Looks like mine are coming from the NetApp Ontap app and are being stored on the search head with the app. 2.1G /local/splunk/var/lib/splunk/tsidxstats/netapp_perf_aggr 53G /local/splunk/var/lib/splunk/tsidxstats/netapp_perf_disk 14G /local/splunk/var/lib/splunk/tsidxstats/netapp_perf_lun 9.7G /local/splunk/var/lib/splunk/tsidxstats/netapp_perf_volume ... View more

Thanks! 🙂 ... View more

Yes, look at this example: http://docs.splunk.com/Documentation/Splunk/6.3.1511/Viz/Chartcontrols#Chart_overlay_example_.28dual_axis.29 ... View more

thank you for your help! ... View more

That's a Windows Event Log, so source=WinEventLog:Application SourceName=oracle.orcl would probably work better. ... View more

Yes, and it is also a lame error message. ... View more

See my updated answer above ... View more

RE: your paragraph 2: there are ways to automate the uptake of CSV files. See the [batch://<path>] stanza in inputs.conf http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/Inputsconf Also, you should be able to rewrite your searches so that they always point at the most recent data. As you note below, dedup might be part of this strategy. ... View more

You have the one of the TA-SQLServer technology add-ons on your server. This contains the dm_audit_class_type lookup as an automated lookup. You have two choices: 1) Edit the props.conf in the TA-SQLServer that you have installed to remove the automatic lookup. 2) Export the lookup table in the TA-SQLServer that you have installed to remove the warning. Either is a good approach. Note that the new Splunk for SQL Server beta opts for option #1. ... View more

My experience with this: If you create a tag via commandline or editor, the tag is only shared in app. If you are searching in the search app, the search app has no permission to show this tag. Setting the tags permission to global solved this problem for me. Especially if you use other apps like CIM which work with these tags. Please correct me, if I am wrong. ... View more

Well, the easiest way to do that would be to set up distributed search on the other search head(s) so that they also search this indexer. An example will make this clearer, I hope:-) Indexer A standalone (running as search head and indexer) with DBX Indexer B standalone (search head and indexer) indexing other stuff Search Head C searches across indexers D, E, F On either B or C (or both), you can configure Distributed Search. It's in the Splunk Manager UI. Go to Distributed Search Setup - by default it is turned on; if it is on, you can leave everything at the defaults. Go to Search Peers and Add New. Enter the info for Indexer A. Wait a few minutes and then run a search on B or C - whichever you set up - and you should see the data from Indexer A. ... View more

Many thanks!it's really helpful. ... View more

You could try adding the following to $SPLUNK_HOME/etc/system/local/limits.conf [kv] maxcols = 1750 By default, Splunk does not extract more than 512 fields, for performance reasons. You might also check to make sure that your events are not being truncated, although it looks like they are okay. ... View more

+1 to Martin's answer. Also, since you probably need to recover at least a little disk space for Splunk to restart - You can examine the contents of the following directories and delete files: Splunk's own logs: $SPLUNK_HOME/var/log/splunk Search results for running searches, and saved search results: $SPLUNK_HOME/var/run/splunk/dispatch Note that removing the saved search results may cause some users to need to re-run old searches; in some environments, this might not be a good idea. Finally, you might think about setting your maximum index sizes so that the sum of all indexes cannot exceed your disk capacity. ... View more

Hi - I have something similar. I was curious to see if you were able to figure it out? I am extracting the action from the logs using regex. Then timecharting. i have three actions listed and i wanted to rename the column headers. Search is: index=app_example sourcetype=provision_example |rex field=_raw "(?logErrorResult\s+[\d+]+:[A-Za-z\s+]+\s+)" |search action="*" |timechart span=1d count by action So displayed is showing something like the following: _time action results (code #1) action results (code #2) action results (code #3) 2015-01-28 Rename to User Failure Rename to System Failure Rename to User/System I want to rename the code # to the message listed below. Thanks! ... View more

There is a wiki article about this: Migrating a Splunk Install But if the underlying operating system is the same, you can just copy the installation. For example, in Linux, assuming that $SPLUNK_HOME is /opt/splunk' and you are running as the user splunkIT` # on the current machine su splunkIT cd /opt/splunk/bin ./splunk stop cd /opt tar -czf splunk.tgz splunk # on the new machine (assumes that user splunkIT exists there as well) # copy the splunk.tgz to /opt using any method, and # make sure that splunk.tgz is owned by splunkIT su splunkIT cd /opt tar -xzf splunk.tgz cd splunk/bin ./splunk start Note that this assumes that the Splunk indexes are also stored beneath the /opt/splunk directory. If they are not, you will have go through similar steps to copy them as well. ... View more

BTW, nicely explained. Unless I completely misunderstood it, of course! ... View more

yes i want user count without having "json from session" entry... ... View more

I have to disagree on defining field extraction at index time. Yes, define your field extractions in props.conf - that is correct, and it is actually at search time. As stefano points out, having the field extractions defined will simplify your search dramatically. It will also make it easier to create reports and other items. There is a built-in sourcetype named iis - if you use it, you might get the field extractions without needing to do anything at all. IIS sometimes shows up as iis-2 or iis-3 , etc. So if you still need to add field extractions to props.conf , you can use the following stanza header and your field extractions will apply to all of the IIS variants: [(?:::){0}iis*] # your field extractions here EXTRACT-e1=(?<year>\d{4})-(?<month>\d{1,2})-(?<date>\d{1,2}) (?<hours>\d{1,2}):(?<minutes>\d{1,2}):(?<seconds>\d{1,2}) (?<server_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) (?<request_method>\w{3,4}) (?<uri>\S*) (?<query_string>.*) (?<server_port>\d{2,5}) - (?<remote_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) (?<user_agent>.*) (?<http_status_code>\d{3}) (?<http_sub_status_code>\d{1,3}) (?<time_taken>\d{1,10}) (?<num_bytes>\d{1,10})$ Also, I would propose this search earliest_time=-15m sourcetype="iis*" AND (host="xxxx-vmweb-p04" OR host="xxxx-vmweb-p05" OR host="xxxx-vmweb-p06" OR host="xxxx-vmweb-p07" OR host="xxxx-vmweb-p08") AND ( [search index="CLIENT_AAA__deploy_arch" | table uri ] ) | stats count as numErrors by http_status_code site_id uri query_string | sort -numErrors This combines the subsearch into the initial search, which will be faster. But the subsearch over the CLIENT_AAA__deploy_arch index is running over all time. Perhaps you should include an earliest= parameter in the subsearch as well? ... View more

Splunks outer join is not the same as a union. It takes all events from the main search and adds matching fields from the subsearch. BUT it discards events from the subsearch that are not matched by any event in the main search. ... View more

No, because props.conf is organized into stanzas. The stanza header says which object (source, sourcetype or host) will be affected by the settings. ... View more

@royswapan This is an old thread with an accepted answer so you're unlikely to get a response. Please post a new question. ... View more