SO I am using an EVAL command in one of my searches in order to name process state as "OK" or "DOWN". This is my Query: sourcetype=WMI:Service Name=VMTools | dedup host,Name | eval State = if(State == Running, "OK","DOWN") | table _time,host,Name,State When I do I get the process is down, even if it's running. Please take a look at the image: Now when I remove the "EVAL" Statement in the query above, it looks just fine. This is the query I am using: sourcetype=WMI:Service Name=VMTools | dedup host,Name | table _time,host,Name,State This is the image for the results no less than 1 minute after the previous image: I am just wondering if I am doing something wrong? I checked the documentation, but I haven't seen this behavior before. I've been looking at this for awhile, and I'm wondering if there is a simple syntax error i'm overlooking? ... View more

When I do a search on my search head for all time, I see correct time stamps in standard EST. When I do a 15 minute search, I see time stamps from 5 hours ago. My search head and indexer are both set to CST on the OS, and the logs are coming in in EST which has been defined in props.conf. Does anyone know why this could be happening? This is an image of my sourcetype time stamps, vs my system clock (CST). ... View more

I have quite a few services that I am looking to grab the latest state on, for each machine. I am trying to come up with a couple different searches, and wanted to look here for some help. I am trying to build a search that will table each of the services, and their latest state, by host. What I have so far is this: sourcetype=WMI:Service Name=servicename host=hostname | stats latest(State) by host,Name The next search I'm trying to create is one to search for an 'OK' state based upon the parameters I give it. This would be a set of services that are in an 'up' state, and if any one of them are down, then it reports a 'Bad' state. I'm doing something like this currently: sourcetype=WMI:Service (Name= OR Name= OR Name= OR name= OR Name= ) | dedup host | eval State = if(State == Running, "OK", "Down") | stats latest(State) by _time,host I believe this is giving me the latest results, all together. Is there a better way to do either of these? ... View more

I am attempting to get the latest status of a port scan for 5 different ports per host into a table. I am trying to format it as follows: time,host,hostname,port1,port2,port3,port4,port5 Currently, my search string looks like this: (sourcetype=port_scan dst_port=443 | stats latest(dst_port_state) AS "port 443 state") OR (sourcetype=port_scan dst_port=80 | stats latest(dst_port_state) AS "port 80 state") and so on, but I am getting errors when running this search. Any assistance would be greatly appreciated! ... View more

I am building a state aware app, that uses ping checks and port checks to 'healthcheck' machines. I am looking to have the app display the host name, and the latest status of the host, and then run this in a realtime search, and display as a table. So far I have this: sourcetype=ping_scan tag= | table dest_ip,status I know the 'latest' command will give me the latest status, but I am having a difficult time putting that into a table format. any insight would be wonderfully helpful! ... View more

I am still running Splunk 5.0.1.2, but I am wondering if there is a way to adjust the splunk email alert content / form without having to manipulate the python script? if not does anyone know if this is adjustable in 6.0? ... View more

I have recently downloaded and installed the splunk for bluecaot app, and i'm having some difficulty adapting it. We are using the legacy proxySG (5.4) so I have usedthe bcreportmain_v1_old transofrm to extract the necessary fields, and this is working properly. I am having difficulty with some of the other views however, and it seems to be the views that are attempting to utilize the 'tstats' command in the search. take for instance the 'Bandwidth Savings' view. I see absolutely no results, so in troubleshooting I have opened the .xml to see what the search query looks like that this dashboard is using. I put that into a regular search to see if it returned some results, but it returns nothing at all. all searches for this view exhibit the same behavior. Please take a look. this is for the "Requests" count. The very first result set on the page. | tstats sum(bytes_in) AS sbi FROM bluecoat_stats | eval mb_in=round(sbi/(1024*1024), 2) | fields mb_in I've never used the 'tstats' command before, so I'm unfamiliar with it's function, however after viewing the documentation, it looks like this query is attempting to call a named series of data to present statistics on it. I am in an attempt to figure out what loads the "bluecoat_stats" data block, because it would seem that it may be broken, or needs some tweeking to make it work. Any suggestions would be greatly appreciated! ... View more

I am attempting to count the number of times a user has made a web server 'hit', and also display the average latency of that/those users. Search Query: sourcetype=www NOT hck=* user=< user > | stats avg(time_taken) as "latency(1s)" | stats count(user) by latency(1s) I can't seem to get the fields to come out right, either I get just the latency, or the count and the latency without the user. ... View more

I am attempting to get the top offenders of average latency, by their client IP, but limited to the top 50 results, sorted by their latency. This is the search that I have, but I can't figure our why it doesn't return any results. If I remove the 'top' command from the below query, it returns results, but it returns all of them, which isn't as helpful. sourcetype=www NOT hck=* | stats avg(timetaken) by _time,clientip | top timetaken any suggestions would be great! Thank you! ... View more

I am attempting to find out the average latency of my requests by ip, per hour, over a 24 hour period. I'm sure i'm making this far too complicated, but it's friday at 5pm. 😃 The search I'm using: website=services* NOT hck=* | bucket _time span=60min | stats avg(time_taken) by clientip this is returning a single value, so i would assume that splunk is averaging the values per hour, and giving that single value? any help is appreciated! ... View more