Hey @kteng2024! Don't forget to "accept" answers when someone answers your question. It helps make the answers more useful to others and awards karma points to the people who are helping you out. 🙂 ... View more

What is your inputs.conf configuration and do your events have a date_zone field? ... View more

There should be a field called user, is it showing up as a blank column? ... View more

Thank you for the reply.. when i tested your regex , data after the bankID is being removed i don't see PerbankId/personIdExternal=123456789}. ... View more

@somesoni2 - This is ugly... tostring(100-round(diskTotalinGB / rawTotalinGB * 100, 2)) + "%" This is not.... tostring(100-round(100*diskTotalinGB / rawTotalinGB, 2)) + "%" ... View more

It is the amount of license usage per day, per source type. index=_internal source=*license_usage.log* type=Usage | eval gb=b/1024/1024/1024 | timechart span=1d sum(gb) AS sourcetype_volume_GB by st ... View more

I believe you will need to look into the interesting fields generated when running index=_internal source=*license_usage.log type=Usage and if not mistaken you will find a field called st that refers to the original source type. ... View more

Thank you for the reply. But i would like to know how data is that sourcetype sending to splunk before indexing . ... View more

You could take a look at the outputs.conf file on the forwarder. ... View more

Why are you using HF? Take a look at these posts and reconsider your use of HF. http://answers.splunk.com/answers/231395/uf-hf-idx-architecture-is-there-a-recommended-numb-1.html - answer-230578 http://blogs.splunk.com/2016/12/12/universal-or-heavy-that-is-the-question/ If you still want to use HF, perhaps you want to review the Troubleshooting Manual http://docs.splunk.com/Documentation/Splunk/6.6.2/Troubleshooting/Troubleshootindexingperformance ... View more

@kteng2024 I would suggest the approach of creating a new app and just add the attribute to it and send it to two different destinations : web01abc23 App1 [monitor://xyz.log] sourcetype=web_log index=abc web01cde21 app2 [monitor://xyz.log] sourcetype=web_log index=abc _TCP_ROUTING=HeavyForwarders_1 Hope this helps. ... View more

Regex processing: 1) If regex is correct , you should see extracted field in interesting fields for that sourcetype by using spl query. 2) from GUI, settings->fields-> field extractions-> search for sourcetype or field name. it should fetch some results CPU and Memory: 1) Install Splunk_TA_nix splunk Addon. So it will report cpu, memory and other os related stats. 2) Settings->Montoring Console-> Resource Usage-> Resource usage:Instances-> select the instance - for this you need setup montoring console ... View more

Take a look at the documentation for inputs.conf, specifically the _TCP_ROUTING setting, which allows you to select your target groups defined in outputs.conf. This post may also help understand the mechanics. ... View more

TCP/8089 is the default management port used by Splunk for communicating with other Splunk instances (And REST API.) Port 9997 is not a default port, but in the examples this is the SPlunkTCP Input port on the indexers that takes Splunk Cooked data from a HF. (So the UF/HF sends to TCP/9997 on the indexers.) All of these ports can be changed via the configuration files. ... View more

The reason why data is missing will depend on how its getting indexed If you are monitoring a file which is managed via logrotation, then problem can be with the filechecksum. Splunk may have already indexed data from the beginning of the file and file was rotated which may have resulted in data not getting indexed from rest of the file. ... View more

start here: http://docs.splunk.com/Documentation/Splunk/6.6.2/Troubleshooting/Cantfinddata hope it helps ... View more

I have updated my answer to include all requirements. ... View more

Think of it this way - each indexer is like a library with its own librarian. Whenever you start a search, you give a request to the head librarian, and she writes instructions for all the other librarians to check their libraries for the books you have asked for, and instructions on what to send back (the whole book, or just a couple of pages). When you cancel a search at the search head, the head librarian has to write an instruction to cancel the searches at each library, then the individual librarians need to get that order. If they happen to be back in the back shelves and storerooms getting information for your search, or for another search, there might be a delay before they know they are supposed to stop your search. II recall correctly, there is a ten minute default duration for searches, so ten minutes after the search head is brought down, all of the subsidiary searches should have completed... although I'm fuzzy on the exact process order so I'll defer to wiser heads. ... View more

You need to tune OOM Killer because Splunk need "all the stuff" routinely and that generally should not be a reason to kill it. ... View more

hello there, here is one solution leveraging the | rest endpoints and the "updated" field that they provide: first one is for your views / dashboards. code: | rest /servicesNS/-/-/data/ui/views | search eai:acl.app = * | table title eai:acl.app eai:acl.owner updated | eval updated_epoch = strptime('updated', "%Y-%m-%dT%H:%M:%S-%:z") | eval now = now() | where updated_epoch > now - 12960000 | sort - updated | fields - now updated_epoch the number 12960000 is approximately 5 months (in seconds) you can adjust as you wish if you want to see all the saved items, change the first line in the code to this: | rest /services/saved/searches here is a sample screenshot. i created a dashboard couple of minutes ago to demonstrate it catches it. named it "transaction complete" hope it helps p.s. there are probably other ways to achieve what you are looking for. possibly in a better way too. also, you will probably want to filter the user = nobody items as i assume you are looking for views created by users and not by pre-built apps ... View more

Thank you for answering the question . If the oldest data age is 5 days, splunk will delete all the data before 5 days ? ... View more

Index data retention is enforced the bucket level (not as individual events), based on the earliest timestamp value stored within bucket. So, to keep the data for a 6 months/180 days, you should ensure that bucket roll from hot to warm every day, regardless of how slow the flow is. Something like this should work in indexes.conf : [YourIndexName] homePath = $SPLUNK_DB/YourIndexName/db coldPath = $SPLUNK_DB/YourIndexName/colddb thawedPath = $SPLUNK_DB/YourIndexName/thaweddb #Rollover data bucket everyday maxHotIdleSecs = 86400 #NEVER keep more than 180 days of data frozenTimePeriodInSecs = 15552000 #NEVER let the index get bigger than 5G homePath.maxDataSizeMB=5000 Even so, I almost never use frozenTimePeriodInSecs because NOT doing so allows me to see the gradual impact of the increase in daily volume on my index. If I do NOT use that setting then my index is ONLY constrained by space (not by date) and I can actually watch as older events are dumped off the back end to make room for new data on the front end (you need to watch both ends). If the data for your index grows so large that 60 days no longer fits, splunk will roll buckets sooner than your frozenTimePeriodInSecs value specifies and you need to know this (preferably before it gets to that point). Whenever a bucket is rolled, there is a log that indicates this. The other answers make sure that you expire data when you should but you ALSO need to have a handle on the opposite to make sure that you are NOT expiring data when you should NOT be. To do this you need to track that the size of 6-months worth of data always ("still") fits within the filespace that you have allotted for this index. To do this, you need to setup an alert or periodic report based on this search: index=_internal sourcetype=splunkd bucketmover | rex "[\/\\\](?<indexname>[^\/\\\]*)[\/\\\][^\/\\\]*db[\/\\\]db_(?<newestTime>\d+)_(?<oldestTime>\d+)_\d+" | rex "db_(?<newestTime>\d+)_(?<oldestTime>\d+)_\d+.*?[\/\\\](?<indexname>[^\/\\\]*)[\/\\\][^\/\\\]*db" | sort 0 - oldestTime | dedup indexname | eval retentionDays=(_time-oldestTime)/(60*60*24) | table _time indexname retentionDays ... View more

@kteng2024 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks! ... View more

Can I use CURL to retrieve saved search? ... View more