Hi I have 3 servers that generate log file daily with size about 12GB (12*3=36GB) How can I gather these files on centralize log server.   FYI1: I can't use splunk forwarder in this scenario. FYI2: rsyslog, filebeat, syslog-ngm, ... are available solution but I can't decide which one is more suitable for this issue. FYI3: raw data is important , and doesn't be missed. FYI4: like forwarder when ever servers or network down, after issue resolve it will continuously send data. (AFAIK rsyslog use tracker when server stopped and try to send remain file after service start again) Any idea? Thanks, ... View more

Hi I've index a 12MB file in splunk but have different between line of file and event of splunk   file = 114,475          lines splunk = 104,475   events   file lines like this: 123456789|0123456789|0123456789|Tobe                             |Alex                            |     any idea? Thanks ... View more

Hi Need to send alert like machine investigate something and after that send alert. I mean something like gptchat talk, instead of sending tables and numbers to users. (like bot) Like this: it seems you have issue on machine X because rate of response decreased last night at 20:00. Any idea? Thanks ... View more

Hi What is the quickest way to find 100 max values of "Q" on huge log file?   here is my query: index="myindex" |  rex "Q\[(?<Q>\d+) | stats max(Q)   here is the log: 13:58:34.999  Q[16]   Any idea? Thanks ... View more

Hi I have a dashboard that show several chart, some of these charts load slowly. 1-is it possible to put radio buttom that have two value like (OFF, ON) whenever user open dashboard won't load those chart, when user hit on load them. 2-is it possible to set load priority that first load light chart, after load them completely start to load heavy one!       <panel>       <title>Number of Request Called From Webservice</title>       <chart>         <search>           <query>index="app" "INFO  [APP] [log]"  | rex "status\[(?&lt;status&gt;\w+)" | timechart count(status)  by status usenull=f useother=f limit=0</query>           <earliest>$tokTime.earliest$</earliest>           <latest>$tokTime.latest$</latest>           <sampleRatio>1</sampleRatio>         </search>         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>         <option name="charting.axisTitleX.visibility">collapsed</option>         <option name="charting.axisTitleY.visibility">visible</option>         <option name="charting.axisTitleY2.visibility">visible</option>         <option name="charting.axisX.abbreviation">none</option>         <option name="charting.axisX.scale">linear</option>         <option name="charting.axisY.abbreviation">none</option>         <option name="charting.axisY.scale">linear</option>         <option name="charting.axisY2.abbreviation">none</option>         <option name="charting.axisY2.enabled">0</option>         <option name="charting.axisY2.scale">inherit</option>         <option name="charting.chart">area</option>         <option name="charting.chart.bubbleMaximumSize">50</option>         <option name="charting.chart.bubbleMinimumSize">10</option>         <option name="charting.chart.bubbleSizeBy">area</option>         <option name="charting.chart.nullValueMode">gaps</option>         <option name="charting.chart.showDataLabels">minmax</option>         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>         <option name="charting.chart.stackMode">default</option>         <option name="charting.chart.style">shiny</option>         <option name="charting.drilldown">all</option>         <option name="charting.layout.splitSeries">0</option>         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>         <option name="charting.legend.mode">standard</option>         <option name="charting.legend.placement">bottom</option>         <option name="charting.lineWidth">2</option>         <option name="height">181</option>         <option name="refresh.display">progressbar</option>         <option name="trellis.enabled">0</option>         <option name="trellis.scales.shared">1</option>         <option name="trellis.size">medium</option>       </chart>     </panel>   </row>   any idea? Thanks ... View more

Hi I have challenge that need to know how with splunk, math, statistics, ... able to solve it. Here is the log: sample:   2022-10-21 13:19:23:120   10 2022-10-21 13:19:23:120   20 2022-10-21 13:19:23:120   9999 2022-10-21 13:19:23:120   10 2022-10-21 13:19:23:120   0 2022-10-21 13:19:23:120   40   FYI1:don't want to summerize or get avrage of values. FYI2:between each second contain over thousands of data points. Need to find abnormal in last 24 hours. FYI3:I need optimise solution because there is a lot of data. FYI4:don't want to set threshold e.g. 100 to filter only above that value, because abnormal situation might occur under that value. FYI5:there is no constant value to detect this abnormal e.g check 10 vlue if increase set as abnormal! How can i find 1 incremental or 2 constant rate points of last 24 hours? (show on below chart) Does not need to show this on chart because of lots of data points. Just list them.   Any idea? Thanks  ... View more

Hi i have several web servers that work on same host (different port) or different host. the best to say that they are work are use curl command, like below curl -s http://192.168.1.1:8000 | grep login Now question is is there any way to monitor these services without pain in splunk? Any add on(like nmon)? or should writ script to create logfile like below then index it on splunk? TIMESTAMP service 1, up TIMESTAMP service 2, down   any idea?  Thanks  ... View more