Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Hemnaath
Hemnaath
Motivator
Member since:
03-15-2015
11-20-2025
Community Statistics
| Posts | 903 |
| Solutions | 12 |
| Karma Given | 1 |
| Karma Received | 55 |
| Member Since | 03-15-2015 |
Activity Feed
- Posted Re: How to create heatmap visualization in dashboard studio? on Dashboards & Visualizations. 11-20-2025 09:06 PM
- Posted How to create heatmap visualization in dashboard studio? on Dashboards & Visualizations. 11-20-2025 03:56 AM
- Got Karma for How to troubleshoot and fix the website input 504 Gateway Timeout Error while configuring an input ?. 01-12-2024 02:44 PM
- Posted Re: Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-29-2023 03:34 AM
- Posted Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-28-2023 04:58 AM
- Tagged Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-28-2023 04:58 AM
- Got Karma for Re: Splunk has found 1 orphaned searches owned by 1 unique disabled users.Click to view the orphaned scheduled searches. Reassign them to a valid user to re-enable or alternatively disable the searches.. 06-13-2023 04:41 AM
- Posted What splunk precedence rules should be followed to upgrade splunk clustered environment ? on Splunk Enterprise. 01-26-2023 01:29 AM
- Got Karma for Unable to break the multi-line events into single event from kinesis log?. 11-07-2022 02:14 AM
- Posted Re: How to write a Splunk query to find the Splunk UF version for specific set of hosts in Splunk Enterprise on Splunk Enterprise. 10-31-2022 11:13 PM
- Posted How to write a Splunk query to find the Splunk UF version for specific set of hosts in Splunk Enterprise on Splunk Enterprise. 10-31-2022 06:44 AM
- Got Karma for Re: ERROR: kvstore port [8191] - port is already bound. Splunk needs to use this port.. 10-13-2022 02:16 PM
- Posted Where can I get the release notes for Splunk enterprise v8.2.6.1 release notes ? on Splunk Enterprise. 07-26-2022 11:17 PM
- Posted How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”? on Getting Data In. 05-26-2022 09:01 AM
- Posted Re: How to write a monitoring stanza to monitor the windows Event Viewer logs on Getting Data In. 05-12-2022 08:59 AM
- Posted Re: How to write a monitoring stanza to monitor the windows Event Viewer logs on Getting Data In. 05-12-2022 06:14 AM
- Posted How to write a monitoring stanza to monitor the windows Event Viewer logs? on Getting Data In. 04-29-2022 03:13 AM
- Posted Re: How to write time format for 2022-04-07 20:40:03.360 -06:00 [XXX] XXXXX? on Splunk Enterprise. 04-16-2022 07:18 PM
- Posted How to write time format for 2022-04-07 20:40:03.360 -06:00 [XXX] XXXXX? on Splunk Enterprise. 04-14-2022 09:17 AM
- Posted Why is Splunk ingesting additional information from the source, when there is no actual data present in the source ? on Splunk Enterprise. 04-13-2022 05:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-27-2017
09:09 PM
Hi All, Can any one guide me on the above issue, as we could see some 22 agent node are getting this above error.
thanks in advance.
... View more
08-27-2017
09:07 PM
Hi Garethatiag, thanks for your effort on this issue. There are 6 apps throwing the search scheduler status = skipped, out which three apps are configured in the cluster master search heads. search head console -->settings--knowledge -->datamodels.
Query details:
dmc_set_index_internal sourcetype=scheduler (status="skipped")
Event details:
08-27-2017 23:22:51.627 -0400 INFO SavedSplunker - savedsearch_id="nobody;critical_security_controls;ACCELERATE_C090FDA2-105E-4875-A110-3F13FF986151_critical_security_controls_admin_4b2771dc07d5983d_ACCELERATE", search_type="report_acceleration", user="admin", app="critical_security_controls", savedsearch_name="ACCELERATE_C090FDA2-105E-4875-A110-3F13FF986151_critical_security_controls_admin_4b2771dc07d5983d_ACCELERATE", priority=default, status=skipped, reason="The maximum number of concurrent auto-summarization searches on this cluster has been reached", concurrency_category="summarization_scheduled", concurrency_context="cluster-wide", concurrency_limit=15, scheduled_time=1503890400, window_time=0
App name : critical_security_controls
There are 23 data models configured on this app.
1) Alerts 2) Application state 3) authentication 4)certificates 5) change analysis, 6) Data Loss Prevention 7) CIM Validation (S.O.S) 😎 Database 9) Email 10) Hybris script failure 11) Interprocess messaging 12) Instrution detection 13)Inventory 14)JVM 15)Malware 16)Network Resolution (DNS) 17) Network session 18) Network Traffic 19) Performance 20 )splunk audit logs 21) Splunk's internal Audit logs -Sample 22) Splunk's Internal Server Audit logs-Sample 23) Ticket Management 24) Web 25)Vulnerbilities 26)Updates
08-27-2017 23:33:07.111 -0400 INFO SavedSplunker - savedsearch_id="nobody;Splunk_TA_CIM;ACCELERATE_DM_Splunk_TA_CIM_Authentication_ACCELERATE", search_type="datamodel_acceleration", user="nobody", app="Splunk_TA_CIM", savedsearch_name="ACCELERATE_DM_Splunk_TA_CIM_Authentication_ACCELERATE", priority=highest, status=skipped, reason="The maximum number of concurrent auto-summarization searches on this cluster has been reached", concurrency_category="summarization_scheduled", concurrency_context="cluster-wide", concurrency_limit=15, scheduled_time=1503891180, window_time=0
App name: Splunk_TA_CIM
08-27-2017 20:35:05.695 -0400 INFO SavedSplunker - savedsearch_id="nobody;symantec_app;ACCELERATE_DM_symantec_app_Symantec_Endpoint_ACCELERATE", search_type="datamodel_acceleration", user="nobody", app="symantec_app", savedsearch_name="ACCELERATE_DM_symantec_app_Symantec_Endpoint_ACCELERATE", priority=default, status=skipped, reason="The maximum number of concurrent auto-summarization searches on this cluster has been reached", concurrency_category="summarization_scheduled", concurrency_context="cluster-wide", concurrency_limit=15, scheduled_time=1503880500,
App name : symantec_app
Kindly guide me how to fix this problem.
... View more
08-27-2017
06:27 AM
Hi Garethatiag, thanks for your effort on this, test01 is the deployment instance and all the three apps are configured under instance, but when checked the deployment console -->settings--knowledge -->datamodel unable to find the data model in deployment instance
But I could see the data model being configured in the cluster search head master server instance. But unable to locate these app in that server under--> opt/splunk/etc/apps/. So can you please help me in how to find out which data model is configured for the apps/saved search causing the issue.
App name: search
APP Name : DA-deployment_monitor
App name: sos
This is the first time I am facing this issue, not having much idea on data models, so please do help
me.
... View more
08-25-2017
09:19 AM
Hi Cmerriman, thanks for you effort on this, I had checked in the test01 deployment console -->settings-->datamodel -- but unable to find any data model configured in this instance. So can you please tell me how to find the which data model is configured for the apps/saved search causing the issue.
App name: search
APP Name : DA-deployment_monitor
App name: sos
Kindly help me on this.
... View more
08-25-2017
07:28 AM
Hi Garethatiag, thanks for your effort on this, Can you please guide me how/where I can find the accelerated data models setting on test01 which is the deployment server. From my DMC console, after executing the above query, I could see the above events and from that events, I can fetch the app name and server name not the exact savedsearches name.
Question :
In test01 the below apps are configured but not sure how/where to find the accelerated data models.conf file and saved search details. And also how to fix this issue.
App name: search
APP Name : DA-deployment_monitor
App name: sos
Please garethatiag, help me on the above question, as this issues is pending for more than a week.
... View more
08-25-2017
07:12 AM
Hi All, I am currently facing an issue with some of the remote host machine not getting a customized app. Yesterday I had made some changes to inputs.conf and pushed the changes from the centralized repository to Deployment server instance and from DP instance, I had executed the splunk-reload deploy-server command to push the changes to all the remote windows machine. We have almost 1000 + nodes with UF agent installed, out of which 20 nodes are having an issue in getting the customized app.
From Forward management console, I could see the below errors are populated for these 20 nodes.
"index=_internal sourcetype=splunkd record (New OR Updating) name=8DD546C9-C911-4B37-8227-C0182473C895 result=Fail | head 100"
UF agent version is 6.6.1
Splunk version is 6.6.1
Only the modified app test-ia-windows is not getting pushed to this 20 node, but could see other apps communicating with Deployment server.
Kindly guide me how to fix this issue.
... View more
08-24-2017
11:14 AM
Hi Spayneort, after making the above changes in the inputs.conf the Invalid key in stanza got fixed.
OS Logs
[WinEventLog://Application]
disabled = 0
current_only = 0
ignoreOlderThan = 2d
checkpointInterval = 5
index = windows
[WinEventLog://Security]
disabled = 0
ignoreOlderThan = 2d
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = windows
[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = windows
thanks.
... View more
08-24-2017
02:46 AM
Hi All, Currently we could see few skipped schedule searches in our environment. From the deployment instance we have ran this query to get the list of skipped searches.
Query details:
dmc_set_index_internal sourcetype=scheduler (status="skipped")
Event details:
08-24-2017 03:12:12.981 -0400 INFO SavedSplunker - savedsearch_id="nobody;DA-deployment_monitor;_ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_DA-deployment_monitor_nobody_1a56f43bf8d5bf20_ACCELERATE_", search_type="report_acceleration", user="nobody", app="DA-deployment_monitor", savedsearch_name="_ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_DA-deployment_monitor_nobody_1a56f43bf8d5bf20_ACCELERATE_", priority=default, status=skipped, reason="The maximum number of concurrent auto-summarization searches on this instance has been reached", concurrency_category="summarization_scheduled", concurrency_context="instance-wide", concurrency_limit=2, scheduled_time=1503558600, window_time=0
APP Name : DA-deployment_monitor
hostname: test01
Event details:
08-24-2017 03:00:13.752 -0400 INFO SavedSplunker - savedsearch_id="splunk;sos;_ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_sos_splunk_9fd0bac7cd608f2c_ACCELERATE_", search_type="report_acceleration", user="splunk", app="sos", savedsearch_name="_ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_sos_splunk_9fd0bac7cd608f2c_ACCELERATE_",: priority=default, status=skipped, reason="The maximum number of concurrent historical scheduled searches on this instance has been reached", ", concurrency_context="instance-wide", concurrency_limit=4, scheduled_time=1503558000, window_time=0
App name: sos
hostname:test01
Event details:
08-24-2017 03:23:02.291 -0400 INFO SavedSplunker - savedsearch_id="nobody;search;_ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_search_nobody_365ca83246f2cca8_ACCELERATE_", search_type="report_acceleration", user="nobody", app="search", savedsearch_name="_ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_search_nobody_365ca83246f2cca8_ACCELERATE_", priority=default, status=skipped, reason="The maximum number of concurrent auto-summarization searches on this instance has been reached", concurrency_category="summarization_scheduled", concurrency_context="instance-wide", concurrency_limit=2, scheduled_time=1503559380, window_time=0
App name: search
hostname:test01
All these events are generated from the Deployment instance "test01"
Question :
1) Unable to find out the exact saved search name "ACCELERATE_D4D707D0-38F3-4F47-A1AA-9DD305E110D0_DA-deployment_monitor_nobody_1a56f43bf8d5bf20_ACCELERATE" from the events , so how to find that out inside the app directory
/opt/splunk/etc/apps/DA-deployment_monitor/default/savedsearches/ -- I could see many queries saved as scheduled searches, but could not find the exact name mentioned as mentioned in the above events.
2) How to fix this issue, I could see these reasons from events
a) "The maximum number of concurrent auto-summarization searches on this instance has been reached"
b) concurrency_category="historical_scheduled
c) concurrency_category="summarization_scheduled"
d) concurrency_limit=2
e) scheduled_time=1503558600
f) window_time=0
g) concurrency_context="instance-wide"
Kindly guide me how to fix this issue.
thanks in advance.
... View more
08-23-2017
10:41 AM
Hi Spayneort, Can I update the above stanza, as you had mentioned in the comments.
Kindly let me know on this, need to update the same in prod environment.
thanks in advance.
... View more
08-23-2017
09:15 AM
Hi All, I have fixed the issue by using the below query and got the desired output.
Problem : Unable to fetch the data in the dashboard and reason was there is no field name present in the index=summary.
Missing filed name
category=splunk_metric
subcategory=indexing
src_type=license_usage
Solution : used index=_internal to get the log volume data by source type.
Query
earliest=-1d@d latest=@d index="_internal" source="*metrics.log" group="per_sourcetype_thruput" | eval GB=(kb/1024/1024/1024) | rename series as st | timechart span=1h sum(GB) by st
Worked fine.
... View more
08-23-2017
09:08 AM
Hi richgalloway, the field aliases using the EVAL command for a firewall device worked perfectly. Using the below EVAL statement. Thanks a lot.
EVAL-action=case(action="Allow", "allowed", action="Deny", "blocked", 1=1, action)
EVAL-tcp_flag=case(tcp_flag="A", "ACK", tcp_flag="S", "SYN", tcp_flag="AS","SYN AND ACK")
... View more
08-22-2017
09:17 AM
Hi Richgalloway, thanks for your effort on this, actually my requirement is to use props/transforms to apply field aliases and evals as needed for a firewall device using the Network Traffic CIM data model. I had compared the CIM model with firewall device and created field aliases for only the CIM fields that is populated by the information available in watchguard logs. But I have to use EVAL command for the above mentioned fields. When checked the props.conf --> Field Extraction configuration document found the below syntax for Eval. https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Propsconf
EVAL- =
EVAL-action=case(action="Allow", "allowed", action="Deny", "blocked", 1=1, action)
EVAL-tcp_flag=case(tcp_flag="A", "ACK", tcp_flag="S", "SYN", tcp_flag)
Can I write like this, Please guide me on this .
... View more
08-22-2017
04:47 AM
Hi Spayneort, thanks for your effort on this issue, so do you mean I need to remove the "ignoreOlderThan" stanza from the inputs.conf file. But will that fix other invalid key issues like checkpointInterval, start_from,evt_resolve_ad_obj and current_only.
OS Logs
[WinEventLog://Application]
disabled = 0
current_only = 0
ignoreOlderThan = 2d
checkpointInterval = 5
index = windows
[WinEventLog://Security]
disabled = 0
ignoreOlderThan = 2d
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = windows
[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = windows
Kindly let me know the modified stanza will fix the issue, as we have almost 2500 Windows UF agents is running with this stanza. So I need to be careful enough before using it. Please let me know whether this will fix the issue.
thanks in advance.
... View more
08-22-2017
04:24 AM
Hi All, I need to write a field aliases using EVAL command for the below mentioned fields.
Field Name : Value
action ---> Allow
action ----> Deny
tcp_flag ---> A
tcp_flag ---> S
Eval statement:
EVAL-action=if(action="Allow", "allowed", action)
EVAL-action=if(action="Deny", "blocked", action)
EVAL-tcp_flag=if(tcp_flag="A","ACK",tcp_flag)
EVAL-tcp_flag=if(tcp_flag="S","SYN",tcp_flag)
Kindly guide me how to write a Field aliases using the Eval command.
thanks in advance.
... View more
08-21-2017
10:27 AM
Hi All, Can any one guide me on this issue.
Thanks in advance.
... View more
08-21-2017
03:26 AM
Hi All, Can any one guide me on this issue. I am not sure how to get the missing field name back in the index=summary , or is there a way to get required data "Prev Day Log Volume by Sourcetype (1h spans) & Prev 7 Days Splunk Log Volume by Sourcetype" for creation of dashboard without this fields.
Kindly guide me on this.
... View more
08-20-2017
07:58 AM
Hi All, Sorry for delayed response on this issue, still I am facing this issue, when executed the query , could notice that all the three fields name are missing in the events from last month. But we could see the events getting indexed to the index=summary but below three fields are missing. Need to create dashboard for Prev Day Log Volume by Sourcetype (1h spans) & Prev 7 Days Splunk Log Volume by Sourcetype.
Field name
category=splunk_metric
subcategory=indexing
src_type=license_usage
how to get this fixed. Could you please provide me some help on this issue.
Thanks in advance.
... View more
08-20-2017
07:47 AM
Hi All, We are recently upgrade to the latest version of the Universal forwarder 6.6.1 as we moved Entire splunk instance from 6.2.1 to 6.6.1. We have configured a customized app for windows monitoring. But currently we are getting the below error message when the agents are restarted and we are not sure why this error message are popped out.
Error details :
Invalid key in stanza [WinEventLog:Application] in C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\default\inputs.conf, line 10: ignoreOlderThan (value: 2d).
Invalid key in stanza [WinEventLog:Application] in C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\default\inputs.conf, line 11: checkpointInterval (value: 5).
Invalid key in stanza [WinEventLog:Security] in C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\default\inputs.conf, line 16:ignoreOlderThan (value: 2d).
Invalid key in stanza [WinEventLog:Security] in C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\default\inputs.conf, line 17:current_only (value: 0).
Invalid key in stanza [WinEventLog:Security] in C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\default\inputs.conf, line 18:evt_resolve_ad_obj (value: 1).
Invalid key in stanza [WinEventLog:Security] in C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\default\inputs.conf, line 19:checkpointInterval (value: 5).
Invalid key in stanza [WinEventLog:System] in C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\default\inputs.conf, line 24: start_from (value: oldest).
Invalid key in stanza [WinEventLog:System] in C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\default\inputs.conf, line 25: current_only (value: 0).
Invalid key in stanza [WinEventLog:System] in C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\default\inputs.conf, line 26: checkpointInterval (value: 5).
Configuration details in inputs.conf -- Partial configuration not full configuration.
[default]
evt_dc_name =
evt_dns_name =
OS Logs
[WinEventLog:Application]
disabled = 0
current_only = 0
ignoreOlderThan = 2d
checkpointInterval = 5
index = windows
[WinEventLog:Security]
disabled = 0
ignoreOlderThan = 2d
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = windows
[WinEventLog:System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = windows
Can anyone help me in fixing this issue.
thanks in advance
... View more
08-20-2017
07:02 AM
Hi Garethatiag, Good Morning thanks for helping me in this problem. Today I had executed the same query which you had provide in the above comments with a time frame set as Last 24 hours. This query was executed at EST 9:35 AM Sunday, August 20, 2017 (EDT)
Query Details
index=win_svrs host=test01 sourcetype=Script:ListeningPorts earliest=+5m latest=+20y
| where _indextime < _time
| eval indextime=strftime(_indextime, "%+")
8/20/17
10:49:00.000 PM
08/20/2017 0:22:49 transport=TCP dest_ip=[::] dest_port=63350 pid=6112
host = test01 source = C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\bin\win_listening_ports.bat sourcetype = Script:ListeningPorts
8/20/17
10:49:00.000 PM
08/20/2017 0:22:49 transport=TCP dest_ip=[::] dest_port=63335 pid=588
host = test01 source = C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\bin\win_listening_ports.bat sourcetype = Script:ListeningPorts
8/20/17
10:49:00.000 PM
08/20/2017 0:22:49 transpor
For the same host when the below query was executed with a time frame set as Last 24 hours, I got this results.
This query was executed at EST 9:35 AM Sunday, August 20, 2017 (EDT)
Query Details
index=win_svrs host=test01 sourcetype=Script:ListeningPorts.
8/20/17
9:22:49.000 AM
08/20/2017 9:22:49 transport=TCP dest_ip=[::] dest_port=63350 pid=6112
host = test01 source = C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\bin\win_listening_ports.bat sourcetype = Script:ListeningPorts
8/20/17
9:22:49.000 AM
08/20/2017 9:22:49 transport=TCP dest_ip=[::] dest_port=63335 pid=588
host = test01 source = C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\bin\win_listening_ports.bat sourcetype = Script:ListeningPorts
8/20/17
9:22:49.000 AM
08/20/2017 9:22:49 transpor
Could see different index time and the event time in both the events for the same host. Similarly when I ran the same query for other hosts, I could see this difference in the time.
So in this case, can I use the Props stanza which you had posted along with the source and source type stanza in props.conf as mentioned below.
[source::...win_listening_ports.bat]
sourcetype = Script:ListeningPorts
TIME_PREFIX=^
TIME_FORMAT = %m/%d/%Y %k:%M:%S
Kindly help me on this. Thanks in advance.
... View more
08-20-2017
05:45 AM
Hi Kalmira, No I was unable to fix the issue, so could not proceed further, so did you get any solution to fix the issue.
thanks in advances.
... View more
08-17-2017
03:21 AM
Hi Garethatiag, again thanks for your effort, I had executed the query for few of the servers with time frame set as last 24 hours and found below outputs.
index=win_svrs host=test1 sourcetype=Script:ListeningPorts earliest=+5m latest=+20y
| where _indextime < _time
| eval indextime=strftime(_indextime, "%+")
8/17/17
10:49:00.000 PM
08/17/2017 0:22:49 transport=TCP dest_ip=[::] dest_port=63351 pid=6112
host = test1 source = C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\bin\win_listening_ports.bat sourcetype = Script:ListeningPorts
8/17/17
10:49:00.000 PM
08/17/2017 0:22:49 transport=TCP dest_ip=[::] dest_port=63335 pid=588
host = test1 source = C:\Program Files\SplunkUniversalForwarder\etc\apps\test-app-win_svrs\bin\win_listening_ports.bat sourcetype = Script:ListeningPorts
8/17/17
and there are nearly 375 nodes having the future log time problem from the same sourcetype = Script:ListeningPorts. I have checked the remote server node test1 time, its showing the correct time EDT time. Kindly let me know how to fix this issue.
... View more
08-16-2017
04:31 AM
Hi Garethatiag, thanks for your effort, I have executed the update query from your post for a time frame of last 7 days. And I had got the below output .
host sourcetype index indextime averageahead maxTime minTime count
test1 Script:ListeningPorts win_svrs Wed Aug 16 00:00:00 EDT 2017 15:56:22 Wed Aug 16 22:49:00 EDT 2017 Wed Aug 16 22:49:00 EDT 2017 49
test2 Script:ListeningPorts win_svrs Wed Aug 16 00:00:00 EDT 2017 10:42:22 Wed Aug 16 17:35:00 EDT 2017 Wed Aug 16 17:35:00 EDT 2017 45
test3 Script:ListeningPorts win_svrs Wed Aug 16 00:00:00 EDT 2017 3:44:22 Wed Aug 16 10:37:00 EDT 2017 Wed Aug 16 10:37:00 EDT 2017 45
test4 Script:ListeningPorts win_svrs Wed Aug 16 00:00:00 EDT 2017 3:17:22 Wed Aug 16 10:10:00 EDT 2017 Wed Aug 16 10:10:00 EDT 2017 41
test5 Script:ListeningPorts win_svrs Wed Aug 16 00:00:00 EDT 2017 4:43:22 Wed Aug 16 11:36:00 EDT 2017 Wed Aug 16 11:36:00 EDT 2017 73
test6 Script:ListeningPorts win_svrs Wed Aug 16 00:00:00 EDT 2017 16:30:22 Wed Aug 16 23:23:00 EDT 2017 Wed Aug 16 23:23:00 EDT 2017 40
And also after changing the query by replacing it with | where averageahead > 1000 got the below output.
host sourcetype index indextime averageahead maxTime minTime count
test1 Script:ListeningPorts win_svrs Wed Aug 16 00:00:00 EDT 2017 15:52:28 Wed Aug 16 22:49:00 EDT 2017 Wed Aug 16 22:49:00 EDT 2017 49
test2 Script:ListeningPorts win_svrs Wed Aug 16 00:00:00 EDT 2017 10:38:28 Wed Aug 16 17:35:00 EDT 2017 Wed Aug 16 17:35:00 EDT 2017 45
test3 Script:ListeningPorts win_svrs Wed Aug 16 00:00:00 EDT 2017 3:40:28 Wed Aug 16 10:37:00 EDT 2017 Wed Aug 16 10:37:00 EDT 2017 45
test4 Script:ListeningPorts win_svrs Wed Aug 16 00:00:00 EDT 2017 3:13:28 Wed Aug 16 10:10:00 EDT 2017 Wed Aug 16 10:10:00 EDT 2017 41
Could you please guide us, whether we have any future log data source in our environment based on the above output result. As we have got some 550 nodes out of 2500 nodes in our environment, after executing the query.
thanks in advance.
... View more
08-15-2017
03:44 AM
Hi Garethatiag, Thanks a lot for providing the query to fetch the future log source. When we had executed the above query by setting a time frame as All Time, we got some 550 node servers results.
host sourcetype index indextime averageahead maxTime minTime count
test1 Script:ListeningPorts win_svrs 00:00.0 16:41:30 49:00.0 49:00.0 49
test2 Script:ListeningPorts win_svrs 00:00.0 11:28:30 36:00.0 36:00.0 45
test3 Script:ListeningPorts win_svrs 00:00.0 4:29:30 37:00.0 37:00.0 45
test4 Script:ListeningPorts win_svrs 00:00.0 4:02:30 10:00.0 10:00.0 41
test5 Script:ListeningPorts win_svrs 00:00.0 0:28:30 36:00.0 36:00.0 68
test6 Script:ListeningPorts win_svrs 00:00.0 5:28:30 36:00.0 36:00.0 73
I am not that good in SPL, so could not understand what the output is trying to convey. Could please guide on this.
thanks in advance.
... View more
08-14-2017
09:20 AM
Hi richgalloway, thanks for your inputs on this, when executed the above query with out the where clause and time frame set as ALL Time and I got some data in to statistics, when sorted out I could see two events with future time stamp
| metadata type=sources | fieldformat recentTime=strftime(recentTime,"%Y-%m-%d %H:%M")
/opt/splunk/var/spool/splunk/3e5c33405c9c491d_events.stash_new sources 1497539222 1497539519 2017-06-15 11:42 5409
XXX-SEC-SUM-MAIL-SYMANTEC-MAIL sources 1497539401 1497555595 2017-06-15 16:10 18708
now, Not sure how to find from which index/host is this source is mapped to in splunk instances.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-20-2025
08:58 PM
|
