Is this to complete event? Looks like there is missing some data ... ... View more

Hi vrmandadi, if you can split the time values by _time or by host so there are no longer multivalued you could get the average time using something like this: index=test | eval response_time = strptime("ENDPOINT_LOG{}.EML_RESPONSE_TIME", "%Y-%m-%d %H:%M:%S.%3N") | eval request_time = strptime("ENDPOINT_LOG{}.EML_REQUEST_TIME", "%Y-%m-%d%H:%M:%S.%3N") | stats avg(eval(response_time - request_time)) AS avg_response by _time, host This is un-tested but should give you a starting point. Hope this helps ... cheers, MuS ... View more

First create searches that will provide the needed information or results to be able to determine the status of the component or service. Next take a look at this App https://splunkbase.splunk.com/app/1923/#/overview and use it together with your search. Try something simple and easy to start with, like Apache status codes. If there are more than 10 x 404 error codes within one minute set the ample to yellow, else it's green. cheers, MuS ... View more

Hi splunk_zen, if you run splunk cmd parsetest --help you will get some options: Usage: /opt/splunk/bin/splunkd [OPTION...] --nodaemon causes the system not to daemonize -c STRING override the config path -h no longer supported -i no longer supported -n STRING the component name to start with -p INT the management port Splunkd will listen on --debug start with debug log config Help options: -?, --help Show this help message --usage Display brief usage message You maybe noticed, that is says Usage: /opt/splunk/bin/splunkd [OPTION...] so this means the parsetest command should be used when Splunk is stopped. Running the parsetest command will start a Splunk process with the provided options, like --debug which will increase debug verbosity in splunkd.log . But I would only use it when advised by Splunk support to do so, like mentioned in the docs http://docs.splunk.com/Documentation/Splunk/6.3.3/Troubleshooting/CommandlinetoolsforusewithSupport Hope this helps ... cheers, MuS ... View more

Hi avshch, I have no idea about duo security, but I can google that for you http://bfy.tw/4ro7 and found this https://duo.com/docs/adminapi#logs Which means you can get your logs using the API from duo.com ; that said you should be able to use the REST Modular input https://splunkbase.splunk.com/app/1546/ to pull the logs and index them in Splunk. Hope that helps ... cheers, MuS ... View more

HeHe, I was typing for too long - again 🙂 ... View more

Hi dpanych, from the docs http://docs.splunk.com/Documentation/Splunk/6.3.3/Data/Monitorchangestoyourfilesystem : This feature has been deprecated. This feature has been deprecated as of Splunk Enterprise version 5.0. This means that although it continues to function in version 6.x of Splunk Enterprise, it might be removed in a future version. As an alternative, you can: - Learn how to monitor file system changes on Windows systems http://docs.splunk.com/Documentation/Splunk/6.3.3/Data/MonitorfilesystemchangesonWindows - Use the auditd daemon on *nix systems and monitor output from the daemon. If you're running on *nix you can create a scripted input that checks the file permission and index the output result of this script; used in combination with auditd this will provide some excellent results. Hope this helps ... cheers, MuS ... View more

... and put those SPL commands into a saved search which does summary indexing http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Usesummaryindexing and you have it stored for future searches .... if this is what the user wants? ... View more

Hi jkreddy, take at this run everywhere example which will only show a dashboard panel if there are results from the search: <dashboard> <row> <panel depends="$panel_show$"> <chart> <title>index=_internal search over the last 5 seconds</title> <search id="mySearch"> <query>index=_internal sourcetype=splunkd | timechart span=1sec count by sourcetype</query> <earliest>-5s@s</earliest> <latest>now</latest> <progress> <condition match="'job.resultCount' > 0"> <set token="panel_show">true</set> </condition> <condition> <unset token="panel_show"></unset> </condition> </progress> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">none</option> <option name="refresh.auto.interval">5</option> </chart> </panel> </row> </dashboard> Adapt the search to your needs and change the <condition match="'job.resultCount' &gt; 0"> to match your condition. Hope this helps ... cheers, MuS ... View more

or if you want to use \s then it should be "^(\w+\s){3}(?<status>[^\s]+)" ... View more

Hi vrmandadi, take a look at this answer https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html to get an idea how you can use eval if there is no result in the base search. Hope this helps ... cheers, MuS ... View more

In addition this little modification will get all needed results: .... | rex "O [^A-Z]*(?<myfield>[A-Z\-\s]+) \[" | ... ... View more

Can you provide all possible combinations please? ... View more

So far you could only add text into the message, but just test it and see what happens: curl -k -u admin:admin123 https://127.0.0.1:8089/services/messages -d severity="info" -d name=message -d value="click this link https://www.google.com"; ... View more

Hi ahogbin, based on your example and your regex try this: ... | rex "(?<myField>[^\s]+)\s\[" | ... Hope this helps ... cheers, MuS ... View more

Reading the first part of this answer I had to thought of this http://splunkreactions.tumblr.com/post/140342252890/can-we-save-on-license-if-we-use-a-smaller-font 🙂 ... View more

Hi watkinst, your can use the -auth switch with your remote search command: /opt/splunkforwarder/bin/splunk search 'index=_internal' -uri 'https://someremoteip:8089' -auth admin:changeme Just remember that you have to allow remote login on the remote Splunk instance in server.conf allowRemoteLogin=always read the docs for more details on this http://docs.splunk.com/Documentation/Splunk/6.3.3/Admin/AccessandusetheCLIonaremoteserver Hope this helps ... cheers, MuS ... View more

I reckon you should rephrase your question in this case; so we understand what you're looking for and also provide your search string. ... View more

Hi HattrickNZ, in your stats command you can provide names for the result: your base search here | stats max(col1) AS max_col1 max(col2) AS max_col2 Hope this helps ... cheers, MuS ... View more