I have to Config Splunk forwarder to read 3MBps data from JMS queue. Installed heavy forwarder on the server and configured to read the JMS queue with 20 parallel connections per Queue. Total of 6 Queues. I have increased the splunk throughput rate in limits.conf to 4000 KBps. But still, I couldn't able to read more than 1MBps. What could be the issue? Could you please help if anyone has tried similar or larger configuration than mine. ... View more

Hi, The data flow is UFs-->HWF-->INDEXERs Some of the event lines sizes are 100K to 300K bytes. By default Splunk truncated the event at 10,000 bytes. As per the props.conf, I have put the below configuration in the Indexers props.conf [my-source-type] TRUNCATE=500000 I have restarted the indexers. But still, I see that the events are getting truncated at ~10000 characters. Do I need to put these properties in the HWF aswell? I have not made TRUNCATE=0 because as per the documentation, often garbage is seen when set to 0. Hence I have set this to 500000 as per the discussion with developers. props.conf... TRUNCATE = * Change the default maximum line length (in bytes). * Although this is in bytes, line length is rounded down when this would otherwise land mid-character for multi-byte characters. * Set to 0 if you never want truncation (very long lines are, however, often a sign of garbage data). * Defaults to 10000 bytes. ... View more

Hi All The timestamp is in the format T , e.g: 2014-06-05T05:03:53-07:00 Is there any configuration supported in SPlunk to automatically recognize and extract this timestamp to _time ? ... View more

index=abc earliest=-7d@d latest=-6d@d action=commit_success | stats count as SUCCESS by user Gives the result: user SUCCESS user1 2 user4 10 user20 7 user50 12 user55 4 user60 10 Commit failed for users: index=abc earliest=-7d@d latest=-6d@d action=commit_failed | stats count as FAIL by user Gives the result: user FAIL user1 3 user5 2 user20 4 user40 1 user50 4 user70 2 Please note, here some users have made successful commit only, some did both success & fail and some did commit fail only. I want to combine these 2 results. combine with append: user SUCCESS FAIL user1 2 user4 10 user20 7 user50 12 user55 4 user60 10 user1 3 user5 2 user20 4 user40 1 user50 4 user70 2 Here the problem is the user names appears 2 times in row for user who have done both success and fail commits If combine with appendcols: user SUCCESS FAIL user1 2 3 user4 10 2 user20 7 4 user50 12 1 user55 4 4 user60 10 2 Here the problem is totally incorrect FAIL count for improper users. if I combine with "join" It either gives me the common name (by default), if I use type=inner, the failure committed users only are ignored if I use type=outer, the success committed user only ignore. But, I want to all the users who have committed success and failures to be display and only 1 row per user even if the user has done both failure and success. I want the result to be like this user SUCCESS FAIL user1 2 3 user4 10 user5 2 user20 7 4 user40 1 user50 12 4 user55 4 user60 10 user70 2 Please do the needful. ... View more

Hi I want to calculate the last 1 hour events for the past week at any given point of time. Support now the time is 11.30a.m. I want to events from 10.am to 11.30am for past 1 week. I'm trying the below search query, but it is returning zero. Since the below query runs on _internal index, you can try on ur system too. index=_internal source=*metrics.log splunk_server="*" group="per_index_thruput" earliest=-7d@d | eval MB=kb/1024 | eval duration=60*60 | eval current_hour=strftime(now(),"%H") | eval last_hour=strftime((now()-duration),"%H") | eval current_Min=strftime(now(),"%M") | where (date_hour=last_hour AND date_minute>current_Min) AND (date_hour<=current_hour AND date_minute<=current_Min) Whats wrong here and what is the right query? ... View more

Hi All I have 2 questions. Question-1: I wanted to write auto extract KVs from JSON portion of the events. Here is the JSON portion of sample event --> "actionId":47533796,"clientIP":"127.0.0.1","actions":["Action1","Action2","Action3"],"user":"alia",... I wrote regex --> \"([\w]+)\":([^,}]+) Here, the complexity is value type is sometime array of values with comma separator with variable number of members. So for the key "actions", the above regex gives the values as ["Action1", Since "," is also delimiter for separating JSON KVs, the array value also uses "," as delimiter, hence the problem. how can I auto extract all the KVs from JSON string for the above case? I want to put in transforms.conf for auto extraction of all the KVs from JSON string....... Question-2: If I want to replace the "," only for array value using SED command, how can I do it? E,g: I want to replace comma delimiter with semi-colon only for the values of array type[a,brrrr,c2,d,ehh,.....,w] with [a;brrrr;c2;d;ehh;....;w] ... View more