Hi ndkhoiits, you hit two problems, one is the linebreaking which happens at the wrong place and the wrong timestamp is being used in your events. The linebreaking can be configured, see the docs for more details and examples - take a closer look at the BREAK_ONLY_BEFORE option. If your events have the wrong time stamp, then you can configure Splunk to use the correct one by using props.conf , see the docs for more details and examples. hope this helps ... cheers, MuS ... View more

no problem - feel free to accept the answer ... View more

This is the reply the gmail server gave you, so read the message and you will find Must issue a STARTTLS command first. Have you tried it with the start_ssl option? ... View more

you run the command 'add monitor' on the server where your data is, so in your case on host B. regarding the inputs.conf, forget about it and use the 'add monitor' command at first try. This will handle it for you and you will get some data to start..... ... View more

Hi windyita, here to help again 😉 you have to create any files in local directory yourself. This is were you store your conf files, so they will never be overwritten by any future Splunk software updates. cheers, MuS ... View more

Hi dfigurello, based on the answer by caraaso this works like this: YourSearchHere earliest=-1w@w | timechart <insert your search commands to get your event results> span=1h | timewrap d series=short | addtotals s* | table _time, _span, s1, s8 | rename s1 as last_Monday, s8 as this_Monday This will search YourSearchHere starting at the start of the week before ( -1w@w ), then you will timechart your events to your needs so you get your sales numbers, timewrap it and addtotals . After that you show, according to your question, this Monday and last Monday results with the table command and rename s1 and s8 to human readable names. I did test it with the index=_internal and it worked, so don't blame me if it will not work with your events 😉 hope this helps ... cheers, MuS ... View more

does 'stops at 9am' mean that also no more _internal logs are forwarded by the universal forwarder or just the log data? ... View more

okay, based on /k second example which you used to get it working a multisearch would look like this: | multisearch [ search index=_internal sourcetype=splunkd_access | eval foo=bytes ] [ search index=_internal sourcetype=splunkd | eval bar=workers ] | stats sum(foo) as sumb sum(bar) as sumw | eval result = sumb/sumw but this is really not necessary in your use case since you use fields with different names and different sourcetypes. A multisearch is used for other use cases...... ... View more

Well sorry in this case, I got you wrong. And my example will not work because of this eval foo which will not work. I use some macros but more the other way round. The macro contains the main search and I pass values to it like myMacro(foo) where myMacro is some search and foo is used in this search. ... View more

Hi chrissale, either disable the Windows Add-on on the universal forwarder or setup route and filter on the indexer to filter out the unwanted events. The later must be done on the indexer and is only valid for new events coming in, because the raw data does not get parsed by the universal forwarder. hope this helps ... cheers, MuS ... View more

Hi SplunkBaby, a quick way could be the following multisearch: | multisearch [ search host=HostA | stats sum(filed) AS fieldA ] [ search host=HostB | stats sum(filed) AS fieldB ] | eval division=fieldA/fieldB | table host filed fieldA fieldB division I'm pretty sure there are better and more efficient ways to do it, but this will get you started ... cheers, MuS ... View more

Hi balajsoz, The first error is because the sendemail.py script cannot getaddinfo for server=chp-outlook.nln.com="" , see this for more info. The second error is because your mail server chp-outlook.nln.com probably does not accept your request to send an email, see this for more info. Both errors are not Splunk errors 😉 cheers, MuS ... View more

Hi triest, If I understand it correct you want to search for the result of another search? It so, you can use a subsearch like this: YourMasterSearch [ search gentimes start=-1 | eval foo="index=main | head 10 | table src_ip dest_ip" | fields foo | table foo ] First, this will run the search in [] and the results will be used in YourMasterSearch . Hope this helps ... cheers, MuS ... View more

Splunk tries to recognize the time stamp of events in multiple ways. One is to look in the raw data and search for date and time in it. Do you have some fancy date and time setting in the raw data that could confuse Splunk and makes it think your time is a date? Have you check 'all time' to see if the events come in with a wrong time stamp? ... View more

Hi harshal_chakranrayan, yes, there is a progress bar build into Splunk. You can call it with the module JobProgressIndicator for more details see the docs on use switchers. Another fancy feature about the docs pages: you can search them ... Top right corner of this page http://docs.splunk.com/Documentation/Splunk there you can find a search box, enter the word you are looking for and press enter. hope this helps ... cheers, MuS ... View more

reverse DNS problem like in http://answers.splunk.com/answers/114447/splunk-to-splunk-communication-stuck-in-close_wait ? ... View more

Hi noliver, are you applying this props.conf on the universal forwarder or the indexer? It will not work on the forwarder, since it does not parse the data/events. You must apply it on the indexer or a heavy forwarder, they do data/event parsing. Also, check that the name in the stanza is correct for this source type. Check the docs on route and filter data hope this helps ... cheers, MuS ... View more

Hi jsmith39, you can use the fillnull search command for that. hope this helps ... cheers, MuS ... View more

may I ask why not use a simple source="syslog.log" OR source="syslog-prehash.log" | where sha256!=event_hash this should work as well ... View more

Hi Nikie, find all the information you need in the docs about DB connect hope this helps ... cheers, MuS ... View more

take a look at http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Routeandfilterdatad the 'default behavior' section 😉 ... View more