Hi ivantn21 have a look at this, looks like this is not possible as by now. cheers, MuS ... View more

Hi martin_mueller you forgot the third option, increasing the waittokill registry entry in Windows. I did not test it, but maybe this would be a way to go for you. In HEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control you will find the string WaitToKillServiceTimeout . If you double click it and then in the > Edit String window, change the > Value data from the default of 12000 (12 seconds) to whatever. (Click OK to save the change). hope this helps... cheers, MuS ... View more

Hi AaronMoorcroft have a look at the Deployment Monitor within this App you can find such searches and views to display forwarders which are sending more then expected. hope this helps... cheers, MuS ... View more

Hi bloodstrife after you put your script into etc/apps/YourApp/bin folder and placed the commands.conf into etc/apps/YourApp/default folder, restart Splunk and switch to YourApp. There simply enter the following search command: | CurrentTime and this will run your command. But I tested your script and the output is none. Here is a quick and dirty rewrite to get it printing current time in csv like output that Splunk likes: import time; mytime = time.localtime(time.time()) print "my_year ,my_mon ,my_mday ,my_hour ,my_min ,my_sec ,my_wday ,my_yday" print "%s, %s, %s ,%s ,%s ,%s ,%s ,%s" % (mytime.tm_year, mytime.tm_mon, mytime.tm_mday, mytime.tm_hour, mytime.tm_min, mytime.tm_sec, mytime.tm_wday, mytime.tm_yday) I'm pretty sure there are better ways to do this in python 😉 But nevertheless hope that helps .... Cheers, MuS ... View more

Take a look here about the fishbucket http://answers.splunk.com/answers/97996/searching-_fishbucket ... View more

| delete does not delete events, the events are no longer searchable but are still in the index. Therefore your files get not reindex. You have to clean the fishbucket to reindex the files ... View more

Hi royimad that would be latest=-1d@d to be used in your search. You can find time modifiers here or in the UI select the time range picker - custom time and in the next screen select Advanced search language and start with your test. The nice thing in the UI is, that the time modifiers like -1d@d gets translated into human readable time. hope that helps.... cheers, MuS ... View more

Hi Ak_C take a look at the docs about Define navigation to saved searches and reports, there you will find all you need to create a sub menu. In Splunk sub menus are called nested collections. cheers, MuS ... View more

Hi shreeCS well timechart has time on the X-axis by default. Your problem is that you count the numbers of events that contain a field named durationHrs, instead of displaying the values of this field. To achieve what you want, change your search to something like this: host="abc" | convert mstime(Outtime) AS otime, mstime(Intime) AS itime |eval durationHrs=(otime - itime)/60 | timechart values(durationHrs) AS myDuration hope this helps..... cheers, MuS ... View more

Hi /k, see my update came up with the same in the end - dur2sec works and mstime() fails because of the missing MM:SS.SSS format ... View more

yes we can and see my update, did some tests and this works fine for me. ... View more

Hi ChhayaV you can use the convert command on Out_Time and In_Time to do your eval , take a look at the examples in docs. After some testing and proofing, this works for me: host="sample" | convert dur2sec(Out_Time) dur2sec(In_Time) | eval diff=(Out_Time - In_Time) | eval Newfield=tostring(diff, "duration") | table Newfield This was tested and it will convert Out_Time and In_Time into second values, the eval will substract it and the last eval will revert it into HH:MM format. hope it works and helps cheers, MuS ... View more

Hi wbordeau like /k said, your search is slow because of the data amount and because of the timechart after a where after a stats . Why don't you simplify your search to something like: earliest=-7d@d latest=now sourcetype="squid" | bucket _time span=1d | stats count by clientip _time | where count > 35000 this should bring back results immediately and you can still use reporting graphs on the result. If the result is useful, set it up as saved search with summary indexing enabled. This will speed up your future searches, if you use the summary index in your future searches. hope this helps.... cheers, MuS ... View more

use it like yannK wrote: crcSalt = <SOURCE> SOURCE is NO placeholder 😉 ... View more

Hi manikdham you can add a HTML link to any URI to the navigation menu, if you add something like this to your default navigation menu: <a href="/app/YourAppName">YourAppName</a> either do this in the Manager » User interface » Navigation menus » default or by editing the file nav.xml in the path $SPLUNK_HOME/etc/apps/YourAppName/default/data/ui/nav hope this helps cheers, MuS ... View more

Hi freeborn An Indexer can also be at the same time a Forwarder, just follow the examples provided @docs http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Forwarddatatothird-partysystemsd Change props and transforms to your needs, don't forget to restart your splunk or reload the new configs by executing the following search command | extract reload=T Also make sure your Indexer can reach the destination server over the network and the destination port is open and listening (don't forget Firewalls, routers and all kind of other Networking things). Hope this helps to get you started.... cheers, MuS ... View more

Hi Parameshwara here is an extract from docs about HiddenPostProcess: A post process search has an unconfigurable limit of 10,000 raw events that can be passed to it. You could avoid the limit by using smaller time ranges to construct the data cube before passing them on to the HiddenPostProcess. Hope this helps..... Cheers, MuS ... View more

dammit, you beat me on that - need to index more coffee 🙂 ... View more

Hi prabhu_kar if i get you correct, you can use the following sample to get a count of certain Status field values: ... | stats count(eval(Status=Pass)) as PassCount by Destination the PassCount is a new field, which is needed and can be used further. hope this is some kind of helpful cheers, MuS ... View more

@RT - thanks for the hint, I will close this question and mark it as duplicate. ... View more

sorry, but how about that -> http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Whatisdistributedsearch ... View more

Hi Aaron, according to http://kc.mcafee.com/corporate/index?page=answerlink&url=spD2Ro8-7xeSDi5pMVrcP4NU4ttaDgfvDk2wLTCzMyuMz4oyiLGtCwXyK-df8-rTJFeDr-E2d5KAfwI6LVw1bnWuIQsNjHpp38oNnKthbAH6Wc3uAV-hNpjW3UWjKYYsGpZI9jjhwVKI1eUpoOcSUeU-qClOYC9FdHJAIZeHvnV1D7BddyGF4Wl3Dbj!5NFlu1RIhjiLdQqM2H2GOdxPHEZ0vPcJgGQP&answerid=16777216&searchid=1378124191887 you can configure the logs in a matter so it will write a txt log file. This can be monitored by Splunk, read more here http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor ... View more

Converted my comment to an answer, so you could accept it 😉 cheers, MuS ... View more