Save a backup of your 4.x install and test the upgrade path. If you follow the instruction, there should be no problem with your users. ... View more

as I said, you need to have the forwarders _internal available. Another way would be to use the REST endpoint /data/outputs/tcp/ but again, this must be done against each forwarder. I would suggest to enable _internal forwarding this would also help in any case of troubleshooting future issues. ... View more

You're welcome 🙂 ... View more

Hi AaronMoorcroft assuming your forwarders are forwarding their _internal index, you can use the following search to find the tcpout connection targets for all forwarders: index=_internal source=*metrics.log* group=tcpout_connections | chart values(destIp) by host hope this helps... cheers, MuS ... View more

+1 from my side ... View more

take a look at the script used by this App, it is a simple Python script using the urllib2 module. For Docs about urllib2 module goto http://docs.python.org/2/library/urllib2.html ... View more

Hi kavekon, as I wrote my examples will get you started. Since I don't have your data available nor know what exactly you want to achieve, this is simply try and error. But ... | timechart span=1w values(ETIME) by ConcurrentProgramName will for sure work and if you need values for WEEK in the 3rd example, simply add values(WEEK) to the search. ... View more

Hi vijayansundararajan, have you tried the App Web Page Monitor? Within it you can choose whether it will index the page content or not. It supports basic authentication as well as HTTPS. Otherwise you can write a Python script which will grab the Webpage and do what ever you want with it within Splunk. hope this helps... cheers, MuS ... View more

Hi kavekon, let me try to help you, but you almost answered the question yourself.... to get a search result where all the rows where rank <11 should appear, append the following to your search: ... | where rank < 11 Once I get the data, I want to show a chart of concurrent program execution time over all the weeks each concurrent program in one chart, append the following to your search: ... | chart values(ETIME) over WEEK by ConcurrentProgramName If this fails because of the WEEK, use instead ... | timechart span=1w values(ETIME) by ConcurrentProgramName Another charts of the top 10 ConcurrentProgramName on x axis and etime on y axis per week, use this search (top will return by default the top 10 of the provided field) and modify the report the match your request: ... | top ConcurrentProgramName | chart values(ETIME) values(ConcurrentProgramName) hope this helps to get you started... cheers, MuS ... View more

a reverted convert mstime() would be the perfect match here ... View more

no strftime takes epochtime as input as were strptime takes a time represented by a string....but now after some testing it looks like strptime isn't working either 😞 ... View more

Hi anava One way I can think of is that you simply disable the App in which your saved searches / alert are located during the maintenance. This way the saved searches are not run any more and you will not get any alerts. After the maintenance enable your App and everything will be back normal. If your saved searches are not in another App then the Search App by now, this would be a good opportunity to move them into one. Because you shouldn't disable the Search App! Also there used to be an App where you were able to mark host for maintenance so you will not get spammed by alerts....but sadly I cannot recall the name of it 😞 cheers, MuS ... View more

glad I could help and thanks for accepting the answer 🙂 ... View more

Hi sgoyal, in addition to /K answers consider to configure your LDAP server to log the etime for each operations. This way you will get exact run times for each operation in milliseconds. ... View more

Hi sgoyal, I could help you on that but you have to wait until monday.... ... View more

Hi Ak_C Check out the docs about the example on how to use DNS lookup for host IP. Splunk ships with a script to handle this kind of external reverse DNS lookups . hope this helps... cheers, MuS ... View more

Hi Ak_C RSS feeds can be enabled the same way you setup email for this report. As you can see in the docs you can opt RSS feed from the Manager > Searches and Reports for each saved search. hope this helps.... cheers, MuS ... View more

Hi Ak_C, can please provide more detailed information on what you want to achieve? ... View more

sure you can use 'earliest=rt-0d@d latest=rt' in the 'time range picker - custome time - advanced search language' for your search ... View more

Hi cpotenzone No, you cannot do this in the manager.... But, since the Pinger app uses one single config file, this file could be modified by any tool which is able to do so. For example, you could modify the file outside of Splunk and use puppet to deploy it. Another example would be to setup some fancy Web editor tool where you can modify the file directly in a web browser. Basically there are almost endless ways to do this kind of file modification, outside of Splunk though. Providing such a way of changing a .conf file is also a security risk and remember that typos happen fast. In the end it all comes to a point where you have to judge the benefits against the risks of any solution, that will allow 'remote' modification of any .conf file. cheers, MuS ... View more