Hi the_wolverine, Yes, this is possible: | tstats count where earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" index=_internal groupby _time span=1m | tstats count where index=_internal earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" groupby _time span=1m | tstats count AS myCount where earliest="11/11/2015:00:00:00" latest="11/12/2015:17:12:00" index=_internal all searches use latestTime 2015-11-12T17:12:00.000+13:00 which can be verified in the search.log This is tested on Splunk 6.3.1 on Linux. cheers, MuS ... View more

Yes, that's the way to log events from your script into splunkd.log . Here is another example http://docs.splunk.com/Documentation/Splunk/6.3.0/AdvancedDev/ModInputsExample ... View more

do slow today 🙂 ... View more

Hi clorne, did you import logging in your script as stated in the example? cheers, MuS ... View more

Just updated the answer and the search ... View more

ahh just found the error 🙂 remove host=indexer from the search ! ... View more

do you have access to index=_internal ? run this search: index=_internal host=indexer source=*license_usage.log type="Usage" The above search is the one from the License Usage Report, just added the useother=f usenull=f options.... ... View more

Hi rrmavani, What is the intention to do so? Giving user access to Splunk CLI on a forwarder will not enable them to run a local search on it. Further more you have to enable some config option to be able to remote connect to the Splunk management port which will open potential security risks. The easiest way to give a Splunk user CLI access is to use this App https://splunkbase.splunk.com/app/1607/ which gives the user Splunk CLI access within the Splunk UI. But to answer your initial questions (just remember the potential security risks you're about to open): what need to be installed in their local computers ? To my surprise you only need an universal forwarder and can run a remote search using this command /opt/splunkforwarder/bin/splunk search 'index=_internal earliest=-1min|stats count by sourcetype' -uri 'https://TheRemoteServer:8089/' What need to be configured to be able to perform search ? Read the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/AccessandusetheCLIonaremoteserver and enable allowRemoteLogin= on the remote server Hope this helps ... cheers, MuS ... View more

Feel free to up-vote this comment and/or answer 😉 ... View more

un-tested since no Splunk available at this time of the day; but try: | rest /services/data/indexes | search title=TheIndexYouWant | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc ... View more

Hi vijaymythili, this message usually occurs if one tries to use a Windows path on *nix or Mac or visa versa. You cannot use \\servername\foo\boo\baz or c:\foo\boo as input on *nix and also you cannot use /foo/boo/baz on Windows, so check the used path. Hope this helps ... cheers, MuS ... View more

Hi sjaworski, one thing that straight popped into my eyes is crcSalt = This in dangerous on rotated log files, because it could lead to the log file being re-indexed after it has rolled. You could limit the monitored files by using whitelist and or blacklist or setup the monitor stanza just to watch this one log file [monitor://$SPLUNK_HOME/etc/apps/eStreamer/log/estreamer.log] See the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Inputsconf for more details. Hope this helps ... cheers, MuS ... View more

Hi apurvsrivastav, I don't think it's the perfect answer - but I post it as one, because the question is not Splunk related as well 😉 Have a look at the posts I found using a simple google search https://www.google.com/webhp?hl=en#hl=en&q=d3+sankey+change+color+based+on+value , because you must do this in either the sankey.js or using css but not in Splunk itself: http://stackoverflow.com/questions/22439891/d3-sankey-chord-colors http://stackoverflow.com/questions/13006712/d3-js-sankey-diagram-rectangles-fill-color http://stackoverflow.com/questions/30614921/changing-the-colour-of-the-node-in-sankey-diagram-using-d3-js-library Hope this helps ... cheers, MuS ... View more

Hi duanehare, run this search, which is basically the same from the license usage report but with added useother=f usenull=f so you no longer have the OTHER group in the time chart: index=_internal source=*license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | join _time pool type=outer [search index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS stacksz by slave, pool, _time | stats max(stacksz) AS stacksz by _time, pool] | stats sum(b) AS bytes_used max(stacksz) AS stacksz by h, _time | timechart span=1d max(eval(round(bytes_used/stacksz*100,2))) by h fixedrange=false useother=f usenull=f Hope this helps ... cheers, MuS ... View more

Well, this is a generic example and does not cover all month. You have to adjust it to your needs, if it really has to be every second week, because the interval will change over the months and this would end up in some if-then crontab which will be not easy to manage. For example one for January 2016: * 06 1-7,15-21,29-31 1 0 But for February 2016 only run it like this, if it was last run in January on the 30th: * 06 12-19 2 0 otherwise run it like this (based on January / February 2014 combination): * 06 1-7,15-21 2 0 Good luck in keeping this clean and I'm sure if you search hard enough there are even more confusing combinations possible. Make it easy, simple and straight forward; run it forthrightly * 06 1,15 * * Yes, I know this will also not provide a precise 2 weeks interval! ... View more

Okay, in this case I'm not sure if you would need spath at all or if you're better off using a rex : your base search here | rex max_match=0 "[Mm]essage[IiDd]+":(?<MessageID>[^}]+)" | ... tested on regex101.con and with pcregextest in Splunk with this examples: {"Request": {"Header": {"MessageID":1234}}} {"Response": {"Header": {"MessageID":1234}}}' {"Response": {"Header": {"messageID":1234}}}' {"Response": {"Header": {"messageiD":1234}}}' {"Response": {"Header": {"MessageId":1234}}}' Just in case MessageID could also contain lower case m, i and d 😉 cheers, MuS ... View more

Sorry to be the bearer of bad news again; but this will not work. He's trying the build a a Python custom command that's generating, so it doesn't receive any events. therefore the command will not be able to use info_min_time nor info_max_time . It would work if the custom command gets some events by using splunk.Intersplunk.readResults . ... View more

hint: ...| eval myTime=if(like(source, "%hits_table.csv"), _time, null()) see docs http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/CommonEvalFunctions ... View more

Hi willprince, Over time your Splunk install will get bigger, more apps added, more knowledge objects added leading to bigger knowledge bundles. The knowledge bundle is the data that the search head replicates and distributes to each search peer to enable its searches. Have a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/DistSearch/Limittheknowledgebundlesize to learn about more on how to limit the size of the bundles. Also have a look at distsearch.conf http://docs.splunk.com/Documentation/Splunk/6.3.1/admin/Distsearchconf and the option sendRcvTimeout = <int, in seconds> * The maximum number of seconds to wait for the sending of a full replication to a peer. to increase the number of seconds to wait for the replication. Last but not least, check the network connection between your search heads and indexers if the bottleneck is there? Is this just related to one search peer? If so, try to remove and add it again as search peer... Hope this helps ... cheers, MuS ... View more

Start working on the provided example, the last step will be a minor one - hint : | where time > logintime AND time < logouttime But you have to use a convert dur2sec() on all time values to be able to compare them; Splunk does not like for example the : in logintime or time You will get there 😉 ... View more

Running this search on Splunk 6.3.1 on Linux works: index="_internal" sourcetype="splunkd" source="*metrics.log" earliest=-1w It will return 450,072 events (before 11/10/15 9:19:03.378 AM) ... View more

Hi GauriSplunk, I converted your comment to an answer since it looks like you solved your time stamp issue/problem by setting a latest value in the search. Is that correct? cheers, MuS ... View more