Yes the top line will match the words "messages", "secure" or "auth" anywhere in the file or folder name. The bottom will only match if it is at the beginning of the source. As most sources start with the drive or a slash (i.e. c:\ or /), it is unlikely to match those. ... View more

Splunk starts blocking when free space falls below 2GB and it sounds like this was the cause of your problem. Just deleting the files will work as a temporary fix but they will grow back. You can change the default in "$SPLUNK_HOME/etc/system/local/server/conf" You need a stanza [diskUsage] minFreeSpace = 1000 #or whatever value you decide on Bob ... View more

No this is already available in 4.2 Create your search, select a real-time range (eg 1 minute window) then click 'create an alert'. ... View more

You can use transaction to collect and throw away duplicates. This will need some editing for your environment. ( search_terms ) OR ( index=summary search_name=searchName ) | transaction _time, other_identifying_fields keepevicted=true | where eventcount=1 | sistats count by _time, other_identifying_fields ... View more

You have the round command before the streamstats, copying it after should give you what you want. <splunk search stuff defining Success and Attempt> | eval rate=round((Success*100)/Attempt,2) | streamstats avg(rate) as average by _time | eval average=round(average,2)| sort -_time limit=15 | fields _time rate average Bob ... View more

I hadn't realized I was using a custom search command form an app I had installed. "Sanity Check My App!" I have updated my reply above. ... View more

If you download the "Sanity Check My App!" app (written by carasso) from splunkbase, it includes a new search command entity. You can use it to tell splunk to use the rest endpoint to collect the saved searches. | entity saved/searches namespace=myapp _raw will contain the search name and the field "search" will have the search string. ... View more

If you don't want to resort to advanced xml, convert your dashboard to a form and add the input type of time. Below is a simple example. <form> <label>My Dashboard as a form</label> <fieldset autoRun="true" > <input type="time" /> </fieldset> <row> <single> <searchTemplate>mysearch | stats count | rangemap field=count low=0-0 elevated=1-10 default=severe</searchTemplate> <title>Responses outside SLA</title> <option name="classField">range</option> </single> </row> <row> <chart> <searchName>MySavedSearch</searchName> <title>My Saved Search</title> <option name="charting.chart">line</option> <option name="charting.legend.placement">bottom</option> </chart> </row> <form> ... View more

To find these events, you can run the following search ...|eventstats count as duplicate by _raw _host _time | where duplicate>1 As a temporary measure you can remove the duplicates from each search with the dedup command ...| dedup _raw _host _time BUT this is inefficient so you need to prevent and get rid of the duplicates. If you have multiple indexers, look for data going to more than one, look for almost duplicate files, avoid using crcsalt in inputs.conf etc. Once you have got rid of the cause, get rid of the duplicates using the following search * | eventstats count as duplicates first(_cd) as cd by _raw host _time | where cd!=_cd I have deliberately not joined the delete to the above search as it is good practice to check the data before deleting it. Confirm it is only bringing back duplicates and not the original then pipe to delete. You will need to temporarily add the candelete roll to your account for this to work. ...| delete ... View more

For this type of search dedup is your friend. If you search for all msg="Connection Opened" OR msg="Connection Closed" events, the most recent for any connection is it's current status. sourcetype=sonicwall msg="Connection Opened" OR msg="Connection Closed" | dedup src_ip dest_ip proto | where msg="Connection Opened" if you regularly run this search, or it takes a long time, it would be worth summary indexing it with sourcetype=sonicwall msg="Connection Opened" OR msg="Connection Closed" | dedup src_ip dest_ip proto | sistats count by src_ip dest_ip proto msg and to report, use index=summary search_name=YourSearchName | dedup src_ip dest_ip proto | where msg="Connection Opened" or you could use the blogged method. ... View more

Some commands that change the data including replace do not map well to automated drilldown. In those cases, you will need to use advanced XML and specify the drildown search. A good explanation of this is given here [http://www.splunk.com/base/Documentation/latest/Developer/TableChartDrilldown]http://www.splunk.com/base/Documentation/latest/Developer/TableChartDrilldown[1] ... View more

You can create a lookup file or add a hosts file to your server and splunk will use either of these to get the hostname. ... View more

I think you could open your workflow in a form view where the form asks for a ticket number and appends it on a post process search. ... View more

I don't think you can do this only using cron. I assume you are using this for an alert so, the way I would approach it is to run every minute between midnight and 3am. Cron * 0-3 * * * Then use the custom condition and where command to limit the time. Assuming you were looking for zero events... where count=0 AND date_hour*100+date_minute>39 AND date_hour*100+date_minute<221 so my savedsearch looks like this [downtime] search = heartbeat | stats count by host enableSched = 1 cron_schedule = * 0-3 * * * dispatch.earliest_time = -1m@m dispatch.latest_time = @m alert.track = 1 alert_condition = where count=0 AND date_hour*100+date_minute>39 AND date_hour*100+date_minute<221 counttype = custom action.email = 1 action.email.inline = 1 action.email.sendresults = 1 action.email.to = [email protected] alert.severity = 4 alert.suppress = 1 alert.suppress.period = 5m displayview = flashtimeline request.ui_dispatch_view = flashtimeline vsid = gq1ya7b9 [edit ref comment] Oops! Sorry not thinking straight there. Adding the following to your search will do what you want | where date_hour*100+date_minute>39 AND date_hour*100+date_minute<221 ... View more

You need to tell splunk that this scripted input is not a multiline event. I would add the following to a props.conf file in the app. [websphere_activity] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false The linebreaker should be the default but it doesn't hurt to redefine it. It is worth noting that you could probably do without the script altogether and index the files directly. Splunk is good at detecting foreign languages and adjusting accordingly though you can tell it what the format is with the following. TIME_FORMAT = <strptime-style format> CHARSET = <string> by the way, it is worth noting this is an index time change so it will not fix any data already in your index. ... View more

I think you could do this by using the bucket function and stats eventtype="search" | bucket _time span=1h | stats count as search_count by host _time | appendcols [search application=flights eventtype="pay_success" | bucket _time span=1h | stats count as buy_count by host _time ] | eval conversion=(buy_count/search_count)*100 | timechart first(conversion) by host The bucket command groups data into hour blocks (you can change that to any period you wish) and then the stats now also groups by host and _time so it should now be possible to timechart. ... View more