the upper and the lower lock the same? Have you checked your Splunk user timezone settings? ... View more

nope, MAX_TIMESTAMP_LOOKAHEAD sets a value to tell Splunk how far past the TIME_PREFIX location it must check in the event for the timestamp. ... View more

cloud you please provide more details? Because basically you say, it works but then again you say the stats command provides different results?? ... View more

Hi togmolodon, no need to extract fields by rex, just use the spath search command on your JSON logs and you're ready to build your table. See example #3 in the docs about spath. hope this helps ... cheers, MuS ... View more

epic answer 🙂 ... View more

Hi harshal_chakranarayan, Splunk uses the following precedence rules to assign time stamps to events: Splunk looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure TIME_FORMAT in props.conf. If no TIME_FORMAT was configured for the data, Splunk attempts to automatically identify a time or date in the event itself. It uses the event's source type (which includes TIME_FORMAT information) to try to find the timestamp. If an event doesn't have a time or date, Splunk uses the timestamp from the most recent previous event of the same source. If no events in a source have a date, Splunk tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.) For file sources, if no date can be identified in the file name, Splunk uses the file's modification time. As a last resort, Splunk sets the timestamp to the current system time when indexing each event. kudos go to docs team for this cheers, MuS ... View more

Hi Jananee_iNautix, try something like this: (Connected to \[|UserID \[)(?<userid>.+)[\:\]] here is a good online regex test tool http://www.regexr.com/ where you can test your regex. hope this helps ... cheers, MuS ... View more

if it was helpful please accept the answer, thanks ... View more

glad to help, I'm sure you will find the problem 😉 ... View more

looks like syslog so Splunk will extract the hostname automatically as field hostname=myhostname1.net ... View more

in this case use rex as well to get/extract fields like router name and others from your raw events first. then you can use them in the alert. ... View more

Hi HeinzWaescher, looks like JSON data, have you tried the spath command on your event and do your stats after that? hope this helps ... cheers, MuS ... View more

Hi splunklab2013, you can limit forwards from sending too much data in limits.conf with this stanza: [thruput] maxKBps = * If specified and not zero, this limits the speed through the thruput processor to the specified rate in kilobytes per second. * To control the CPU load while indexing, use this to throttle the number of events this indexer processes to the rate (in KBps) you specify. This must be set on the forwarder and not on the indexer! Hope this helps, cheers MuS ... View more

Hi cmeo, you can use chart instead to do this: sourcetype=df | chart span=1h values(mount) AS mount avg(storage_percent_free) AS pctfree over _time by host should do the job for you. cheers, MuS ... View more

you can use puppet to install the universal forwarder - the lesser 'hard way' 😉 ... View more

Hi kkossery, No, Splunk does not support pull method for remote logs out of box ..... but you could do it in different ways: rsync the logs from the indexer and read the files from there NFS mount the source files and index them from there Anyhow, best way to do it, is using the universal forwarder and forward logs to the indexer. hope this helps ... cheers, MuS ... View more

Hi Runals, see this answer from @lguinn, maybe this helps .... cheers, MuS ... View more

small update on the regex, this will not include the \/ in the value of field: (? \w{64}) ... View more

Hi dinesh_wadhwa, /k is correct, best way is to use Splunk search commands. BUT .... since Splunk can do magic: Setup Splunk internal DB connector dbconnect and then use the dbquery like this | dbquery "DB connector name" "YourSQLfu" cheers, MuS ... View more