how to see when a set of host send under 100 logs per hour? stats count wont show a value of 0. and you cant use HEAD with fields(that i know of). Whats the best way to do this? ... View more

what’s the best way to alert when a universal forwarder cant connect to the deployment server? I am looking to build a alert when a forwarder can not get the configuration from the deployment server. The built-in alert for the deployment monitor isn't quite what we are looking for. has anyone built there own that might be better? ... View more

if i wanted to take the app_name from the path of the source and create a field via the CLI of the input how would i do that? I know i could rename the source type however, that is not a option. I want to create a new field based off the 4th position of the source path. source = /foo/app/test/app/app_name/logs/log.log ... View more

Since our Splunk environment has grown, i wanted to build a Visio diagram and overlay sankey diagram of event counts, and live stats of servers. how do i import the diagram? how do add visuals over the diagram? has anyone done this before? ... View more

If i wanted to disable Splunk Add-on for Microsoft Windows on all Universal Forwarders (6.4.4) and only use my own app to collect Windows logs, what would be the best way to do this? I was going to make a directory in deployment apps named the same thing as the app on the UF's "splunk_ta_windows" and set it to disable in app.conf. any thoughts? ... View more

how would i search to see how the amount of license usage per Active Directory (AD) event code? looking to add it to this search if possible index=_internal source=*license_usage.log type="Usage" st=MyWindowsLogs | bin _time span=1h | stats sum(b) as b by _time, pool, s, st, h, idx | timechart limit=0 span=1d sum(b) AS volumeB by st fixedrange=false | bin _time span=1d | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] | addtotals ... View more

I need help with setting these wild cards, it seems like Splunk is not picking up the file in the sub folders. Logs are in: /opt/app/nv/vtest/test1/logs/mylLogs/file1/file2/testing/year/month/day/day/APP-blah-blah-bhal-LOG There is data in the sub folder in /year/month/day/day /, and then there are the file names that seem random, but start with APP and end with LOG. Below is what I have set up and no data is coming in. [monitor:///opt/app/nv/vtest/test1/logs/mylLogs/file1/file2/testing/.../.../.../.../APP*LOG] disabled = false recursive = false sourcetype = blah index = foofooblahhhhhh ... View more

Keep getting this error after moving to SH cluster, Please make sure that the pass4SymmKey setting in server.conf, under [general], is the same for the License Master and all its slaves from ip='1.1.1.1' first failure time=1477268328 (Sun Oct 23 20:18:48 2016) the key is the same for all of the servers, what else would cause this? ... View more

how can i re-enable real time searches? We lock it down by user role so this should not be happening. ... View more

Unable to initialize modular input "jms" defined inside the app "jms_ta": Introspecting scheme=jms: script running failed (exited with code 1). I did change the home path yet i am still seeing the error above . if (not os.environ.has_key('JAVA_HOME')): JAVA_EXECUTABLE = '/d01/app/java' else: JAVA_EXECUTABLE = os.path.expandvars('$JAVA_HOME') + "/bin/java" what else is needed to resolve this problem? ... View more