We can, by using the command, rpm -Uvh --oldpackage filename ... View more

Hope ur requirement is, Use regex to get timeout value for the user in 1min or Get the list of timeout users in a minute ... View more

use Wget link , u can see it after the required package then on Right side. if needed, Let me know which version link u want ... View more

installing Splunk for Windows via the command line http://docs.splunk.com/Documentation/Splunk/6.2.2/Installation/InstallonWindowsviathecommandline ... View more

Good option but will not help us as we will miss the Time field. ... View more

At the end of your query use , |stats values(user) as user count(user) as eventcount by _time use user also after by clause i.e, |stats values(user) as USER count(user) as eventcount by _time user|fields USER eventcount But i don't think that can be fruitful. Let me know if need more assistance. Updated Query with span of 1min... index=casm_prod sourcetype=smtrace "Center realm" | rex "(?i) Realm\]\[\]\[\]\[\]\[\]\[\]\[(?P[^\]]+" |bucket span=5m _time|stats values(user) as USER count(user) as eventcount by _time |fields USER eventcount ... View more

Firstly, on Forwarder check to which instances it is sending the data to using 1. /opt/splunk/bin/splunk btool outputs lists --debug once u get the output list(IP's) 2. Ping the IP's/IDX to check the connectivity Go to the respective IP's/IDX and check the instance status 1. Server is up and running 2. Look for listening ports(netstat -an) 3. Check Splunk status and also the splunkd.logs ... View more

Troubleshooting, 1.Hope you have restarted your Splunk instance after updating the Lookups. 2. Kindly check by replacing 'as' with 'AS' 3. Finally, just use in search bar with only "| lookup oracle_returncode.csv" ... View more

Just for confirmation. Have you implemented clustering .. ... View more

Good, unique requirement but Hope this can help your requirement, there is a option called 'logrotate' which will help you to created one log file per log(if this is ur requirement) and we can achieve it. go through the logrotate concept in unix. ... View more

Hi Zac, go through the below link, http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/ExtractfieldsinteractivelywithIFX Hope it will help your concerns as it automatically creates the field extraction as per your requirement. ... View more

Hey avmik, 2nd Method: Yes we can delete the data virtually i.e, the metadata will be deleted from Indexers so that the data can't be searchable. Note: Your index size and events will remain same size as before along with buckets. at the end of your query add 'by clause' with delete command eg: if you have 110hosts and you want to see only 2hosts data, index=xxxx_index NOT host=xxx_1 NOT host=xxx_2|delete Hope it can help you. ... View more

A small deployment server (30 or fewer clients) can co-reside with a splunk instance which has other duties, such as a search head, indexer, or other splunk instance. At moderate to large sizes (30-300), the deployment server should reside on its own splunk instance which does not have other duties. http://wiki.splunk.com/Deploy:DeploymentServer Hope this can help you. ... View more

hi Pop, Hope you are not running the search for AllTime, as in AllTime along with events the time value also gets changed. Kindly confirm by running the search query for specific time range. ... View more

Use span with buckets in your search, eg: |bucket span=7d _time or |bucket span=1mon _time http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Bucket http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Timechart Hope it can help you. ... View more

Along with Summary indexing the other alternative option is making a search has made available for later use by creating the savedsearch. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchTutorial/Aboutsavingandsharingreports ... View more

Hope, it can help you. http://answers.splunk.com/answers/8152/ibm-siteprotector.html Kindly share if you have any updates. ... View more

Thanks Martin, Completely agree with you, But why for few hosts it shows the eventsCount and for few it shows with 0events ... View more

It automatically extracts the fields. In your case, clientip and status can be extracted by splunk intelligence. Which can be seen in interesting fields.mostly on indexer/seachheads to avoid the load it is kept to None. Kindly check with this option. ... View more