found a solution! working on the alert script..... ... View more

Hi yadvendra, sorry but I cannot help you further in this matter. You will have to do a lot of reading in the docs and setup your Splunk according to your needs. Just don't give up on this - everyone was a newby sometimes 😉 ... View more

Hi sure it does, you must include \ like this ((\w+\.){2,6})(?<test>\w+\b) it will create new fields called test ... View more

Hi mohankesireddy, you can use something like this: YourFancySearchCommand | regex _raw="(?i)YourFieldName=\"*\"" this will search for all YourFieldName's which has a value of * hope this helps ... cheers, MuS ... View more

Hi navinmistry, Yes it can - Splunk can read anything as long as it is human readable text. See the docs for more detailed information on what Splunk can monitor hope this helps to get you started ... cheers, MuS ... View more

other question, why do use a flashtimeline.xml in your app if it is the same as in the search app? ... View more

Hi mstegmueller, quickest approach, do a SSH login to your Splunk server and search for it: find /opt/splunk -name flashtimeline.xml -exec ls -la {} \; and replace yours with the newest one found. hope this helps ... cheers, MuS ... View more

did you try btprobe? see this answer http://answers.splunk.com/answers/64679/how-can-i-tell-if-a-file-has-been-recorded-correctly-by-the-tailing-processor ... View more

Hi mcbradford, make sure the user email is in the search result. Then setup your own email script and parse SPLUNK_ARG_8 for the user email and use it in the script. hope this helps ... cheers, MuS ... View more

Hi adityapavan18, basically you can say that a queue is blocked until the congestion in the next queue is removed. Most cases for blocked queues are either a temporary indexer overload, slow disks or forwarders sending too much data for what ever reason (some java log from a application gone crazy for example). You can limit the forwarder to not sent too much data at once in limits.conf: [thruput] maxKBps = <integer> * If specified and not zero, this limits the speed through the thruput processor to the specified rate in kilobytes per second. additionally you can setup a persistent queue on the forwarder to prevent data loss. Regarding the Indexer, you can follow this checklist about performance. hope this helps ... cheers, MuS ... View more

Hi Jananee_iNautix welcome to Splunk 🙂 Take a look at this page on docs it is all about forwarding data from Splunk to third party systems. Update: by following this docs, you will 'convert' your Splunk indexer into a heavy forwarder. One Splunk instance can be indexer and forwarder at the same time. Hope this helps to get you started ... cheers, MuS ... View more

Can you verify if the buckets were moved or not? Could you turn on Debug for the BucketMover channel and if you get more details for this? Permission problem? ... View more

well that was what you requested in first place 😉 To match the last word in any of the above provided errors you could use something like this: ((\w+\.){2,6})(?<test>\w+\b) cheers ... View more

you should not delete bundles unless you want to mess up Splunk. For the moment I cannot tell you if there is a conf option to limit that. If I find something, I'll get back to you. ... View more

Hi prad18 quick one would be like this: (?<test>(\sSQL|(\w+\.){3}\w+SQL)+Exception) this matches org.springframework.jdbc.UncategorizedSQLException and SQLException You can test your regex by using this nice online regex tester hope this helps ... cheers, MuS ... View more

Looks like I found a way to achieve this.....but I have to verify this first.... ... View more

in addition to this correct answer: check this app http://apps.splunk.com/app/396/ it will enable Splunk to send growl pop-up messages - cheers ... View more

nice - thanks for this ... View more

if you run this search in the search app: index=acess_web |eval Gb=bytes_in/1073741824| timechart span=1d sum(Gb) do you get back any results? Do you have any field named 'bytes_in'? ... View more

wow - we answered at the same time: lukejadamec answered 22 secs ago MuS answered 22 secs ago ... View more

Hi iKate, have you tried using chart instead of timechart ? timechart count is basically the same as chart count by _time , so just use that with a different field instead of _time. hope this helps ... cheers, MuS ... View more