index=_internal source=*license_usage.log type=Usage h=192.168.0.0/16 | stats sum(b) as bytes by h | eval usagePercent=bytes/( 50 *1024*1024*1024)*100 | where usagePercent>5 This search would output the hosts in the 192.168.0.0/16 range using more than 5 % of the 50 GB license for the selected time range. You'd have to customize this search (ie. change 50 to the actual licensed volume and set the threshold). Also, this search assumes the host values in splunk to be IP addresses. You'd have to add reverse DNS resolution if this isn't the case. index=_internal source=*license_usage.log type=Usage | lookup dnslookup clienthost as h OUTPUT clientip as ip | eval h=coalesce(ip,h) | search h=192.168.0.0/16 | stats sum(b) as bytes by h | eval usagePercent=bytes/( 50 *1024*1024*1024)*100 | where usagePercent>5 ... View more

There are 2 alternatives to show the current (today's) license usage: | rest /services/licenser/pools | stats sum(used_bytes) as used | eval used=round(used/1024/1024) or index=_internal source=*license_usage.log type=Usage earliest=@d | stats sum(b) as bytes | eval mb=round(bytes/1024/1024) | fields mb ... View more

You can monitor files remotely by exposing the logs in a file share, then mount and monitor it on a server where you have a Splunk forwarder or indexer installed. Most filesharing protocols should work (eg. SMB/CIFS, NFS, SSHFS, ...) ... View more

Just an alternative that might be a bit more efficient: ... | eventstats count by _time | where count>0 ... View more

You can use the job.touch() method to keep the job alive for the given ttl (time to live) or modify the ttl by using job.setttl(<ttl in seconds>) . "Touching" the job every few thousand events might be a good idea. Additionally, using job.cancel() when you've finished processing the results can be used to remove the job. job.setttl(86400); processEvents(job); job.cancel(); ... View more

something like allowed/blocked or success/failure. whatever is more reasonable. ... View more

Yup. Network Protection/Traffic might be the best choice. ... View more

This is a good place for getting started: http://dev.splunk.com/view/logging-with-splunk/SP-CAAADP5 http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6 In addition, naming field according to the CIM (Common Information Model) would be a good idea: http://docs.splunk.com/Documentation/ES/latest/CreateTA/CommonInformationModelFieldReference ... View more

I'll add an explanation later ... View more

I don't think you can calculate the cumulative percentage and a running average this way... ... View more

Here is how to create a new field by parsing and formatting a date value using Splunk's eval command: ... | eval newdatefield = strftime( strptime( myolddatefield, "%b %d %H:%M:%S" ), "%m/%d/%Y %I:%M:%S %p") use strptime() to parse a timestamp value use strftime() to format a timestamp value ... View more

Is it the timestamp, that is recognized by Splunk or do you have an extracted field with this value? ... View more

Yes, it's possible. You should take a look at the SideviewUtils app and try to do that using customBahavior on form elements. http://splunk-base.splunk.com/apps/36405/sideview-utils ... View more

it should work, at least on 4.3. The subsearch creates an additional condition for the outer search nps_nasIP="10.170.191.48" . The dot characeter . is used for string concatenation. There's no INT and MOD function for Splunk's eval command so I changed them to INT ==> floor(tonumber(X)) and MOD ==> X%Y Here's a list of functions you can use with the eval command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions ... View more

You could do this using a subsearch: index="winradius" [ | stats count | eval nps_nasIP="10." . tostring(floor(tonumber("0191")/256+170)) . "." . tostring(tonumber("0191")%256) . ".48" | return nps_nasIP ] ... View more