Hi iamlearner123, from the docs http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstorage coldToFrozenDir If you don't set either this attribute or coldToFrozenScript, the indexer will just log the bucket's directory name and then delete it once it rolls to frozen. Long story short, there is no default directory for frozen - it will be deleted. Hope this helps ... cheers, MuS ... View more

Hi kentcoble, I'm not sure if there is a special docs page about this topic, but basically what you need to do at a minimum is to create your add-on folder that contains a bin and a local directory. Store your scripts in the bin folder, make sure it is executable, and configure the inputs.conf in local like this for *nix: [script://./bin/YourScriptNameHere.py] interval = inSeconds or cronSchedule sourcetype = something index = another one and like this for Windows: [script://.\bin\YourScriptNameHere.ps] interval = inSeconds or cronSchedule sourcetype = something index = another one This should do it and you can deploy it to the universal forwarder. Hope this helps ... cheers, MuS ... View more

Hi auaave, Your events contain time stamps that are not usable with any of the http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Commontimeformatvariables switches (Upper case month is the major problem!) So, this needs to get fixed manually using rex and some eval before you can even think about using strtime() on the events. By cleaning the timestamps and normalising ORDERNO you can get a nice table with this search: your base search here ( source="WCT_4DELIVERY_ORDER_STATUS.csv" STATUS="finished" ) OR ( source=WCT_4ORDER_PLANNED.csv PLANNINGRESULT=OK ) OR ( source="ORDER_PROCESSED.csv" ) OR ( source="ORDER_RECEIVED.csv" ) | fields DELIVERYORDER PLANNINGRESULT EVENTTS ORDERNO STATUS DELIVERYORDER SIOFLAG RFT source | rex field=DELIVERYORDER "-(?<ORDERNO>\d+)" | rex field="EVENTTS" "^(?<ts_1>\d{2}\/[A-Z])" | rex field="EVENTTS" "^\d{2}\/[A-Z](?<ts_2>[A-Z]{2})" | rex field="EVENTTS" "^\d{2}\/[A-Z][A-Z]{2}(?<ts_3>.+)" | rex field="RFT" "^(?<rft_ts_1>\d{2}\/[A-Z])" | rex field="RFT" "^\d{2}\/[A-Z](?<rft_ts_2>[A-Z]{2})" | rex field="RFT" "^\d{2}\/[A-Z][A-Z]{2}(?<rft_ts_3>.+)" | eval ts_2=lower(ts_2), ts_4=ts_1 ."". ts_2 ."". ts_3 | eval rft_ts_2=lower(rft_ts_2), rft_ts_4=rft_ts_1 ."". rft_ts_2 ."". rft_ts_3 | eval ftime=strptime(ts_4, "%d/%b/%y %H:%M:%S.%3N") | eval rft_time=strptime(rft_ts_4, "%d/%b/%y %H:%M:%S.%3N") | table ORDERNO PLANNINGRESULT RFT rft_time SIOFLAG STATUS ftime EVENTTS | stats values(*) AS * by ORDERNO ftime The results look like this: These results can be further processed by comparing rtf_time < ftime for example or what ever you want to do with them. Hope this helps ... cheers, MuS ... View more

HI troyward, have a look at this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html where you can find a way to do it. Hope this helps ... cheers, MuS ... View more

Hi 22isaiah, but now you get an answer 😉 According to the logs it's not related to your pass4SymmKey 😉 You have this setting on the forwarder in outputs.conf : master_uri = http://10.130.154.112:8089 but it should be master_uri = https://10.130.154.112:8089 This is the reason the cluster master is complaining with this message: WARN HttpListener - Socket error from 10.xxx.xxx.xx while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number So the master is not even checking the pass4Symmkey because the forwarder is not able to establish a proper connection. Hope this helps ... cheers, MuS ... View more

Hi Valisha2005, based on the generic example you provided, you can use something like this: source=x OR source=y | stats count values(*) AS * by url_id | sort - count | head limit=30 Read this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html to learn more about this topic. Hope this helps ... cheers, MuS ... View more

Hi auaave, after indexing your csv I was able to get it working with this SPL: Your base search here to get all events | eval LOCATION=case(like(REQLOCATIONTEXT,"%ASRS%"),"ASRS", like(REQLOCATIONTEXT,"%Induct%") or like(REQLOCATIONTEXT,"%Receiving%"),"Conveyors", LOCATION="1", "Sorter", isnotnull(LOCATION), LOCATION, 1=1, "unknonw") | stats count(eval(source="mfc_read.csv" OR (BIT_FLAGS="1" OR BIT_FLAGS="4" OR BIT_FLAGS="9"))) AS READ, count(eval(source="mfc_noread.csv" OR (BIT_FLAGS="2"))) AS NOREAD by LOCATION | eval "READ%"=round(READ/(READ+NOREAD)*100,2) The problem was that we lost LOCATION=1 after the first stats , so I extended the first eval and it worked 😉 Hope this helps and all suitcases are tracked correctly now 🙂 cheers, MuS ... View more