My understanding of "Live Product Roadmap & Input" is : Webinar IRC Enhancement Request thru Support Portal and other live communication and input between Splunk and users. Thanks! ... View more

In 4.3.2, I confirmed this is working for both type of OS. For Unix OS : Sampledata.zip:./([^/]+)/ For Windows ： Sampledata.zip:.\\([^/]+)/ ** The regex in Tutorial Doc is not working, be careful. ... View more

It depends on how busy the remote hosts are. As a rule of thumb, one Splunk instance (forwarder or indexer) can support the collection of Security Event Logs (the most verbose variety) on between 20 and 50 remote hosts. To scale out collection on more remote hosts, simply add another Splunk instance (forwarder or indexer) to collect another from another 20 to 50 remote hosts. Rinse and repeat. All that said, I would strongly recomment installing the Splunk Forwarder, a relatively lightweight build of Splunk that has no UI and no indexing, on your hosts rather than using WMI. Beyond better resiliance by collecting Event Logs and other WMI data remotely, you will be able to easily collect and forward other data such as DNS, DHCP, Windows Update, and application logs. ... View more

I am not sure this is right way, but Icame up with the following: Create summary index for 7 day average index=test earliest=-7d@d latest=@d | stats avg(number) as mean | addinfo | collect index=summary addinfo marker="info_search_name=\"7day_avg_num\"" Search from summary index and put the average value using eval + subsearch index=test | eval 7day_avg=([search index=summary info_search_name="7day_avg_num" | head 1 | rename mean as search]) | timechart avg(7day_avg), avg(number) Any comment appreciated. ... View more

When you stop Splunk, it has to close out all the inputs, as well as the indexes and other components of the product. The more of these you've got floating around, the longer it takes. Splunkd.log in $SPLUNK_HOME/var/log/splunk/ will tell you what is shutting down when the shutdown occurs. If your particularly curious what is taking so long, and you can't tell from splunkd.log, you can probably strace splunkd during the shutdown to see what is happening. For Windows, the equivalent tool would be procmon. I think you'll find the answer here. ... View more

With splunk team, I could get the following result, but I am still looking for the search to get the result based on actual time stamp like above. # splunk search 'sourcetype="sendmail" | convert dur2sec(delay) dur2sec(xdelay) | transaction queueid | search msgid=*ChangeMe from=testuser1* to=testuser2* | where delay>=0 | stats last(_time) as time1 first(_time) as time2 list(delay) as delay(sec) values(host) list(stat) by from,to,msgid | convert ctime(time1) ctime(time2)' from to msgid time1 time2 delay(sec) values(host) list(stat) ---------------------- ---------------------- ----------------------------------------- ------------------- ------------------- ---------- ------------ ---------- testuser1@mydomain.poc testuser2@mydomain.poc 012B28991FA3471F9929FEA3977B7C8A@ChangeMe 12/20/2010 16:31:00 12/20/2010 16:31:08 5 mail1 Sent 7 mail2 Sent 5 mail3 Sent testuser1@mydomain.poc testuser2@mydomain.poc 1EE3A51D02FD4EF58488BEA27F452324@ChangeMe 12/20/2010 16:39:11 12/20/2010 16:39:13 0 mail1 Sent 1 mail2 Sent 1 mail3 Sent testuser1@mydomain.poc testuser2@mydomain.poc 24FC6F57221C4FFA9BC1B5E5E0676519@ChangeMe 12/16/2010 14:06:18 12/16/2010 14:06:18 0 mail1 Sent testuser1@mydomain.poc testuser2@mydomain.poc 282997A8AE804969B7AEDEF9E8C357F6@ChangeMe 12/16/2010 17:14:08 12/16/2010 17:14:11 0 mail1 Sent 2 mail2 Sent 1 mail3 Sent testuser1@mydomain.poc testuser2@mydomain.poc 2FB15937BFF349B8BEA52BC33776C122@ChangeMe 12/20/2010 16:29:13 12/20/2010 16:29:16 0 mail1 Sent 2 mail2 Sent 2 mail3 Sent testuser1@mydomain.poc testuser2@mydomain.poc 99A437DA859C4EA4B58702961591692C@ChangeMe 12/16/2010 14:27:31 12/16/2010 14:27:33 0 mail1 Sent 1 mail2 Sent 2 mail3 Sent testuser1@mydomain.poc testuser2@mydomain.poc 9E3FCD84A0524ACFB0F7AF4FD2FA7B68@ChangeMe 12/16/2010 15:02:35 12/16/2010 15:02:37 1 mail1 Sent 1 mail2 Sent 1 mail3 Sent testuser1@mydomain.poc testuser2@mydomain.poc FA1F6FD73ED347CB8F3B5451C59750CA@ChangeMe 12/16/2010 17:10:52 12/16/2010 17:10:55 1 mail1 Sent 2 mail2 Sent 1 mail3 Sent ... View more