paste error? In your case you can remove spaces from values like this: ... | spath | eval myFilesize=ltrim(filesize) | eval myTranstime=ltrim(transtime) | eval myDevision=myFilesize/myTranstime | table myDevision hope this helps ... cheers, MuS ... View more

Hi elusive, as addition, here is a good doc about How to file a great Support case cheers, MuS ... View more

read this http://docs.splunk.com/Documentation/Splunk/6.0.2/Indexer/RemovedatafromSplunk but this will have no effect on your disk space problem on the C: drive, because you moved the data in the indexes to another drive ... View more

sure, but you will hit the same problem again and again as soon as there is some search activity going on, because this is were your search results/artifacts are stored.... ... View more

look, since this looks like a newer install with almost no historical data I would suggest that you uninstall Splunk from your C: drive and install Splunk on a drive which holds more free space. ... View more

seams your C: drive is pretty tight on space, try to clean up to gain disk space and lower the disk space alert for splunk in server.conf minFreeSpace option or in the UI > settings > general settings > 'Pause indexing if disk space ...' ... View more

Hi ramanapvr, take a look at the send events to specific index docs, this is what you can setup on the indexers to send data from one universal forwarder (you call it agent) to a specific index. hope this helps ... cheers, MuS ... View more

okay, you can restart Splunk from the UI as well since you don't want to keep the old data. Just in case you want/need to keep the old indexes, change the setting in the UI but don't restart yet. do a 'net stop splunkd', move data and do a 'net start'. You can stop/start Splunkweb, but this is not mandatory for this action. ... View more

Yes, this will change the setting globally for all indexes. But you still have to move the files from 'old path' to 'new path' while Splunk is not running. ... View more

Hi DereckKing, you could do something like this: | metadata type=hosts index=* | stats count(host) as myCount | eval key="foo" | lookup assetinventory key as key OUTPUT value AS newCount | eval myPerc=myCount*100/newCount | table myCount myPerc I did setup a lookup based on the following dummy lookup file: key,value foo,30 this is needed to do some dummy lookup and will get back the total number of your assetinventory . The lookup file can be updated on a nightly base by running a saved search which will search all reporting hosts and updates the lookup with outputlookup There is probably some other way to achieve this, but this will get you started. cheers, MuS ... View more