I have restarted splunk, and when i make that correction or change to the regex, it still does not stop the events from coming through. ... View more

This was my issue and fix too ('cept I ended up having to create the web.conf file and using 8080). ... View more

@sowings - absolutely correct, a slip of imprecision on my behalf there. Amended. Thanks ... View more

...there were a few more slashes in there when I left it... ... View more

It's a charting command, you could place it inline with your other stats command. What stat did you want to show in the sparkline? earliest=-2d@d latest=-1d@d index=_internal group="per_index_thruput" | eval rmb = round(kb/1024, 2) | eval rgb = round(rmb/1024, 2) | eval mb = kb/1024 | eval gb = round(kb/1024/1024, 2) | stats sparkline sum(gb), sum(gb) AS "Total GB" by series | addcoltotals http://docs.splunk.com/Documentation/Splunk/5.0/Search/Addsparklinestosearchresults ... View more

This looks like it would work too and slightly easier. Will give it a go later. ... View more

If the answer solved your problem, please click the check box to the left to "accept" the answer. ... View more

The sort command is capping your results to 10000, change your sorts command to | sort 0 dept, -total. ... View more

Your string ":: ::: ::::" has white spaces which I suspect are causing you grief. Remove the white spaces between the various groups of ":" that you have in your string and then try something like this. | eval _raw = replace (_raw," +","=") This worked for me when I had to remove an unknown quantity of white spaces, but only when grouped at 4 or more white spaces. So for you a double eval may work best but might not be the most optimal solution if your regex skills are advanced enough. | eval _raw = replace (_raw,": :","::") | eval _raw = replace (_raw,"::+",":") ... View more

Issue was fixed after setting followtail to 0. This file was a static one, because of no update coming to it indexer was not showing any details of it. After setting followTail = 0, it started working. Thank you everyone for the answers... ... View more

Hi @manish_singh_777, I'm not sure what you mean but I think you might want to take a look at working with Splunk using XML and the APIs? ... View more

Since the "-et" and "-lt" fields need either a relative time ("-6d@d" or "-y"), or a Unix Epoc time ("Fri Jul 11 10:00:56 EDT 2014" == 1405087256), but I've found that I need to have the fill_summary_index.py script start and stop at specific times (i.e. "-et June 22, 2014 22:00:00"). I could convert those times to epoc, then run the command on the command line, but I'm lazy and that's prone to error. I use the Unix "date" command like this (in KSH): /splunk cmd python fill_summary_index.py ... -et $(date -d "June 22 2014 22:00" +%s) ... At 3AM this helps me avoid one more possible typo... ... View more

this works awesome. Thanks for prompt response Here are the Steps I followed 1)Created ldap_errcodes.csv as below err,ldaperr_description 1,Operations error 2,Protocol error 2)uploaded this file to Manger>Lookups>Look up table files 3) gave the search err| lookup ldap_errcodes.csv err OUTPUT ldaperr_description |top err,ldaperr_description ... View more

If I wanted to get the count per user would the following be correct: index="main" source=accesscontrol.csv" | eval access_hour=strftime(_time,"%H") | where ( access_hour >= 19 OR access_hour < 7 ) | table _time,User | top 10 User showperc=false Thx ... View more

I downvoted this post because this is not supported, and as a comment suggested, will break between upgrades (and also not be transferrable between systems) ... View more

Thank you MuS! It turns out the queue referred to as "splunktcpin" in the metrics.log is actually the splunk listener on port 9997, defined by .\etc\system\local\inputs.conf with this stanza [splunktcp://9997] queueSize = 10MB #<-- this is my change The other one I had issues with, parsingQueue (which alacercogitatus helped me with), is defined in a different conf file - .\etc\system\local\server.conf, with: [queue=parsingQueue] maxSize = 30MB #<-- this is my change A little confusing... 😞 Thank you both! ... View more

thanks for ur information ... View more

I would agree with Ayn, but when I ran it, the search didn't have the quotes around "red car". I added this: | eval search = "\"" .search."\"" | before the format and it returned with the quoted "red car", which will search for "red car" and not "red AND car". ... View more

I have this very same issue but with multiple sets of username and passwords in a single app. The specific use case is that the scripted input invokes three HTTPS endpoints each with its own set of credentials. In addition, each endpoint has custom fields that it uses to configure the connection to the respective endpoint. Any idea how this can be achieved? ... View more

Thanks for the info. My splunk version is 4.3.1 but the function, latest, seems not working. ... View more

Awesome! If you feel your question was answered, could you please mark the answer as accepted? Thanks! ... View more

I am also have a problem with Indexing Volume stats. I am logged in as Admin with full permissions and role access to everything, yet when run Status, Indexing Volume I only see data for is for _thefishbucket and _internal. I have a lot of Windows WMI event data being forwarded to the Indexer the indexing stats are not showing when when I display the Indexing Volume by Source/Sourcetype. ... View more

LINE_BREAKER=([\r\n]+)time: worked for me. ... View more

Thanks! I will move the props.conf to our Heavy Forwarder. ... View more