Update available here https://splunkbase.splunk.com/app/1871/ cheers, MuS ... View more

Update now available here https://splunkbase.splunk.com/app/1871/ cheers, MuS ... View more

Update available here https://splunkbase.splunk.com/app/1871/ cheers, MuS ... View more

Update available here https://splunkbase.splunk.com/app/1871/ cheers, MuS ... View more

Hi splunker969, read the docs about the management console http://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview and most specific about the search usage statistics dashboard http://docs.splunk.com/Documentation/Splunk/latest/DMC/Searchusagestatistics Hope that helps ... cheers, MuS ... View more

Hi kozanic_FF, it just needs a tiny little tweak by adding an additional stats at the end and it works even with single value and trellis 😉 Try this one: index=_internal | stats count by sourcetype | append [| stats count | eval sourcetype=if(isnull(sourcetype), "none", sourcetype)] | streamstats count AS line_num | eval head_num=if(line_num > 1, line_num - 1, 1) | where NOT ( count=0 AND head_num < line_num ) | table sourcetype count | stats sum(count) AS count by sourcetype again it is a run everywhere SPL, and you need to add random strings to the base search to make it work. cheers, MuS ... View more

okay, got the question wrong. Look at the options @DalJeanis posted below vvv - I reckon bin will be the best option. cheers, MuS ... View more

Hi rsm1444, have you tried: TransactionName=WPP* | stats count(TransactionStatus) as TOTAL count(eval(TransactionStatus == "true")) as SUCCESS count(eval(TransactionStatus == "false")) as FAILURE by TotalNoOfThreadsInGroup | where (TotalNoOfThreadsInGroup>=1 OR TotalNoOfThreadsInGroup<=25) OR (TotalNoOfThreadsInGroup>=26 OR TotalNoOfThreadsInGroup<=50) OR (TotalNoOfThreadsInGroup>=51 OR TotalNoOfThreadsInGroup<=75) Note that this does not overlap the thresholds like you asked for. cheers, MuS ... View more

Hi uvmk61, this will work as a two step process, take a look at this answer here https://answers.splunk.com/answers/111602/trigger-a-pdf-via-the-command-line.html Or maybe check this app https://splunkbase.splunk.com/app/4030/#/details maybe this app can do such a thing (disclaimer: never tried this app, so I don't know). Hope this helps ... cheers, MuS ... View more

Check props.conf and/or transforms.conf if there is any filtering or routing configured. I know that _audit is not effected by those settings and therefore reaches your indexer. Also these kind of configuration changes need a Splunk restart to take effect. cheers, MuS ... View more

Well, you can have a look at the license usage by sourcetype based on the LURV to get the numbers. But you will most likely have two problems: Your friendly Splunk sales will be hard to convince to go this approach In case of an incident you will need every single bit of information that you could possibly get out of your systems, so limiting yourself in this regard is dangerous Just my 2 cents 😉 cheers, MuS ... View more

Hi pdantuuri0411, without seeing a sample event, my guess is that Splunk sees one of the values in the JSON as an epoch timestamp. Have a read here http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking and configure the line breaking according. Hope this helps ... cheers, MuS ... View more

I might misunderstood your question, but have a go with this run everywhere search: | makeresults count=3 | eval field1="test with space", bar="baz", field2=bar, field3=123 | map search="| stats count | fields - count | eval map_field1=\"$field1$\",map_field2=\"$field2$\",map_field3=\"$field3$\",map_bar=\"$bar$\" " This might answer and/or clarify the issue. I reckon the important thing is to have the token field in the map search like this \"$name$\" cheers, MuS ... View more

Hi kylosplunk, sorry for not be clear on that, you can run this command to find the location of the transforms.conf $SPLUNK_HOME/bin/splunk btool transforms list --debug This will show all transforms merged and by using the --debug it will also show the path where the file is located. This should help to find the transforms that holds the unwanted stanzas. cheers, MuS ... View more

Hi splunk_mkhan, you can always load additional python modules from your app for example if the Splunk provided module is too old. Find an example here https://github.com/splunk/splunk-sdk-python/blob/master/examples/dashboard/feed.py It is not recommended to upgrade any modules provided by Splunk for various reasons. Hope this helps ... cheers, MuS ... View more

Hi kozanic_FF, take a look at this run everywhere search that will show a text once no search results were found: index=_internal place anything here to produce an empty search | stats count by sourcetype | append [| stats count | eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)] | streamstats count AS line_num | eval head_num=if(line_num > 1, line_num - 1, 1) | where NOT ( count=0 AND head_num < line_num ) | table sourcetype count You need to replace the search filter with each run, otherwise Splunk will find the filter string on the second run in the logs 😉 Adapt the search to your, hope this helps ... cheers, MuS ... View more

Hi kylosplunk, yes, if you are sure those stanzas are no longer needed, you can simply delete them. Might be worth making a backup copy of the file first 😉 Hope this helps .... cheers, MuS ... View more

Hi yutaka1005, you are using an eval and using field vs "field" is not the same 😉 using field in an eval will tell Splunk to use the values of the field field using "field" in an eval will tell Splunk to use the string field As example: | eval bar="111" | eval foo=bar this will result in foo="111" , whereas | eval bar="111" | eval foo="bar" will result in foo="bar" . Hope this explains the problem you encountered. cheers, MuS ... View more

Hi khandpi, you might check this (from the install instruction of the app): ***Please onboard your data as sourcetype=tomato. This will sub-sourcetype to various components with their own logic for extractions, event types, dashboards, etc. This app also assumes your data will exist in index=tomato. If it does not, you will need to update 2 variables. Settings > macros > tomato_index (index=tomato) Settings > eventtypes > tomato (index=tomato) cheers, MuS ... View more

Hi there, if nothing helps, edit server.conf in $SPLUNK_HOME/etc/system/local/ and add [license] active_group = Free Restart Splunk and you're good to go 😉 cheers, MuS ... View more

Hi ianyoung1987, by doing this your universal forwarder will simply connect to port 8089 of the heavy weight forwarder and checks if it has a deployment app or not. The heavy weight forwarder will not route this traffic forward. If you want to do such a thing, try this approach: Your original deployment server has a second directory for the apps that the UF will get in example deployment-apps-hwf , put all apps that will be deployed to the UF's in there. Your servercalss.conf needs something like this: [serverClass:<serverClassName>] stateOnClient = noop repositoryLocation = etc/deployment-apps-hwf targetRepositoryLocation = etc/deployment-apps Next your heavy weight forwarder needs to become deployment client of the deployment server, once this is done add the heavy weight forwarder to the serverclass as client. This should deploy all apps from deployment-apps-hwf to $SPLUNK_HOME/etc/deployment-apps on the heavy weight forwarder. Once this is done configure the server classes on the heavy weight forwarder to deploy the apps to the UF's. Given everything is done correctly you will have the wonderful messy setup of a layered deployment server 😉 This is an example of just because you can, you should not necessary do it - try to deploy the configs to the UF using a different tool like Ansible or Puppet - you will have less trouble 😉 Hope this help anyway ... cheers, MuS ... View more

Just guessing here: could it be you have a multi site cluster? If so check this http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Multisitesearchaffinity - this could explain why only one indexer gets hit by your SHC. But again, this question is missing the level of detail that is needed to be able to help ... cheers, MuS ... View more

Hi rajanshrivastav786, But whenever I do "curl -k http://localhost:8089/en-us", Your problem is that you are using port 8089 AND http, the management port and therefore the REST API uses SSL by default. Just use curl -k https://localhost:8089/ instead and it works. cheers, MuS ... View more