We are using Informatica software. The logs produced are dumped into 1 directory. Currently there are 1000+ log files produced from various runs. Each file needs to be consumed as 1 event. A new run will overwrite the log file from a similar run. My current inputs entry: [monitor:///apps/informatica/powercenter91/server/infa_shared/SessLogs/*.log] host = etltest1 ignoreOlderThan = 1d index = main sourcetype = etl_logs And props entry: [source:*SessLogs/*.log] CHECK_METHOD = modtime Is this the optimum config? Thanks! ... View more

More and more I'm getting reports of bad queries, or queries that don't match results from a separate run. In most cases, if I re-type the search string manually, it works. Visually the string is identical, but apparently there are invisible characters introduced at some point in the crafting of the string. When the search fails completely, it's more apparent and I can train users on this. Sometimes, however, it's a silent failure. For example, today there was an issue with one of the filters in the string: FIELD!=value . Checking the search inspector revealed that Splunk was seeing FIELD!=value\xa0 . Again, visually the string looked fine. Anyone got suggestions for how to address this with the 500+ users on my system? I fear bad results are being handed out because parts of searches silently aren't firing. ... View more

I saw this post, but no one has answered with specifics. I've tried without success to modify the block of JS that calls Drilldown.handleDrilldown in the tagcloud sample app. I just want it to set form field values: events: { 'click a': function(e) { e.preventDefault(); unsubmittedTokens.set('fieldtoken',e.target.text()); submittedTokens.set('fieldtoken',e.target.text()); } }, But this doesn't work. Any hints? Original JS block: events: { 'click a': function(e) { e.preventDefault(); // Perform automatic drilldown on click on a tag Drilldown.handleDrilldown({ name: this.settings.get('labelField'), value: $.trim($(e.target).text()) }, 'row', this.manager); } }, ... View more

The following form is not behaving as intended. The tokens don't always make it through. I can verify this by clicking on the open in search link on the results and see that the token expanded to the default value. I've tried restarting splunk, and clearing browser data. Any ideas? Splunk 6.0 64bit running on Linux. <form> <label>Service Starts</label> <description>Shows any service start, with time, host and service</description> <fieldset> <input type="text" token="server"> <label>Hosts to match</label> <default>*</default> </input> <input type="text" token="svc"> <label>Service to match</label> <default>ELTPGuardian</default> </input> <input type="time" searchWhenChanged="true"> <default> <earliestTime>@d</earliestTime> <latestTime>now</latestTime> </default> </input> </fieldset> <row> <table> <searchString>host=$server$ sourcetype="WinEventLog:Application" started SourceName=$svc$ | transaction maxpause=10m pod SourceName | table _time pod host SourceName | rename SourceName as Service</searchString> <earliestTime>$earliest$</earliestTime> <latestTime>$latest$</latestTime> <option name="count">50</option> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> </table> </row> </form> ... View more

We experience heavy search loads a few times a day. This can cause the Search Peers to drop from the Search Heads, resulting in the dreaded yellow triangles on dashboard panels. "Unable to distribute to peer..." After the heavy load is gone, Search Heads often don't reconnect to the Peers, or at least not in a timely manner. However, if I drop into the settings and disable/enable, it always reconnects immediately. Is there a way to increase the frequency of the retries? (Or enable it at all, because seriously, sometimes I've waited hours only to disable/enable and have it work immediately.) I found this in the spec file, but... checkTimedOutServersFrequency = <integer, in seconds> * This setting is no longer supported, and will be ignored ... View more