I am using the following to determine the amount of browsing time for a user. I would like to have a table that actually shows browsing time by day. So if I run this command for the past 7 days, I would like to have a breakdown per day. index=webproxy user="test" Company="test" | transaction user maxpause=5m | stats sum(duration) as browsing_time by user | fieldformat browsing_time = tostring(browsing_time,"duration") ... View more

I want to create a time chart (line) based on the count of events for the past 24 hours, and one week earlier same day and same time period I can create a time chart using the following: index=myindex | timechart count I know I can the previous week by using the following: index=myindex earliest-7d@h latest -6d@h How do I create a line chart using the values for the past 24 hours and the values from the previous week? What will the search be? ... View more

We have a system where the log rotation confuses splunk and splunk starts attempting to reindex the log. This happened 3 days ago and we Splunk is still trying to catch up. How can I clear the "buffer" and just tell splunk to start from this point forward? I think the throughput is saturated and it is sending as many events it can. When the problem started, we were getting about 9400 duplicate events per 1 event. We are now at about 50 to 1. Any ideas on how to make this stop? ... View more

I have a lookup table, and then I added another field to the table (csv) The original table contained some of the following: user_id, name, company I have now added the manager_user_id to the table (csv) user_id, name, company, manager_user_id I have an automatic lookup that links user=user_id, so when I perform a search the following fields show up: name, company, etc... The manager_user_id will can also be matched to the user_id What I want to do is perform a lookup of the manager_user_id against the table where manager_user_id = user_id to enrich my data. I would love to have an automatic lookup, but I am unsure what might happen with the fields from the automatic lookup where user=user_id So, in my case, manager_user_id and user = a field in the table called user_id ... View more

I am using the following, but I only want to see events if the number dest_ip are 2 or more. |top 10000 src_ip, dest_ip | stats count, values(dest_ip) by src_ip Ideas? ... View more

We just upgraded to Splunk 4.3.1 from 4.3 to address the memory leak issues. We have not updated the UFs since this would be a manual process at this point. Are there any know memory leak issues that are impacting the Ufs? I have UFs installed on my DCs and if Splunk crashes one of these - well you know the rest of the story! ... View more

I have installed the UF on 4 systems, but one is giving me the following error... 03-02-2012 10:46:33.860 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: select Name, CurrentDiskQueueLength, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk) 03-02-2012 10:46:41.122 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: SELECT Name, FreeMegabytes FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk) 03-02-2012 10:46:48.447 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: select Name, BytesReceivedPerSec, BytesSentPerSec, BytesTotalPerSec, CurrentBandwidth from Win32_PerfFormattedData_Tcpip_NetworkInterface) 03-02-2012 10:46:55.708 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: select Name, IDProcess, PrivateBytes, PercentProcessorTime from Win32_PerfFormattedData_PerfProc_Process) 03-02-2012 10:47:04.070 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: select Name, BytesReceivedPerSec, BytesSentPerSec, BytesTotalPerSec, CurrentBandwidth from Win32_PerfFormattedData_Tcpip_NetworkInterface) 03-02-2012 10:47:11.384 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: select Name, IDProcess, PrivateBytes, PercentProcessorTime from Win32_PerfFormattedData_PerfProc_Process) 03-02-2012 10:47:19.247 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: SELECT Name, FreeMegabytes FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk) 03-02-2012 10:47:27.078 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: select Name, IDProcess, PrivateBytes, PercentProcessorTime from Win32_PerfFormattedData_PerfProc_Process) 03-02-2012 10:47:34.887 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: SELECT Name, FreeMegabytes FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk) 03-02-2012 10:47:42.203 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: select Name, BytesReceivedPerSec, BytesSentPerSec, BytesTotalPerSec, CurrentBandwidth from Win32_PerfFormattedData_Tcpip_NetworkInterface) 03-02-2012 10:47:50.034 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: SELECT Name, FreeMegabytes FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk) 03-02-2012 10:47:57.866 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: select Name, BytesReceivedPerSec, BytesSentPerSec, BytesTotalPerSec, CurrentBandwidth from Win32_PerfFormattedData_Tcpip_NetworkInterface) 03-02-2012 10:48:05.131 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-wmi.exe"" WMI - Error occurred while trying to retrieve results from a WMI query (error="Query was not syntactically valid." HRESULT=80041017) (root\cimv2: select Name, IDProcess, PrivateBytes, PercentProcessorTime from Win32_PerfFormattedData_PerfProc_Process) Three of the systems have identical hardware/software. inoputs.conf [default] host = anna-LT [script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path] disabled = 1 [script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 0 interval = 1 source = wmi sourcetype = wmi wmi.conf [settings] initial_backoff = 5 max_backoff = 20 max_retries_at_max_backoff = 0 checkpoint_sync_interval = 2 [WMI:LocalPhysicalDisk] interval = 10 wql = select Name, CurrentDiskQueueLength, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk disabled = 0 [WMI:LocalProcesses] interval = 30 wql = select Name, IDProcess, PrivateBytes, PercentProcessorTime from Win32_PerfFormattedData_PerfProc_Process disabled = 0 [WMI:Memory] interval = 5 wql = select PagesPerSec, AvailableMBytes, CommittedBytes, PercentCommittedBytesInUse from Win32_PerfFormattedData_PerfOS_Memory disabled = 0 [WMI:LocalNetwork] interval = 10 wql = select Name, BytesReceivedPerSec, BytesSentPerSec, BytesTotalPerSec, CurrentBandwidth from Win32_PerfFormattedData_Tcpip_NetworkInterface disabled = 0 [WMI:CPUTime] interval = 3 wql = SELECT PercentProcessorTime,PercentUserTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name="_Total" disabled = 0 [WMI:FreeDiskSpace] interval = 120 wql = SELECT Name, FreeMegabytes FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk disabled = 0 Not sure what the problem is? I have uninstalled, restarted, reinstalled???? ... View more

I use the following to show me what my estimated license usage is at the time the search is ran. I would like to create a chart that looks at the past X days and show me what I used. index=_internal source=*license_usage.log earliest=@d+30m| eval GB=b/1024/1024/1024 | stats sum(GB) by pool | eval used='sum(GB)' | eval GB_Used_Today=round(used, 0) | fields GB_Used_Today ... View more

Prior to upgrading to 4.3, I had designed some dashboards where I used the eval to combine some fields to provide me some useful information at a glance; for example... 185.25.25.25 -> 65.55.7.172, US - port:443 Prior to the upgrade, I could read the the information above, but after the upgrade, the information looks like... 185.25.25..., US-port:80 I can hover over the bar and get all the information. I would rather have more info displayed and less graphic displayed. Any ideas? ... View more

We are using McAfee Network Security Manager. We are using the option to send alerts out via syslog. Not all the fields are available, but they are in the mysql db. Has anyone worked on a good sql select to pull most of the alert data per event? ... View more

I perform a serach that gives me a host name, but within the returned data the event does not contain the host_ip. Within the same index, a different type of event contains both values. I think this can be done with a subsearch? Is there any function within splunk to enrich the original event? Like a lookup? ... View more

I need to filter out some events on the heavy forwarder. I know how to do this but I need some help with the regex. If dstip=123.123.123.123 and dstport=514 and rule_name not ="this is my rule" drop the events. These are the events I want to see....... Jan 31 04:09:39 gwz auditd: date="2012-01-31 09:09:39 +0000",fac=f_kernel_ipfilter,area=z_general_area,type=t_nettraffic,pri=p_major,hostname=abc.cbs.com,event="session end",app_risk=low,app_categories=infrastructure,netsessid=54c044f265c90,srcip=123.15.3.19,srcport=41868,srczone=internal,protocol=17,dstip=123.123.123.123,dstport=514,dstzone=dmz,bytes_written_to_client=0,bytes_written_to_server=136491133,rule_name="this is my rule",cache_hit=0,start_time="2012-01-30 09:02:08 +0000",application=Syslog ... View more

I am building a dashboard based on all activity related to an IP. I have one source that generates events, but does not always include the IP. The events that do have an IP always have the host name. From one search, I want to search by IP, but also associate the IP to a host name and then search again with the host name and display all events. ... View more

I would like to create a dashboard with multiple event panels. I would like each event panel to also include the panel that includes the fields? Is this possible. What I am really looking for is the view you get from the search view without the timeline. ... View more