Is it the indexes that make the difference. Check your "Path to indexes" and is the size of the disk/folder of splunkdb on both indexers is the same? If yes, your indexes are being replicated properly but there is some other problem on one of your indexers. ... View more

that's what streamstats is ... View more

As far as I have seen it doesn't limit the rows, or maybe I am getting you wrong. However, I think the problem may be in the roles. If you assign a user role to someone his search size is limited to 100MB and therefore it stops once the search occupies more than 100MB. Change "Limit Total Jobs Disk Quota" in the roles settings and this may fix the problem ... View more

There may be a better solution but as a workaround I think use automatically extracted fields for all other fields and extract the field in quotes separately from raw data. ... View more

A quick workaround should be to extract the quoted field separately from the _raw data. You can do it through field extractions or props.conf and transforms.conf. Here I would give you the example using inline rex command: -- Your query -- | eval _raw = " 2016-12-20T14:33:54.693Z,fe80::b9c4:56fa:d460:81f3,exchangesrv.test.com,fe80::b9c4:56fa:d460:81f3%12,exchangesrv,\"MDB:bdfe3301-0f8f-48ce-92e4-6ff938ad1a6d, Mailbox:6a2dac65-cadc-46ec-b44c-98fba096c55e, Event:156022, MessageClass:IPM.Note.ProbeMessage.MBTSubmissionServiceHeartbeatProbe, CreationTime:2016-12-20T14:33:54.599Z, ClientType:Monitoring, ServerMdbConnectionId:08D423660D5DE7FD\",,STOREDRIVER,RECEIVE,2014,,4c7b2b2e-291a-4635-f603-08d428e539b5,[email protected],To,8944,1,,,0000003a-0000-0000-0000-0000f519e953-MBTSubmissionServiceHeartbeatProbe,[email protected],[email protected],04I: ,Originating,,,,S:MailboxDatabaseGuid=bdfe3301-0f8f-48ce-92e4-6ff938ad1a6d;S:ItemEntryId=00-00-00-00-2D-E8-87-0C-DF-D8-A0-42-97-64-3D-D7-57-8C-2A-3C-07-00-E7-FB-62-04-97-51-5F-44-B6-C5-9B-A3-65-97-9D-5F-00-00-00-00-01-0B-00-00-E7-FB-62-04-97-51-5F-44-B6-C5-9B-A3-65-97-9D-5F-00-00-1E-84-2C-F6-00-00;S:DeliveryPriority=Normal;S:AccountForest=test.com;S:IsProbe=true;S:PersistProbeTrace=False,Email,940aee54-2531-41e4-f603-08d428e539b5,15.01.0544.027" | rex field=_raw "\"(?<quoted>.*)\"" | table _raw quoted ... View more

Use sed command to replace unwanted \x0a with a space or any character you want: --SomeSearch--| eval data = "somevalue\x0aData2 date-string\x0aData3 some-string with spaces\x0aData4" | rex field=data mode=sed "s/(\\x0a)/ /g"| table data You can also use sedcmd in props.conf to automatically apply this to your data. ... View more

It is the time row was added. It is guaranteed to be unique ... View more

Best practice I have seen so far it to make timestamp column your rising column. This will eliminate the chances of skipping events due to not matching rising column condition. ... View more

Use calculated fields. http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/definecalcfields ... View more

The format of the output may differ a bit but the information is what you want so try this: | timechart span=1h max(UTILIZATION) AS UTILIZATION by groupA,groupB |eval hour=strftime(_time,"%H") | table hour groupA groupB ... View more

Is it auto-increment or the getting its value from some other means? Just asking because I also had same problem and found out that the database was somehow not saving records in order ... View more

is the rising column on an auto-increment field? If not so, there is a chance that the records don't come in order and DB Connect will ignore the events with value less than the rising column value it last saw. You can check it in /opt/splunk/var/lib/persistantstorage/dbx//state.xml file what value it has stored last. you need to find the folder relevant to your query as the names are just given in form of random numbers. ... View more

The best way is to pull the SharePoint list through a PowerShell Script and ingest in Splunk and schedule it through your heavy/light forwarder. Send the XML query that will look like this: -- snip < List> < Query> < Where> < And> < Geq> < FieldRef Name='EventDate'/> < Value Type='DateTime'> < Today/> < /Value> < /Geq> < Leq> < FieldRef Name='EventDate'/> < Value Type='DateTime'> < Today OffsetDays='+30'/> < /Value> < /Leq> < /And> < /Where> < /Query> < /List> -- endsnip Use GetSPList command in Powershell to send the query and receive the results. You may need to install SPClient_x64 or SPClient_x86 based on your system. Cheers ... View more

Transaction command is very heavy on resources. So the first thing is how much processing power you have. Yes, it can be used on large amount of data but you need to carefully examine your data and its behaviour and then select the Transaction Definition options including startswith, endswith, maxspan, maxevents, maxpause, keeporphans, unifyends etc; https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transaction ... View more

Hi did it work for you? ... View more

I am getting results for today and yesterday. For the day before (previous day) you need to append another query with different time range. index=apiUser earliest=@d latest=now | stats count(api) AS TodayCount by userID | append [ search index=apiUser earliest=-1d@d latest=@d | stats count(api) AS YesterdayCount by userID] | append [ search index=apiUser earliest=-2d@d latest=-1d@d | stats count(api) AS PreviousDayCount by userID] | stats sum(TodayCount) AS TodayCount sum(YesterdayCount) AS YesterdayCount sum(PreviousDayCount) AS PreviousDayCount by userID| sort by -TodayCount | head 10 ... View more

This will do what you need, I think index=apiUser earliest=@d latest=now | stats count(api) AS TodayCount by userID | append [ search index=apiUser earliest=-1d@d latest=@d | stats count(api) AS YesterdayCount by userID] | stats sum(TodayCount) AS TodayCount sum(YesterdayCount) AS YesterdayCount by userID| sort by -TodayCount | head 10 ... View more

So when you will sort it by TodayCount and select the top 10 users, YesterdayCount column will be showing their counts from yesterday. ... View more

yoursearch | eval field_value="some value or and expression" | where another_field != $field_value$ ... View more

you need to run the query twice, once for today's timeframes and once for yesterday's timeframes. then append the two results and use stats to combine both. index=apiUser earliest=@d latest=now | stats count(api) AS TodayCount by userID | append [ search index=apiUser earliest=-1d@d latest=@d | stats count(api) AS YesterdayCount by userID] | stats sum(TodayCount) AS TodayCount sum(YesterdayCount) AS YesterdayCount by userID| sort by -YesterdayCount | head 10 You can sort by -TodayCount and then select top 10 as well. ... View more

However, if you go with the regex I provided you don't need to: This is the output: JobDate JobTime JobType JobStartOrEnd 12/12/2016 3:21:19 DailyDayJob Starting 9/12/2016 23:27:19 DailyNightJob completed 9/12/2016 23:21:19 DailyNightJob Starting 9/12/2016 3:28:10 DailyDayJob completed 9/12/2016 3:21:19 DailyDayJob Starting ... View more

Yes. Extract it as JobStartorEnd and then use CASE statement | eval status = CASE(like(JobStartorEnd,"%Starting%"),"Start",1==1,"Ending") ... View more

Don't know why the fieldnames are being removed from the query. However, you can add the fieldnames in the regex yourself. ... View more