Hi, I think this is similar case as user URL tracking on web sites, and I am trying to track what page a user have visited. Here is my log (simplified). This includes user, previous page, current page and timestamp in unix time. 1361836690 user=u01 action=move prev=p1 current=p2 1361836690 user=u02 action=move prev=p2 current=p4 1361836691 user=u01 action=move prev=p2 current=p3 1361836691 user=u02 action=move prev=p5 current=p6 1361836691 user=u03 action=move prev=p2 current=p1 1361836692 user=u02 action=move prev=p5 current=p6 1361836693 user=u03 action=move prev=p1 current=p3 1361836696 user=u01 action=move prev=p3 current=p4 1361836698 user=u03 action=move prev=p3 current=p4 1361836699 user=u03 action=move prev=p5 current=p6 1361836708 user=u03 action=move prev=p6 current=p1 What I want to do is to list which page a user has visited by connecting prev in a event and current in the next latest event that matches to prev value in a last event. I think SQL can query such information, but I need to do this by Splunk Language. I would like to get some help with this from anyone who knows this type of search. Thank you in advance, ... View more

Hi, I have been looking for information about REST API point to know if UF has completed reading the file and sending events to indexer, or simply waiting for events to be logged to monitored file: /services/admin/inputstatus/TailingProcessor:FileStatus I am trying to track if universal forwarder is reading files monitored or completed sending events. some key shows type="open file", and others showing "finished reading". Could anyone know the difference between "open file" and "finished reading"? If there are more status for file input, I would like to know the information about the status of file being monitored. <s:key name="/root/test.log"> <s:dict> <s:key name="file position">2252994</s:key> <s:key name="file size">2252994</s:key> <s:key name="percent">100.00</s:key> <s:key name="type">**open file**</s:key> </s:dict> </s:key> and, <s:key name="/opt/splunkforwarder/var/log/splunk/license_audit.log"> <s:dict> <s:key name="file position">0</s:key> <s:key name="file size">0</s:key> <s:key name="parent">$SPLUNK_HOME/var/log/splunk/splunkd.log</s:key> <s:key name="percent">100</s:key> <s:key name="type">**finished reading**</s:key> </s:dict> </s:key> Any information would be appreciated. ... View more

Hi I created a table using stats, it looks like Table A below What I am trying to do is make create Table B. Table A Key1 Key2 FiledA FiledB FiledC FiledD ------------------------------------------------------------------------ Key1-1 Key2-1 A-1 B-1 C-1 D-1 A-2 B-2 C-2 D-1 Key1-2 Key2-2 A-3 B-2 C-3 D-2 A-4 B-4 C-3 D-3 Table B Key1 Key2 FiledA FiledB FiledC FiledD ------------------------------------------------------------------------ Key1-1 Key2-1 A-1 B-1 C-1 D-1 Key1-1 Key2-1 A-2 B-2 C-2 D-1 Key1-2 Key2-2 A-3 B-2 C-3 D-2 Key1-2 Key2-2 A-4 B-4 C-3 D-3 I was trying to do this by mvzip and mvexpand, but there are multiple multivalue fields, so I need to do mvzip many times. Any idea or approach to this would be appreciated. ... View more

Hi, I followed the README for installation. When I used httpget command from search bar, I got following error. command="httpget", Error : Traceback: Traceback (most recent call last): File "/opt/splunk/etc/system/bin/httpget.py", line 26, in <module> conn.close() NameError: name 'conn' is not defined Is there anything I need to do for this to make this work? I am running Splunk5.0.1. Thank you! [Added for ndoshi's answer] I checked with new one, and followed README again. (1) FILENAME in commands.conf should be in lower case. Possible typo in stanza [httpget] in /Users/mhyugaji/Desktop/spl_instance/splunk/etc/system/local/commands.conf, line 2: FILENAME = httpget.py * It is working though. (2) If url field has "http://" in front of URL, no good. (Working) * | head 1 | eval url="www.splunk.com" | httpget | table url httpget * | head 1 | eval url="www.splunk.com:80" | httpget | table url httpget (Not working and get error) * | head 1 | eval url="http://www.splunk.com" | httpget | table url httpget (Not working and no error) * | head 1 | eval url="http://www.splunk.com:80" | httpget | table url httpget so, my url fields sometimes has "http://", so I will apply httpget command after removing http://. ... View more

Hi, I am looking for the chart property to control the max number of data points that a chart can handle. There are some posts in Answers related to this topic but I still can not find the configuration parameter for this. I would appreciate if anyone could point me to the information about this. Thank you all in advance. ... View more

Hi I am planning to upload an app. However, in case I need to delete or hide the app from splunkbase, can I do it from splunkbase site? I would like to know this before I upload the app. Thanks ... View more

Hi, I have a field "host" that contain more than 10 values. When I issue "... | timechart count by host", timechart shows only 10 hosts and others. Is it possible to configure the number of field values I can display in a timechart? How do I configure simple XML views to show more than 10 host in a timechart? Thanks in advance! ... View more

Hi I have a simple XML dashboard with 1 panel as line chart showing the following search result: * | timechart span=1h count and XML is: * | timechart span=1h count index=me | timechart count log line What I want to do is 1) add markers where data is plotted on Y (count) 2) delete the line so only plotted marker is shown without line I am looking for this in the Visualization document for 5.0.1, but still can't figure out how to do this. Also tried to use scatter chart with _time in X axis, but no luck. Any comment would be appreciated, Thanks! ... View more

Hi I have Splunk 4.3.4 installed using tgz installer on MacOS and Linux. I want to upgrade them using tar installer to Splunk 5. Is there automatic upgrade available in tgz installer? Do I have to manually copy all the configurations in another location and do clean installaion of splunk 5 then copy all configuration back to the splunk 5 installation? Thank you ... View more

こんにちは。 このSplunk Answersでは、英語での質問受付のみのようですが、 日本語でも質問をすることはできますか？ Question in Japanese? ... View more

Hi I am looking for a answer about how to remove safely from the restored buckets from thaweddb directory after restoring/rebuilding archived buckets into thaweddb. Is it safe to simply remove the restored buckets from thaweddb directory without stopping splunkd? I would like to know if there is a specific procedure for this operation. The restored buckets can be safely removed without splunkd by rm commands? Thank you in advance, ... View more

Hi, I am trying to search: sourcetype=access* bytes>1024*10 But this returns event bytes less than 1024, and the result looks wrong. Is there anyway to add calculation on the right side of field? Thank you, ... View more

Hi I am trying to plot image (such as JPEG/PNG) on google map, and want to change the image based on a value in a field. Does anyone try or know how to do this? Thank you in advance.. ... View more