@RT - thanks for the hint, I will close this question and mark it as duplicate. ... View more

sorry, but how about that -> http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Whatisdistributedsearch ... View more

Hi Aaron, according to http://kc.mcafee.com/corporate/index?page=answerlink&url=spD2Ro8-7xeSDi5pMVrcP4NU4ttaDgfvDk2wLTCzMyuMz4oyiLGtCwXyK-df8-rTJFeDr-E2d5KAfwI6LVw1bnWuIQsNjHpp38oNnKthbAH6Wc3uAV-hNpjW3UWjKYYsGpZI9jjhwVKI1eUpoOcSUeU-qClOYC9FdHJAIZeHvnV1D7BddyGF4Wl3Dbj!5NFlu1RIhjiLdQqM2H2GOdxPHEZ0vPcJgGQP&answerid=16777216&searchid=1378124191887 you can configure the logs in a matter so it will write a txt log file. This can be monitored by Splunk, read more here http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor ... View more

Converted my comment to an answer, so you could accept it 😉 cheers, MuS ... View more

Hi badland check your props with btool: $SPLUNK_HOME/bin/splunk cmd btool props list also keep in mind each change in props and/or transforms needs a reload. this can be done with this search command on the fly: | extract reload=T here are some sources which are useful in this case: Troubleshooting configurations - in-depth examples using btool. Configuration file precedence - understanding Splunk layered configurations. Attribute precedence within a single props.conf file - discussion on using priority and matching based on souce:: vs host:: vs sourcetype. hope this helps, cheers - MuS ... View more

no, if there is a transitive relationship between the fields in the fields list, the transaction command will use it. Best for you would be to create field extraction for 'eventX' and use this in transaction. ... View more

well according to your example it looks like the host field is either 'Sa' or 'Sb' and tag is either '1' or '2' and this is why the transaction command is grouping them this way. read more here: http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Transaction ... View more

Hi crazyeva if your host field really is host=Sa this is eventX then you could use endswith=<filter-string> Description: A search or eval filtering expression which if satisfied by an event marks the end of a transaction. and or startswith=<filter-string> Description: A search or eval filtering expression which if satisfied by an event marks the beginning of a new transaction. with your transaction like this: yourSearch | transaction startswith="Sa this is event8" .... hope this helps, cheers - MuS ... View more

okay like always got curious and did some testing: permission errors will be reported like this Pid file "/opt/splunk/var/run/splunk/splunkweb.pid" unreadable.: Permission denied so for this part my answer is wrong. But like grijhwani and I did say correctly, having the file system in read-only mounted will show more errors and possible end in data loss. ... View more

Hi adityapavan18 well according to the message the user trying to restart splunk does not have permission on the file /opt/splunk/var/run/splunk/splunkweb.pid. If your file system would be read only, your splunk would have thrown many, many other messages nor would be able to index any kind of data. cheers, MuS ... View more

btw did you check out the Sharepoint App yet http://apps.splunk.com/app/1559 ? ... View more

couldn't stop to try further 🙂 here is another, more easy one try this: (?<=[Il ]Exception: )(? \w+([.\s]\w+)*) ... View more

I think you got some starting point here and should be able to create the matching regex now. ... View more

Hi ChhayaV when I'm doing regex, I use http://gskinner.com/RegExr/ this works perfect to test regex and you see what you get. So I took your provided data, pasted it into gskinners RegExr and tried some commands. After some try and error I came up with this regex: (?<=[(Innr)l ]Exception\: )(?<FieldIdentifier>.+?)\w+[\.\w]*[\s\w]+ This matches, at least for the provided data, what you asked for. Does that make sense? Cheers, MuS ... View more

provide more information so anyone would be able to help? are you searching the correct index and time range? do you have permission to do so? ... View more

hehe, copy paste error - updated the answer 🙂 ... View more

Hi linu1988, once did some epoch to human readable converting using this commands: convert timeformat="%Y-%m-%d %T" mktime(Message_time) | fieldformat Message_time=strftime(Message_time,"%Y-%m-%d %T") adapted to your search it should be something like this: | stats max(_time) as LastBackup,min(_time) as StartBackup,sum(FileSize) as TotalBackupSize | eval TimeDiff=LastBackup-StartBackup | fieldformat TimeDiff=strftime(TimeDiff,"%T") | table StartBackup LastBackup TimeDiff does that make sense? Cheers, MuS ... View more

here is a good source for the XML character references http://myhandbook.info/codes_htmlchr.html ... View more

Hi aaronkorn, try the sample in the docs about dynamic drilldown http://docs.splunk.com/Documentation/Splunk/5.0.4/Viz/Dynamicdrilldownindashboardsandforms and you should be able to get the result you want. cheers, MuS ... View more

found one way to be able to drill down with sla line, use the eval before the timechart like this: … | eval b=50 | timechart values(b) as base count by foo ... View more

Hi overboard, just got curious, because Americas Cup is currently running.... Have you ever used Splunk for this? Cheers, MuS ... View more