Have you check the services? ... View more

Hi Maddy, Sine your URL format pattern is not same so you need to use two regular expressions, | rex field=s "(?<customer_name>[^\/]*)\?" | rex field=s "(?<customer_name>[^\/]*)\/localization" Explanation: | rex field=s "(?<customer_name>[^\/]*)\?" The above one helps to grab the customer name before query string, eg /../.../.../..././../.../customer_name?query | rex field=s "(?<customer_name>[^\/]*)\/localization" The second one helps to grab the customer name which is before localization. ( you have to add in-case if you find any pattern like localization) Sample searches: |stats c | eval s="7 Jan 2015 17:12:44,500 RequestLog INFO :end: /XYZ/api/assets/customer_name? Model=iphone?uage=ge&" | rex field=s "(?<customer_name>[^\/]*)\?" | rex field=s "(?<customer_name>[^\/]*)\/localization" |stats c | eval s="2 Jan 2015 14:57:45,121 RequestLogFilter INFO :end: /XYZ/api//dassets/customer_name2?deviceModel=iphone?uage=ge&pageSize=1000?reenSize=0640x1136&assetQuality=hq" | rex field=s "(?<customer_name>[^\/]*)\?" | rex field=s "(?<customer_name>[^\/]*)\/localization" |stats c | eval s="2 Jan 2015 15:18:29,913 RequestLogFilter INFO :end: /XYZ/api//dasset/customer_name3/localization?language=ge&deviceModel=iphone&assetQuality=hq&assetVersion=160?reenSize=0640x1136˜i=2" | rex field=s "(?<customer_name>[^\/]*)\?" | rex field=s "(?<customer_name>[^\/]*)\/localization" Hope This will helps you !! Cheers!!! Thanks, V ... View more

Hi Cduryea, You can set permissions on a per-object and per-app basis in Splunk Manager. Follow these instructions: 1. Click Settings in the top-level Splunk Enterprise menu. 2. In the Knowledge panel, select a category containing the object you want to edit permissions for. For example, to change permissions on a saved search, click Searches and reports. You can also select All configurations to access all the configurations in a given app. 3. Once you've found the object you want to set permissions for, click the permissions link next to the object. 4. Set permissions to read and/or write for all the roles listed. 5. Click Save. Ref: http://docs.splunk.com/Documentation/Splunk/6.3.2/AdvancedDev/SetPermissions Thanks, V ... View more

Hi, Try to write a simple java JDBC connection class to validate your connection parameters. I guess the host/any connection parameter is not valid or some firewall rules? Check the below link for prerequistites, DB2Conenct: http://docs.splunk.com/Documentation/DBX/2.1.1/DeployDBX/Prerequisites Below link will help you on Java code, JAVA Class: http://www.tutorialspoint.com/jdbc/jdbc-sample-code.htm Thanks, V ... View more

Hi Pavanae, Could you please share the earliest version and the latest version you were upgrading? What are all the components you were updating? Please check the below URL http://docs.splunk.com/Documentation/Splunk/6.3.1/Installation/Aboutupgradingto6.3READTHISFIRST Thanks, V ... View more

Search helps to find the max queue size which is blocked in indexer or forwarder, index=_internal sourcetype=splunkd blocked=true | stats values(max_size_kb) as kb by name,host | sort 0 name | eval mb=kb/1024 index=_internal source=*metrics.log group=queue "blocked" | transaction blocked name host | eval queue_blocked = duration /60 | where queue_blocked > 1 | table host name blocked queue_blocked Solutions Queue size increase in forwarder does impact on the indexers (forwarder queue change will helps till parsing queue), So I guess we can apply the same conf in indexers and test. (Note: Reason for queue block is, when some component in the index time can not service data as fast is entering into the system) Sources : http://wiki.splunk.com/Community:HowIndexingWorks ... View more

Hi, index=http status=200 src_ip!=10.0.0.0/8 src_ip!=192.168.0.0/16 src_ip!=172.16.0.0/12 | table src_ip The above query will gives you all the possible src_ip details (including duplicate entries). Then you are left joining with other index(duplicate remove). So either you need to remove the duplicate before or after join. so the query will be like this, index=http status=200 src_ip!=10.0.0.0/8 src_ip!=192.168.0.0/16 src_ip!=172.16.0.0/12 | dedup src_ip | table src_ip | join [search index=snort | dedup src_ip,signature | table src_ip,signature] Thanks, V ... View more

Try this, index=_internal source="/opt/splunk/var/log/splunk/metrics.log*" "group=udpin_connections" NOT [| inputlookup syslog_lookup | fields Ip,Data_Source| dedup Ip | rename Ip as hostip|return hostip] | fields Ip,Data_Source,hostip Cheers! V ... View more

Hi imsiva, First ensure two forwarders are sending data and the host names are different (as like you mentioned above). then source file path is common(except the server name) in two forwarders. search : index=<your index> host=* index=<your index> host=server01 source="/var/apps/IBM/WASAppTarget0*/serverout.log" index=<your index> host=server02 source="/var/apps/IBM/WASAppTarget0*/serverout.log" If the above queries gives appropriate results then the below query will gives results as expected. index=<your index> host="server0*" source="/var/apps/IBM/WASAppTarget0*/serverout.log" Cheers! ... View more

hope this helps you. ... View more

Hope this helps you. Cheers! ... View more

check this, http://wiki.splunk.com/Community:MoveIndexes ... View more

Check this, http://wiki.splunk.com/Community:MoveIndexes ... View more

go through this article, Link ... View more

Hi, What's the common field? I can see that common field TimeInHours is not available in the table result. index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=)| join ,input, TimeInHours [search sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time] Assuming input is the only common field in both the searches, index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=)| join input, TimeInHours [search sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time] execute the searches and check it manually input has common values, Search 1: index=cas OR index=vod (sourcetype=ch AND input=) OR (sourcetype=ac AND id= AND code=) OR (sourcetype=hy AND ruid=) | table input Search 2: sourcetype=ch input=* | chart latest(Status) as stat earliest(_time) as earliest by input| eval Time=round(((now()-earliest)/60)/60) | where match(stat, "Failed") | table input,Time ... View more

English Version of question: index to have a field called "count", for each "user" and issued a total of "count", you have to appear in the order number is large. | stats sum (count) by user | sort - sum (count) For human small number you want to exclude, if you want to display only a large number top ten, Are you sure you want if you use any kind of command? top and I was or try to use such as a command or have changed but a result, we have may not be displayed well. Better advice thank you for a good way you know. ... View more

try this, |stats sum(count) as total by user | sort - total | head 10 Cheers! ... View more

Hi Heinz, There is no row or column limitation on lookup table. default size is 10MB. Refer the post Link Cheers! ... View more