Could anyone please tell me whatare all the bundles present in /opt/splunk/var/run/searchpeers location. This location is kind of holding lot of data and disk space is almost full. From what i saw this location is holding configurations of all the search heads contacting this indexer. But for each search head there are around 5 copies of bundles with different timestamps SearchHead1-1384788323 Mon, 18 Nov 2013 15:25:23 GMT SearchHead1-1384796779 Mon, 18 Nov 2013 17:46:19 GMT SearchHead1-1384810416 Mon, 18 Nov 2013 21:33:36 GMT SearchHead1-1384810689 Mon, 18 Nov 2013 21:38:09 GMT SearchHead1-1384811445 Mon, 18 Nov 2013 21:50:45 GMT Is there a way i can restrict these many number of copies and let only the latest be present. Or any other option to restrict this please let me know ... View more

I need to create a panel in advanced dashboard where in same panel i want to show pie chart and table side by side. When i use <module name="HiddenChartFormatter" layoutPanel="panel_row2_col1"> <param name="charting.chart">pie</param> <module name="JSChart"/> </module> <module name="Pager" layoutPanel="panel_row2_col1"> <module name="SimpleResultsTable"> <param name="displayRowNumbers">False</param> <param name="entityName">results</param> </module> </module> I get the pie chart above table when i change the col number in layout panel i get the table in a seperate panel. Is there a way to get both side by side in same panel ?need help ... View more

Hi PFB the snippet in my dashboard: <module name="Search" layoutPanel="panel_row2_col1" autoRun="True"> <param name="search"> <![CDATA[| inputlookup splunk_servers_cache | search server_role="search-peer" | map maxsearches=100 search="| rest count=35 /services/data/indexes splunk_server=$sos_server$ " | stats sum(currentDBSizeMB) as currentDBSizeMB list(minTime) as MinTime by title splunk_server| eval currentDBSizeGB = currentDBSizeMB/1024 | where currentDBSizeMB>1]]></param> </module> The search is returning resuts when run in freeorm search. But when run in a dashboard it doesn't return any results. When i checked in job inspector the query is showed as | inputlookup splunk_servers_cache | search server_role="search-peer" | map maxsearches=100 search=| rest count=35 /services/data/indexes splunk_server= | stats sum(currentDBSizeMB) as currentDBSizeMB list(minTime) as MinTime by title splunk_server | eval currentDBSizeGB = currentDBSizeMB/1024 | search title="*apps" OR title="*perf" | where currentDBSizeMB>1 where the quotes for map command and splunk_server substitution disappeared? How do i avoid this ?? and get the query running in dashboard Complete XML: <view autoCancelInterval="90" isSticky="False" isVisible="true" onunloadCancelJobs="true" template="dashboard.html"> <label>Index Size Distrubution</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="appHeader"/> <module name="SideviewUtils" layoutPanel="appHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="maxSize">2</param> <param name="clearOnJobDispatch">False</param> </module> <module name="Search" layoutPanel="panel_row1_col1" autoRun="True"> <param name="search"> <![CDATA[| inputlookup splunk_servers_cache | search server_role="search-peer" | map maxsearches=100 search="| rest count=35 /services/data/indexes splunk_server=$sos_server$ " | stats sum(currentDBSizeMB) as currentDBSizeMB list(minTime) as MinTime by title splunk_server| eval currentDBSizeGB = currentDBSizeMB/1024 | where currentDBSizeMB>1]]></param> <param name="earliest">-15m</param> <param name="latest">now</param> <module name="JobProgressIndicator"/> <module name="Paginator" layoutPanel="panel_row2_col1" group="Search Results"> <param name="count">10</param> <param name="entityName">results</param> <param name="groupLabel">Search Results</param> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="SimpleResultsTable"> <param name="entityName">results</param> <param name="allowTransformedFieldSelect">True</param> <module name="Gimp"/> </module> </module> </module> </module> </view> ... View more

Hi I need to monitor a directory and by end of the day i want to check if there are n number of files. if numbers files is greater/less than n in that directory i need to raise an alert. Can this be done in splunk. Can anyone help me? ... View more

I have events which start like 16OCT13 AAAB 12:59:00 JAJAS DKDJD KDD 16OCT13 AABB 13:00:00 AJAJA AKAJK AKA But i am not able to extract that particular timestamp for events In my props.conf i used: SHOULD_LINEMERGE=false TIME_PREFIX=^ TIME_FORMAT=%d%b%y [A-Z]{4} %H:%M:%S But doesn't seem to work. Please tell me what i am doing wrong? ... View more

Hi, I have around 10 SH's in my production setup.A load balancer is used to redirect User to any of those search heads. many users are complaining about UI timing out. Is there a way i can track these timeouts in splunk internal logs? ... View more