Well run each search seperate and see if you get results back: (sourcetype=ib:reserved source=ib:user index=ib_security) and then index=ib_summary report=si_hits BTW, as mentioned in your earliest=-1w question, you should NOT set source in inputs.conf see the docs why : http://docs.splunk.com/Documentation/Splunk/6.3.1/admin/Inputsconf ... View more

And here is another tip, you can test / verify it in Splunk running this command: /opt/splunk/bin/splunk cmd pcregextest mregex="^(?P<date>[^\s]+)\s+(?P<time>[^\s]+)\s+(?P<time_taken>[^\s]+)\s+(?P<c_ip>[^\s]+)\s+(?P<cs_username>[^\s]+)\s+(?P<cs_auth_group>[^\s]+)\s+(?P<x_exception_id>[^\s]+)\s+(?P<filter_result>[^\s]+).*?\"(?P<category>[^\"]+)\"\s+(?P<http_referrer>[^\s]+)\s+(?P<sc_status>[^\s]+)\s+(?P<action>[^\s]+)\s+(?P<cs_method>[^\s]+)\s+(?P<http_content_type>[^\s]+)\s+(?P<cs_uri_scheme>[^\s]+)\s+(?P<cs_host>[^\s]+)\s+(?P<cs_uri_port>[^\s]+)\s+(?P<cs_uri_path>[^\s]+)\s+(?P<cs_uri_query>[^\s]+)\s+(?P<cs_uri_extension>[^\s]+)\s+\"(?P<http_user_agent>[^\"]+)\"\s+(?P<s_ip>[^\s]+)\s+(?P<sc_bytes>[^\s]+)\s+(?P<cs_bytes>[^\s]+)\s+\"?(?P<x_virus_id>[^\"]+)\"?\s+\"(?P<x_bluecoat_application_name>[^\"]+)\"\s+\"(?P<x_bluecoat_application_operation>[^\"]+)\"" test_str="2015-11-05 16:01:53 54 10.0.19.44 hammlx1 - - OBSERVED \"Web Ads/Analytics\" http://bcp.crwdcntrl.net/5/c=1226/rand=328960996/pv=y/int=%23OpR%2358075%23DailyMail%20%3A%20Time%20of%20Day%20%3A%2010AM%C2%A0/int=%23OpR%2358689%23Dailymail%20%3A%20Weather-current-description%20%3A%20Cloudy%20with%20outbreaks%20of%20Rain/int=%23OpR%2358690%23Dailymail%20%3A%20Weather-current-temperature%20%3A%2043%C2%B0F/int=%23OpR%2358691%23Dailymail%20%3A%20Weather-upcoming-description%20%3A%20Scattered%20Showers/int=%23OpR%2358692%23Dailymail%20%3A%20Weather-upcoming-temperature%20%3A%2046%C2%B0F/med=%23OpR%2350629%23DailyMail%20%3A%20Home%20Page%20Date%20%3A%20Thursday%2C%20Nov%205th%202015/seg=%23OpR%2350561%23Date%20%3A%20Thursday%2C%20Nov%205th%202015/ug=%23OpR%2350557%23GrapeShot%20%3A%20Channel%20%3A%20gv_weightwatchers/ug=%23OpR%2350558%23GrapeShot%20%3A%20Channel%20%3A%20gv_weightwatchers/ug=%23OpR%2350559%23GrapeShot%20%3A%20US%20Channel%20%3A%20us_negative_crime/ug=%23OpR%2350560%23GrapeShot%20%3A%20US%20Channel%20%3A%20us_negative_crime/genp=%23OpR%2330426%23Site%20Section%20%3A%20index/genp=%23OpR%2330427%23Site%20Section%20%3A%20ushome/rt=ifr 204 TCP_NC_MISS GET image/png;charset=UTF-8 http su.addthis.com 80 /red/usync ?pid=11127&puid=ce5754badf674f9ba73d138adc3e8e1a - \"Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\" 10.0.2.248 451 2394 - \"none\" \"none\"" and this will be the result: #### Capturing group data ##### Group | Name | Value -------------------------------------- 1 | date | 2015-11-05 2 | time | 16:01:53 3 | time_taken | 54 4 | c_ip | 10.0.19.44 5 | cs_username | hammlx1 6 | cs_auth_group | - 7 | x_exception_id | - 8 | filter_result | OBSERVED 9 | category | Web Ads/Analytics 10 | http_referrer | http://bcp.crwdcntrl.net/5/c=1226/rand=328960996/pv=y/int=%23OpR%2358075%23DailyMail%20%3A%20Time%20of%20Day%20%3A%2010AM%C2%A0/int=%23OpR%2358689%23Dailymail%20%3A%20Weather-current-description%20%3A%20Cloudy%20with%20outbreaks%20of%20Rain/int=%23OpR%2358690%23Dailymail%20%3A%20Weather-current-temperature%20%3A%2043%C2%B0F/int=%23OpR%2358691%23Dailymail%20%3A%20Weather-upcoming-description%20%3A%20Scattered%20Showers/int=%23OpR%2358692%23Dailymail%20%3A%20Weather-upcoming-temperature%20%3A%2046%C2%B0F/med=%23OpR%2350629%23DailyMail%20%3A%20Home%20Page%20Date%20%3A%20Thursday%2C%20Nov%205th%202015/seg=%23OpR%2350561%23Date%20%3A%20Thursday%2C%20Nov%205th%202015/ug=%23OpR%2350557%23GrapeShot%20%3A%20Channel%20%3A%20gv_weightwatchers/ug=%23OpR%2350558%23GrapeShot%20%3A%20Channel%20%3A%20gv_weightwatchers/ug=%23OpR%2350559%23GrapeShot%20%3A%20US%20Channel%20%3A%20us_negative_crime/ug=%23OpR%2350560%23GrapeShot%20%3A%20US%20Channel%20%3A%20us_negative_crime/genp=%23OpR%2330426%23Site%20Section%20%3A%20index/genp=%23OpR%2330427%23Site%20Section%20%3A%20ushome/rt=ifr 11 | sc_status | 204 12 | action | TCP_NC_MISS 13 | cs_method | GET 14 | http_content_type | image/png;charset=UTF-8 15 | cs_uri_scheme | http 16 | cs_host | su.addthis.com 17 | cs_uri_port | 80 18 | cs_uri_path | /red/usync 19 | cs_uri_query | ?pid=11127&puid=ce5754badf674f9ba73d138adc3e8e1a 20 | cs_uri_extension | - 21 | http_user_agent | Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko 22 | s_ip | 10.0.2.248 23 | sc_bytes | 451 24 | cs_bytes | 2394 25 | x_virus_id | - 26 | x_bluecoat_application_name | none 27 | x_bluecoat_application_operation | none cheers, MuS ... View more

Take a look at this answer https://answers.splunk.com/answers/50175/ldap-authentication-troubleshooting-information.html and test your user with some native LDAP tool. Also you can increase AuthenticationManagerLDAP logging in Splunk http://docs.splunk.com/Documentation/Splunk/6.3.1/Troubleshooting/WhatSplunklogsaboutitself using a log-local.cfg or start Splunk in debug mode. cheers, MuS ... View more

update ping... ... View more

I assume you have conflicting config here because of this: How app directory names affect precedence Note: For most practical purposes, the information in this subsection probably won't matter, but it might prove useful if you need to force a certain order of evaluation or for troubleshooting. To determine priority among the collection of apps directories, Splunk uses ASCII sort order. Files in an apps directory named "A" have a higher priority than files in an apps directory named "B", and so on. Also, all apps starting with an uppercase letter have precedence over any apps starting with a lowercase letter, due to ASCII sort order. ("A" has precedence over "Z", but "Z" has precedence over "a", for example.) In addition, numbered directories have a higher priority than alphabetical directories and are evaluated in lexicographic, not numerical, order. For example, in descending order of precedence: $SPLUNK_HOME/etc/apps/myapp1 $SPLUNK_HOME/etc/apps/myapp10 $SPLUNK_HOME/etc/apps/myapp2 ... View more

KV store is a good approach, but if you cannot do it there is always stats . If your orders and costumers source types have a common field like id you can to something like this: sourcetype=orders OR sourcetype=costumers | stats values(orders) AS orders values(costumers) AS costumers by id This is un-test since I don't have your data available, but you can read more about this topic here: https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html cheers, MuS ... View more

Update ping; just added some new stuff to the answer ... View more

Hi dominiquevocat, I had the same problem til I changed the div id="force directed" to div id="custom" take a look at this example: <form script="autodiscover.js"> <fieldset submitButton="false"> <input type="link" token="unused"> <label>Choose a visualization...</label> <choice value="sankey">Sankey</choice> <choice value="forcedirected">Force Directed Graph</choice> <default>sankey</default> <change> <condition value="sankey"> <set token="showSankey">true</set> <unset token="showForceDirected"></unset> </condition> <condition value="forcedirected"> <set token="showForceDirected">true</set> <unset token="showSankey"></unset> </condition> </change> </input> </fieldset> <search id="viz_search"> <query> <![CDATA[ index=_internal sourcetype=splunk_web_access NOT uri_path=*/static/* uri_path=*/app/* OR uri_path=*/manager/* | rex field=referer "https?://.+?/.+?(?<referer_path>/[^\\?]+)" | rex field=uri_path "/.+?(?<path>/.+)" | rename referer_path as from path as to | stats count by from to | sort -count | head 50 ]]> </query> </search> <row> <panel depends="$showSankey$"> <html> <h2>Sankey</h2> <div id="sankey" class="splunk-view" data-require="app/simple_xml_examples/components/sankey/sankey" data-options='{ "managerid": "viz_search", "height": 400 }'> </div> </html> </panel> </row> <row> <panel depends="$showForceDirected$"> <html> <h2>Force Directed</h2> <div id="custom" class="splunk-view" data-require="app/simple_xml_examples/components/forcedirected/forcedirected" data-options='{ "managerid": "viz_search", "height": "500px", "panAndZoom": false, "isStatic": false }'> </div> </html> </panel> </row> </form> Hope this helps und Grüsse nach Basel! cheers, MuS ... View more

Have a look at the job inspector and see what is reported there; running | tstats values from datamodel=internal_server over today returns for me this at top of the job inspector: This search has completed and has returned 1 result by scanning 213,774 events in 0.377 seconds. ... View more

Have you tried some different browsers too? ... View more

Splunk 6.3 ... View more

+1 for tstats which will be faster then metadata ... View more

Watch out when using crcSalt = this can give you double indexed events! If you encounter double indexed events, change the initCrcLen and discard crcSalt = 😉 ... View more

You could also simply search for all orders below 1000 this will also return all order containing 3 digits: index=system* sourcetype=inventory order<1000 ... View more

Maybe you have to ping @LukeMurphey for help on this topic..... ... View more

Hi tmarlette, I assume there is some problem with precedence of your cons files, see the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Wheretofindtheconfigurationfiles I would rather try the filter and routing approach described in the docs here http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/Routeandfilterdatad if you have a heavy weight forwarder or send all event to both indexer are filter and nullQueue them on the indexer http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues For your example it would be on server 1: props.conf [testy_testy] TRANSFORMS-null-testy_testy= setnull transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue and for server 2 it would be: props.conf [staging_test] TRANSFORMS-null-staging_test= setnull transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue or visa versa 😉 Hope this makes sense ... cheers, MuS Update: Just found this: it should be possible, you have to define a group in each outputs.conf and specify which input (log path) you want to send to which group Link to routing documentation outputs.conf in App1: [tcpout:App1] server=server1:9997 outputs.conf in App2: [tcpout:App2] server=server2:9997 inputs.conf in App1: [monitor:///opt/splunk/var/log/myLog.log] crcSalt = <SOURCE> disabled = 0 sourcetype = testy_testy index = test_apps _TCP_ROUTING = App1 inputs.conf in App2: [monitor:///opt/splunk/var/log/myLog.log] crcSalt = <SOURCE> disabled = 0 sourcetype = staging_test index = staging _TCP_ROUTING = App2 Make sure you test the precedence of the config files and stanzas with btool to see what is actually applied to the input: $SPLUNK_HOME/bin/splunk cmd btool --debug inputs list | grep -v default Hope this makes more sense now 🙂 cheers, MuS ... View more

If this was useful and answered your question, please accept the answer - thx. ... View more

For my above example it would be like this: your base search here | eval user_time=tonumber(trim(like(source, "%user-info%"), "t")) | eval some_time=tonumber(trim(like(source, "%some-info%"), "t")) | stats sum(hits) AS total_hits by ipaddress, name, hits, user_time, some_time | where some_time < user_time ... View more

It looks like you hint a low disk space limit here: 11-03-2015 04:40:36.779 -0500 ERROR DiskMon - Cannot write data to index path "/opt/splunk/var/lib/splunk/audit/db" because you are low on disk space on partition "/". Indexing has been paused. Will resume when free disk space rises above 5000MB. either free up disk space or decrease the limit in server.conf : [diskUsage] minFreeSpace = <num> * Specified in megabytes. * The default setting is 5000 (approx 5GB) ... View more

This is way I told this before 😉 -> Place this on the Splunk instance where the parsing happens http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings ... View more