I doubt that Indexer's HDD performance might NOT be enough in your environment. Your indexer's metrics.log (queue) may show some evidences of root causes. I ask you to check. Splunk on Splunk App has a dashboard to check your queue status. What kind of storage do you use for index volumes? Do your 30 indexers create indexes on an NAS storage? Do you deploy indexers on your VM environments? If yes, I think you might need to re-build your Splunk environemt. I hope it helps you. インデクサーのHDD性能が十分でない可能性が高いと思います。 Indexerのmetrics.log(キュー情報)に根本原因のヒントが見つけられると思います。 Splunk on Splunk Appには、キュー情報を確認できるダッシュボードが用意されています。 どのようにインデックス用のストレージを構成されていますか？ 30台のIndexerが共通のNAS上にインデックスを作成していませんか？ VM環境にIndexerを構築されていませんか？ もし、その通りなら、Splunkのサイジング・構成を見直す必要があると思います。 ご参考になれば、幸いです。 ... View more

Hello, Could you use combination "NOT", "subsearch" and "return"? (your search) NOT [search (your search to get Table_B) | return [<count>] Table_A=Table_B ] In the subsearch, you may get a list of Table_B. And Table_B is changed to Table_A field with using "alias" feature of "return" command. The "NOT" located in front of the subsearch makes negative match. So you may get the part of Table_A values which are not in Table_B. I hope it helps you. Thank you. ... View more

Hello, Could you try to use "where" command to compare 2 fields' value? (your search) | where CurrentValue=NextValue OR (your search) | where 'CurrentValue'='NextValue' I hope it helps you. Thank you. ... View more

Hello, Could you try to use "timechart" instead of "chart"? xxxxxx | timechart span=1d count(uri) AS Errors | eval Date=strftime(_time," %m-%d") | table Date Errors I believe it would be simple. I hope it helps you. Thank you. ... View more

Hello, Could you try to use "eventstats"? I think the "Example 3" of eventstats would be the same as your requirement. http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Eventstats index=temp sourcetype=searchlog | eventstats avg(searchKeyword.hits) AS avg | where searchkeyword.hits > avg I hope it helps you. Happy splunking! ... View more

検索文について、「｜」で分解し、どの部分に問題があるか、切り分けをされてはいかがでしょうか？ 1) データの選択範囲が正しいか？ sourcetype=d_log (source=i_device OR source=device OR source=i_device_n OR source=*i_device_r) | stats count by source 対象にしているsourceがカウントされているか、確認します。ここで対象から漏れている場合、inputs.confの設定を見直し、sourceとsourcetypeが期待通りに設定されるか、ご確認ください。 2) transpose transposeでは引数を指定しないと、デフォルトは5となっています。transpose 10のように大きい数字を指定することで変化は見られませんか？ 3) すべてのsourceにて、フィールド情報が含まれているでしょうか？fillnullの有無で件数に変化がないかを確認。 index= sourcetype=d_log (source=i_device OR source=device OR source=i_device_n OR source=*i_device_r) | rex field=id "(?<id>d+)@" | fillnull value="NULL" id c_id id serial type model version Carrier pp u_id wifi enrolled_date lastmodified number phone | stats latest(c_id) AS CID latest(id) as ID latest(serial) AS Serial latest(type) AS Type latest(model) AS Model latest(version) AS Version latest(Carrier) AS Carrier latest(pp) AS PP latest(u_id) AS UID latest(wifi) AS wifi latest(enrolled_date) AS enrolled_date latest(lastmodified) as lastmodified by number | eval Enrolled=strftime(enrolled_date,"%Y/%m/%d %H:%M") | eval Lastupdated=strftime(lastmodified,"%Y/%m/%d %H:%M") | rename phone AS MSN | table CID ID MSN Serial Type Model Version Carrier PP UID wifi Enrolled Lastupdated | transpose fillnullコマンドを追加する事で、期待結果が得られるなら、フィールドの値が正しく抽出できていないのかもしれません。 フィールド抽出設定をご確認ください。 フィールドが抽出できないケースが想定される場合には、fillnullコマンドによる対応が必要なのかもしれません。 参考にしていただければ幸いです。 ... View more

sunriseさん、こんにちは エクスポート時に文字コードをUTF-8以外に変更する機能はSplunk 6.0.3には提供されていないと思います。 一方で、Excel Export Appを利用すれば、文字コードを変換する必要はありません。お試しください。 I believe Splunk 6.0.3 and lower versions don't have any function to specify character encoding type to export results. It is always UTF-8. But if you use "Excel Export App" to export search results, you don't need to convert character encoding. Happy splunking!! Excel Export App ... View more

Hello, You may need to add the " use_file_operator " capability into your role in order to use the "file" search command. If my role doesn't have this capability, Splunk reports the error message; "You have insufficient privileges to perform this operation." And the default admin role doesn't have it. So, you need to add it. Thanks. ... View more

Hello, You can use "dboutput" command to enter your search restuls into your DB servers. "README/dboutput.conf.spec" may help you. Could you check it? I cannot use my stanza configurations specified in "dboutput.conf". But I can use "dboutput type=insert database=MsSQL table=dbx fields" style. Thanks. ... View more