Hi, I've archived indexed data into location "D:\Program Files\Splunk\myfrozenarchive" and now myfrozenarchive folder has to folders db_1364755264_1356979773_16 db_1364971832_1364756312_15 Both these inturn contain folder called rawdata. I'm trying to restore this archived data but getting error in one of the steps mentioned in the documentation Windows users Here is an example of safely restoring a 4.2+ archive bucket to thawed: 1. Copy your archive bucket to the thawed directory: > xcopy D:\MyArchive\db_1181756465_1162600547_0 %SPLUNK_HOME%\var\lib\splunk\defaultdb\thaweddb\/s /e /v 2. Execute the rebuild command on the temporary bucket to rebuild the Splunk indexes and associated files: > splunk rebuild %SPLUNK_HOME%\var\lib\splunk\defaultdb\thaweddb\temp_db_1181756465_1162600547_0 3. Rename the temporary bucket to something that Splunk will recognize: > cd %SPLUNK_HOME%\var\lib\splunk\defaultdb\thaweddb > move temp_db_1181756465_1162600547_0 db_1181756465_1162600547_1001 Note: You must choose a bucket id that does not conflict with any other bucket in the index. This example assumes that the bucket id '1001' is unique for the index. If it isn't, choose some other, non-conflicting bucket ID. 4. Restart Splunk. Go to %SPLUNK_HOME%\bin and run this command: > splunk restart I'm getting following error in the 2nd step while trying to rebuild. Command: D:\Program Files\splunk\bin > splunk rebuild “D:\Program Files\splunk\var\lib\splu nk\defaultdb\thaweddh\temp_db_1364755264_1356979773_16” ERROR — Error opening ‘D:\Program Files\Splunk\uar\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunlc\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. ERROR — Error opening ‘D:\Program Files\Splunk\var\log\splunk\splunkd.log”: The process cannot access the file because it is being used by another process. Error: The path D:\Program Files\Splunk\var\lib\splunk\defaultdb\thaweddb\temp_ db_1364755264_1356979773_16 is not a directory. Rebuilding bucket failed Please can any one elaborate 2nd and 3rd steps. Version used : splunk 5.0.2 My thaweddb folder Thank You. ... View more

Hi, I have a search query which includes subsearch as follows: host="sharepoint" | rex field=msg "\sMore\sinformation:\s(?<EventCode>[\dxA-F]+)" | rename EventCode as output | eventstats count by output | sort -count | dedup output | append [search host="database" | rename EventCode as output | eventstats count by output | dedup output | sort -count | head 5] | table output count | sort -count When i run this search it says : [subsearch]: Search auto-finalized after time limit (30 seconds) reached I checked my limit.conf file and its subsearch parameters as [subsearch] maxout = 10000 maxtime = 60 ttl = 300 So what's needs to be changed ? Is there are any changes to be made in limits.conf file? How to come out of this problem.Also here my search is taking to long to process(taking more time). Thank you ... View more

Hi, I have a dashboard panel showing data in a tabular structure. Here i just wanted a drilldown into a default flashtimeline on click of table's row(any value of a table). Here is the advanced xml : <module name="HiddenSearch" layoutPanel="panel_row4_col1" group="Recommendation for ErrorCodes" autoRun="True"> <param name="search">host="sharepoint" | rex field=msg "\sMore\sinformation:\s(?&lt;ErrorIdentifierField&gt;[\dxA-F]+)" | eventstats count by ErrorIdentifierField | sort -count | table ErrorIdentifierField count </param> <module name="SimpleResultsTable"> <param name="entityName">results </param> <param name="dataOverlayMode">heatmap </param> <param name="drilldown">all </param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline </param> <param name="popup">True </param> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline </param> </module> </module> Here the problem is when i click on the table's row/any of the value its not drilling down to a default flashtimeline but shows same tabular structure. Now in this tabular structure if i click agian then it will show the table but containing only clicked(the value which clicked) value.Here i wanted to show the default flashtimeline for the clicked values. So pls help with the advance xml for this. Thank you ... View more

Hi, I have SharePoint logs and in that there is a field called message.From the message field i have extracted exceptions using regular expressions.Here for extracting three exceptions i have used one regular expression and for other two i have used different regex. The search queries used for those two different regex are : host="sharepoint" | rex field=message "(?i)\b exception\b:\s(?P<FieldIdentifier>[^\)]+Exception)\:" | table FieldIdentifier host="sharepoint" | rex field=message "(?<=[Errorlfailed]\: )(?P<FieldIdentifier1>[^\)]+Exception:)" | table FieldIdentifier Here i want to have single search query including both the regex.How can i write this in rex command .Tried with OR command but that din't worked.So pls help with the query. Thank you ... View more

Hi, I have SharePoint logs.Here i have a field called message and I'm trying to extract the exceptions from the message. Here is the sample entries of message(for simplicity i have numbered the messages and rest of the fields are not shown here) 1) Error warming up the worker process. - Starting worker process threw - Inner Exception: System.NullReferenceException: Object reference not set to an instance of an object. Server stack trace: at Microsoft.SharePoint.Utilities.SPShimOutOfProcUtility.GetSecurityPolicyFileCore() at Microsoft.SharePoint.Utilities.SPShimOutOfProcUtility_SubsetProxy.GetSecurityPolicyFileCore__Inner() at Microsoft.SharePoint.Utilities.SPShimOutOfProcUtility_SubsetProxy.s_GetSecurityPolicyFileCore() at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs) at System.Runtime.Remoting.Messaging.StackBuilderSink.SyncProcessMessage(IMessage msg, Int32 methodPtr, Bool 2) [SPUCWorkerProcessProxy] [SPUpgradeSession] [ERROR] [7/8/2013 9:45:31 AM]: Exception: Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding. 3) System.Data.SqlClient.SqlException: Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding. at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) at System.Data.SqlClient.TdsParserStateObject.ReadSniError(TdsParserStateObject stateObj, UInt32 error) at System.Data.SqlClient.TdsParserStateObject.ReadSni(DbAsyncResult asyncResult, TdsParserStateObject stateObj) at System.Data.SqlClient.TdsParserStateObject.ReadNetworkPacket() at System.Data.SqlClient.TdsParserStateObject.ReadBuffer() at System.Data.SqlClient.TdsParserStateObject.ReadByte() at System.Data.SqlClient 4) Redirect to error.aspx failed. Exception: System.Web.HttpException: The remote host closed the connection. The error code is 0x800704CD. at System.Web.Hosting.IIS7WorkerRequest.RaiseCommunicationError(Int32 result, Boolean throwOnDisconnect) at System.Web.Hosting.IIS7WorkerRequest.ExplicitFlush() at System.Web.HttpResponse.Flush(Boolean finalFlush) at System.Web.HttpResponse.End() at Microsoft.SharePoint.Utilities.SPUtility.Redirect(String url, SPRedirectFlags flags, HttpContext context, String queryString) 5) Unhandled exception was thrown by the sandboxed code wrapper's Execute method in the partial trust app domain: An unexpected error has occurred. - Monitored process "ipc://eac75fb1-94c0-4941-a6e2-186e9d097b4f:7000" has encountered an unhandled exception while executing user code. - Inner Exception: Microsoft.SharePoint.UserCode.SPUserCodeSolutionProxiedException: Timeout while waiting for request to complete within the sandboxed appdomain. at Microsoft.SharePoint.UserCode.SPUserCodeApplicationHostAppDomainRef.Execute(Type userCodeWrapperType, SPUserCodeCachedAssemblyGroup userAssemblyGroup, Guid siteCollectionId, Byte[] binaryUserCodeToken, Byte[] proxyOperationToken, SPUserCodeExecutionContext executionContext) Here i just want to extract the exceptions from each message.For example from the 1st message i want to extract "System.NullReferenceException",from 2nd "Timeout expired" ,from 3rd "System.Data.SqlClient.SqlException" and so on. I tried with the following regex host="sharepoint" | rex field=msg "(?i)\b exception\b:\s(?P<FieldIdentifier>[^\)]+)\:" | where FieldIdentifier !="" | table FieldIdentifier If i do so only some of the exceptions were getting captured. So pls help with the regex. Thank you ... View more

Hi, I have a field called message and now i'm trying to extract a ErrorIdentifier from that message field. Below is the sample log entries of sharepoint: 7/8/13 8:49:34.360 AM 07/08/2013 08:49:34.36 w3wp.exe (0x0AD8) 0x698C SharePoint Foundation General 8e2s Medium Unknown SPRequest error occurred. More information: 0x80070005 880cf2d3-7093-4a52-94dc-4261ccdbf2aa 7/8/13 8:27:26.670 AM 07/08/2013 08:27:26.67 w3wp.exe (0x0AD8) 0x9404 SharePoint Foundation General 8e2s Medium Unknown SPRequest error occurred. More information: 0x80070002 7/8/13 10:12:04.460 AM 07/08/2013 10:12:04.46 w3wp.exe (0x0AD8) 0x4CB4 SharePoint Foundation Monitoring b4ly Medium Leaving Monitored Scope (Request (GET:https://www.myvantageconnect.co.in:443/_LAYOUTS/ClientPortal/SilverlightWebParts/PROD/System.ComponentModel.Composition.zip)). Execution Time=34.7719304398 Here i just want extract a patterns "0x80070005" from message field. I tried with this regex : host="sharepoint" | rex field=msg "(?i) .*?: (?P<FieldIdentifier>\d+\w+)(?=\t)" | table ErrorIdentifier If i do so it's not extracting the desirable output. Note: The pattern always followed by the word "More information:" in a message field. So please help regarding this. Thank you ... View more

hi, Is there any App available for IBM data power? Thanks and regards ... View more

hi, I've log file with multiple log formats. sample.log file Type 1: [Thu May 31 13:27:14 2012] FATAL: WARNING: The current transaction ID is Oxfwq3SgJS. Run local database repair with rebuild database option enabled to fix it before it reaches allowed limit cf transactions (Oxqfhhe320) [Thu May 31 14:01:38 2012] FATAL: WARNING: The current transaction ID is Oxeap54lh7. Run local database repair with rebuild database option enabled to fix it before it reaches allowed limit cf transactions (Oxfqfhhe 020) Type 2: 3996491294 ZONE: 2012/06/01 9:54:21.599 (Oxjun3l:0x63) Sending search result entry “docsismacaddr—1\,6\,00:l5:dl:al:ed:c9,ou—IKV,ou—NorthWest,o--General” to connection 0x973fw410 3996491294 ZONE: [2012/06/01 9:54:21.599) (90.21.103.1:42009) (Oxjun3l:0x63) Sending operation result 0:MM:1 to connection 3x972fw410 Type 3: [-- DRost Logging STARTED Fri Jun 1 02:47:47 2012 -- ] [-- DRost Logging STARTED Fri Jun 1 03:07:35 2012 -- ] Type 4: Jun 01 02:45:35 NDS iMonitor for Novell eDirectory 9.9.5 SP5 v20506.01 SI’S started successfully. Jun 01 03:09:27 conf files: inputs.conf in system/local directory to load the sample.log in splunk [monitor://D:\sample.log] props.conf [Mysourcetype] DATETIME_CONFIG = /etc/system/datetime.xml LINE_BREAKER = ([\r\n])+(?=([\w{3}\s(\w{3})\s(\d{1,2})\s(\d{2}):(\d{2}):(\d{2})\s(\d{4})]|\d{10}:?\s\w{4}:|[\s--\s|\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s\s)) SHOULD_LINEMERGE=false datetime.xml in /etc/system/datetime.xml datetime> !-- [Sat May 31 13:27:14 2012] --> define name="_datetimeformat1" extract="litmonth, day, hour, minute, second, year"> text>[\w{3}\s(\w{3})\s(\d{1,2})\s(\d{2}):(\d{2}):(\d{2})\s(\d{4})] /define> !-- [2012/06/01 8:54:21.599] --> define name="_datetimeformat2" extract="year, month, day, hour, minute, second, subsecond"> text>[(\d{4})/(\d{2})/(\d{2})\s\s(\d{1,2}):(\d{2}):(\d{2}).(\d{3})] /define> !-- Fri Jun 1 02:47:47 2012 --> define name="_datetimeformat3" extract="litmonth, day, hour, minute, second, year"> text>\s\w{3}\s(\w{3})\s\s?(\d{1,2})\s(\d{2}):(\d{2}):(\d{2})\s(\d{4}) /define> !-- Jun 01 02:45:35 NDS iMonitor for Novell eDirectory 8.8.5 SP5 v20506.01 SP5 started successfully. --> define name="_datetimeformat4" extract="month, day, hour, minute, second"> text>(\w{3})\s(\d{2})\s(\d{2}):(\d{2}):(\d{2})\s\s /define> timePatterns> use name="_datetimeformat1"/> use name="_datetimeformat2"/> use name="_datetimeformat3"/> use name="_datetimeformat4"/> /timePatterns> datePatterns> use name="_datetimeformat1"/> use name="_datetimeformat2"/> use name="_datetimeformat3"/> use name="_datetimeformat4"/> /datePatterns> /datetime> while restarting splunk i'm getting error as error while parsing 'C:\program files....\datetime.xml [Errno 13] permission denied: 'C:\program files....\datetime.xml Please tell me where is the problem? where should put datetime.xml if i dont have custom app IS this way to load log file with multiple formats? Thank you ... View more

hi, I have a log files which are having columns that are not fixed. if first log entry has col1,col2,col3 then next entry can have col4,col5 only can i analyze and extract fields from such columns Thanks and Regards ... View more

hi, Is there any performance impact if i use inline search instead of saved one? Thanks and Regards ... View more

hi, What else can be done using splunk other than log processing? Thanks and Regards ... View more