Field name is FLOW. FLOW field value is 123 OR 123456 OR 123456789 OR ... FLOW=123 ===> FLOW=null FLOW=123456 ===> FLOW=123 FLOW=123456789 ===> FLOW=456 . . . I only need a three-digit in the end. Help me .... ... View more

Hi Splunk alert pop-up possible? If you possible, how to set this? or Do you have an example? Thank you ... View more

I'm bringing data from a database every 1 minuite. Data is three kinds. Data type is 1. 2013-02-01 13:12:01;i;OS0001; ~~~ 2. 2013-02-01 13:12:04;d;OS0001; ~~~ 3. 2013-02-01 13:13:06;u;OS0001;~~~ => "i" is insert, "d" is delete. , "u" is update, OSC001 is PK. Can you calculate in case "d" data comes "i" next time? ... View more

Hi I'm using 4.3.3 on linux. After 5.0 update, only a title is indicated and the result value is not marked. Doesn't the excel_export app become a compatible in the splunk 5.0? Thank you It is the different question, don't you support AIX? ... View more

The method is which I can use (hot, warm db) for 1 year and I move to the cold db from this or greater? Description: If collected data become 1 year, data is movement possible with the cold db? I am trying to save collected data on the local disk(hot,warm) for 1 year. And I am trying to move to the external storage unit from data which it become with 1year. Moreover can I solve with a warmToColdScript? This script is necessary if it is possible. Is there the possible way? Thank you ... View more

Volume when calculating per_index_thruput and per_host_thruput. However, when calculated as per_index_thruput and per_host_thruput There seems to be a difference between the two. During the last 24 hours, capacity of the three index calculated results the 30GB. But If you search for a host that contains three indexes, the 14GB will.. But same search and using per_host_thruput... Difference between per_index_thruput and per_host_thruput? ... View more

Hi I want to search several host include in indexes. last 24hour index name is a_1, a_2, a_3.... how to search? thank you ... View more

Hi 1 years old data on the local disk will try to move it storage. So I want to warm data to cold by time. (It is not using maxWarmDBCount). Is there any way? Thank you. ... View more

Hi Specifically Is there a way to improve performance? Two of the indexer and search my splunk configuration header is one. My splunk configuration is Two indexer and One search header. Thank you my hardware capa Raid = 1+0 MEM = 16GB CPU = Intel Xeon 2 Quardcore 2.4GHz Day Volume = 100GB ... View more

Hi I have a two indexer and one search header. Licence is 200GB. splunk version is 4.3.2. OS is RedHat 5.5 Ent. CPU is 2.4GH 2 quard core. MEM is 8GB search header of splunk web service down. only splunk web service down. splunkd service alive. Is it because time? only search header and ntpserver linkage. Do you have splunk web service down known issue? Thank you. -- web_service.log 2012-06-21 01:53:52,846 INFO [4fe20020d712a00f50] utility:63 - name=javascript, class=Splunk.Session, appCodeName=Mozilla, appName=Microsoft Internet Explorer, appMinorVersion=0, cpuClass=x86, platform=Win32, systemLanguage=ko, userLanguage=ko, appVersion=4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2), userAgent=Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2), height=1080, bufferDepth=0, deviceXDPI=96, logicalYDPI=96, deviceYDPI=96, availHeight=1080, logicalXDPI=96, systemXDPI=96, fontSmoothingEnabled=true, systemYDPI=96, colorDepth=32, width=1920, availWidth=1920, updateInterval=0, documentURL=http://10.140.1.50:8000/ko-KR/manager/search/saved/searches/%ED%95%98%EB%82%98%20%EC%BA%90%ED%94%BC%ED%83%88%20APC?action=edit&ns=search&uri=%2FservicesNS%2Fadmin%2Fsearch%2Fsaved%2Fsearches%2F%25ED%2595%2598%25EB%2582%2598%2520%25EC%25BA%2590%25ED%2594%25BC%25ED%2583%2588%2520APC, documentReferrer=http://10.140.1.50:8000/ko-KR/manager/search/saved/searches, flash=11.2.202, Splunk.Session.START_EVENT fired @Thu Jun 21 01:54:09 UTC+0900 2012 2012-06-21 01:53:56,215 INFO [4fe200240e2aaaca180d50] cached:77 - memoized decorator used on function <function getEntities at 0x1181e398> with non hashable arguments 2012-06-21 01:53:56,435 INFO [4fe200240e2aaaca180d50] cached:77 - memoized decorator used on function <function getEntities at 0x1181e398> with non hashable arguments 2012-06-21 01:53:57,738 INFO [4fe20025bb13a79750] utility:63 - name=javascript, class=Splunk.Session, appCodeName=Mozilla, appName=Microsoft Internet Explorer, appMinorVersion=0, cpuClass=x86, platform=Win32, systemLanguage=ko, userLanguage=ko, appVersion=4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2), userAgent=Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2), height=1080, bufferDepth=0, deviceXDPI=96, logicalYDPI=96, deviceYDPI=96, availHeight=1080, logicalXDPI=96, systemXDPI=96, fontSmoothingEnabled=true, systemYDPI=96, colorDepth=32, width=1920, availWidth=1920, updateInterval=0, documentURL=http://10.140.1.50:8000/ko-KR/manager/search/saved/searches?msgid=454110.617617482516&ns=search&redirecting=true, documentReferrer=, flash=11.2.202, Splunk.Session.START_EVENT fired @Thu Jun 21 01:54:14 UTC+0900 2012 2012-06-21 01:53:58,618 INFO [4fe200269d2aaaca180650] cached:77 - memoized decorator used on function <function getEntities at 0x1181e398> with non hashable arguments 2012-06-21 01:53:58,741 INFO [4fe20026bd13a79d10] cached:77 - memoized decorator used on function <function getEntities at 0x1181e398> with non hashable arguments 2012-06-21 01:53:58,930 INFO [4fe20026bd13a79d10] view:1059 - PERF - viewTime=0.1424s templateTime=0.0468s 2012-06-21 01:54:00,043 INFO [4fe200280a2aaab47dfa90] utility:63 - name=javascript, class=Splunk.Session, appCodeName=Mozilla, appName=Microsoft Internet Explorer, appMinorVersion=0, cpuClass=x86, platform=Win32, systemLanguage=ko, userLanguage=ko, appVersion=4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2), userAgent=Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2), height=1080, bufferDepth=0, deviceXDPI=96, logicalYDPI=96, deviceYDPI=96, availHeight=1080, logicalXDPI=96, systemXDPI=96, fontSmoothingEnabled=true, systemYDPI=96, colorDepth=32, width=1920, availWidth=1920, updateInterval=0, documentURL=http://10.140.1.50:8000/ko-KR/app/search/dashboard_live, documentReferrer=http://10.140.1.50:8000/ko-KR/manager/search/saved/searches?msgid=454110.617617482516&ns=search&redirecting=true, flash=11.2.202, Splunk.Session.START_EVENT fired @Thu Jun 21 01:54:17 UTC+0900 2012 2012-06-21 01:54:03,639 INFO [4fe2002b9f139dae90] view:537 - loading saved search "?섎굹 罹먰뵾??APC" into view "flashtimeline" 2012-06-21 01:54:03,647 INFO [4fe2002ba4139da590] cached:77 - memoized decorator used on function <function getEntities at 0x1181e398> with non hashable arguments 2012-06-21 01:54:03,950 INFO [4fe2002ba4139da590] view:1059 - PERF - viewTime=0.1791s templateTime=0.1244s 2012-06-21 01:54:05,696 INFO [4fe2002db12aaaac0ea210] utility:63 - name=javascript, class=Splunk.Session, appCodeName=Mozilla, appName=Microsoft Internet Explorer, appMinorVersion=0, cpuClass=x86, platform=Win32, systemLanguage=ko, userLanguage=ko, appVersion=4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2), userAgent=Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2), height=1080, bufferDepth=0, deviceXDPI=96, logicalYDPI=96, deviceYDPI=96, availHeight=1080, logicalXDPI=96, systemXDPI=96, fontSmoothingEnabled=true, systemYDPI=96, colorDepth=32, width=1920, availWidth=1920, updateInterval=0, documentURL=http://10.140.1.50:8000/ko-KR/app/search/flashtimeline?s=%ED%95%98%EB%82%98%20%EC%BA%90%ED%94%BC%ED%83%88%20APC, documentReferrer=http://10.140.1.50:8000/ko-KR/app/search/dashboard_live, flash=11.2.202, Splunk.Session.START_EVENT fired @Thu Jun 21 01:54:23 UTC+0900 2012 2012-06-21 01:54:23,454 INFO [4fe2003f732aaac7575e50] <string>:59 - creating excel export for user admin from search id 1340211248.13715 2012-06-21 01:54:24,508 INFO [4fe2003f732aaac7575e50] wb_client:68 - request completed successfully, parsed 4 results 2012-06-21 01:54:24,508 INFO [4fe2003f732aaac7575e50] <string>:125 - streaming excel spreadsheet to client 2012-06-21 01:54:48,696 INFO [4fe20058b12aaab55f62d0] <string>:59 - creating excel export for user admin from search id 1340210762.13682 2012-06-21 01:56:48,862 INFO [4fe200d0db12bce610] <string>:59 - creating excel export for user admin from search id 1340210762.13682 2012-06-21 01:57:01,381 INFO [4fe200d0db12bce610] wb_client:68 - request completed successfully, parsed 9 results 2012-06-21 02:08:08,671 INFO [4fe2037881efaf10] __init__:160 - Using default logging config file: /opt/splunk/etc/log.cfg 2012-06-21 02:08:08,671 INFO [4fe2037881efaf10] __init__:176 - Setting logger=splunk level=INFO 2012-06-21 02:08:08,672 INFO [4fe2037881efaf10] __init__:176 - Setting logger=splunk.appserver level=INFO 2012-06-21 02:08:08,672 INFO [4fe2037881efaf10] __init__:176 - Setting logger=splunk.appserver.controllers level=INFO 2012-06-21 02:08:08,672 INFO [4fe2037881efaf10] __init__:176 - Setting logger=splunk.appserver.lib level=WARN 2012-06-21 02:08:09,381 INFO [4fe2037881efaf10] lists:59 - List controller loaded: EntitiesListGenerator 2012-06-21 02:08:09,381 INFO [4fe2037881efaf10] lists:65 - Setting lists/entities 2012-06-21 02:08:09,381 INFO [4fe2037881efaf10] lists:59 - List controller loaded: JobsListGenerator 2012-06-21 02:08:09,382 INFO [4fe2037881efaf10] lists:65 - Setting lists/jobs ... View more