I hope below link helps you, http://docs.splunk.com/Documentation/Splunk/6.6.2/RESTREF/RESTinput# - data/inputs/udp/{name} or data/inputs/udp/ ... View more

So can get search body and other details by executing this rest command | rest /services/search/jobs/1499263157.5501 splunk_server=local Below is the link, http://docs.splunk.com/Documentation/Splunk/6.6.2/RESTREF/RESTsearch ... View more

try this your base search | timechart usenull=fasle useother=false limit=0 count ... View more

there should be a space between $TIME_STRING$ and index=main. $TIME_STRING$ index=main ... View more

try this index=xxxx sourcetype=xxxxxx | timechart span=1h count by DC ... View more

Please check you have proper file read/write permission on authentication.conf ... View more

Did you change the $SPLUNK_DB folder old path to new path under indexes.conf. This will avoid splunk under default location. Please go through below link for further clarification, https://answers.splunk.com/answers/149248/how-to-move-index-from-one-hard-drive-to-another-in-splunk-clustered-environment.html ... View more

..... earliest=-2d@d latest=-0d@d | timechart span=1d count by users | eval _time = strftime(_time,"%Y-%m-%d") | fields - _span _spandays | transpose ... View more

It is possible two reasons 1) Interesting fields wont show because of fast mode. 2) Field coverage might be less than 1% ... View more

Try this eventtypes.conf [stuff_index] search = index=stuff-xxx OR index=stuff-yyy ... Search query : eventtype="stuff_index" ..... ... View more

can you post some sample events. ... View more

Hi Rayudu, You can delete old splunkd logs i.e., internal logs by tweaking _internal index configuration under indexes.conf. ... View more

transforms.conf seems correct. Problem with your search query ... View more

... | rex field=_raw "DBNAME=\"(?\S+)\" | chart sum(USED_KB) over SNAP_DATE by DBNAME ... View more

[] SHOULD_LINEMERGE=false NO_BINARY_CHECK=true TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N TIME_PREFIX=\d+-\d+-\d+\s\d+:\d+:\d+.\d+\,\sDBNAME=\"\S+\",\sSNAP_DATE=\" MAX_TIMESTAMP_LOOKAHEAD=21 CHARSET=UTF-8 ... View more

Hi, Please try this, .... | eval co = server."". status | stats values(co) as server_status by group | rex field=server_status "(?P\S+)(?P\S+)" | fields - server_status ... View more

Hello, you can do the following, $SPLUNK_HOME/etc/apps//local/transforms.conf [extract_csv] filename = extract.csv index_fields_list = field1, field2 .... ... View more

at the end is mq-, secs- and err-* ... View more

Hi, you can try this, [monitor:///var/mtapps/ashl/logs/*/*/*/mq-*] index = index_name sourcetype = sourcetype_name1 crcSalt= blacklist.1=secs-.* blacklist.2=err-.* [monitor:///var/mtapps/ashl/logs/*/*/*/secs-*] index = index_name sourcetype = sourcetype_name2 crcSalt= blacklist.1=mq-.* blacklist.2=err-.* [monitor:///var/mtapps/ashl/logs/*/*/*/err-*] index = index_name sourcetype = sourcetype_name3 crcSalt= blacklist.1=mq-.* blacklist.2=secs-.* Regards, Badri Srinivas B ... View more

Hi, Below is the sample query, index=whatever | transaction statrtswith="Apps_Assignment: New apps retrieved" maxspan=1h | stats values(Count) as Apps_Assignment | stats first(Apps_Assignment ) as Initial_Apps_Assignment | eval apps_assignment_time = _time | Table apps_assignment_time , Initial_Apps_Assignment | transaction startswith="Apps_Assignment: apps generated" maxspan=1h | stats values(Count) as Assignment_app | stats last(Assignment_app ) as final_Assignment_app | eval Assignment_app_time = _time | Table Assignment_app_time , final_Assignment_app Hope this will help you Regards, Badri Srinivas B ... View more

Hi Shankarananth, You need to change the regex expression according to you xml source. Regards, Badri Srinivas B ... View more

Hi Shankarananth, you can try to extract the field by using props.conf and transforms.conf instead of spath. Below is example $SPLUNK_HOME/etc/app/your_app/local/props.conf [your_sourcetype] KV_MODE = xml REPORT-getting_logins_fields = xml_login_fields $SPLUNK_HOME/etc/app/your_app/local/transforms.conf [xml_login_fields] REGEX=([^<]+)>([^<]+)< FORMAT = $1::$2 MV_ADD = True I hope this will help you. Regards, Badri Srinivas B ... View more

Thanks Martin ... View more