Which tool we can use to record windows desktop application transaction time like what we do using selenium for web automate testing? Goal is to check whether email can be send from Outlook application (windows) as an user experience synthetic monitor. Did the same thing using Selenium for web-mail ,but now the requirement is for Desktop application of Outlook.Suggest tools and if possible an example. ... View more

Is there any solution to monitor Skype for business using Splunk? ... View more

How to create ITSI KPI for windows service status? For Windows service I created a search like below: eventtype=hostmon_windows Type=Service host="*" (Name="ClusSvc" OR Name="MSExchangeADTopology" OR Name="MSExchangeAntispamUpdate" OR Name="MSExchangeCompliance" OR Name="MSExchangeDagMgmt" OR Name="MSExchangeDelivery" OR Name="MSExchangeDiagnostics" OR Name="MSExchangeEdgeSync" OR Name="MSExchangeFastSearch" OR Name="MSExchangeFrontEndTransport" OR Name="MSExchangeHM" OR Name="MSExchangeHMRecovery" OR Name="MSExchangeImap4" OR Name="MSExchangeIMAP4BE" OR Name="MSExchangeIS" OR Name="MSExchangeMailboxAssistants" OR Name="MSExchangeMailboxReplication" OR Name="MSExchangePop3" OR Name="MSExchangePOP3BE" OR Name="MSExchangeRepl" OR Name="MSExchangeRPC" OR Name="MSExchangeServiceHost" OR Name="MSExchangeSubmission" OR Name="MSExchangeThrottling" OR Name="MSExchangeTransport" OR Name="MSExchangeTransportLogSearch" OR Name="MSExchangeUM" OR Name="MSExchangeUMCR" OR Name="COMSysApp" OR Name="Dnscache" OR Name="gpsvc" OR Name="HostControllerService" OR Name="IISADMIN" OR Name="LanmanServer" OR Name="LanmanWorkstation" OR Name="lmhosts" OR Name="LSM" OR Name="MpsSvc" OR Name="MSDTC" OR Name="MSMQ" OR Name="NcbService" OR Name="Netlogon" OR Name="Netman" OR Name="NetMsmqActivator" OR Name="NetPipeActivator" OR Name="netprofm" OR Name="NetTcpActivator" OR Name="NetTcpPortSharing" OR Name="ProfSvc" OR Name="RpcEptMapper" OR Name="RpcSs" OR Name="SamSs" OR Name="SessionEnv" OR Name="TermService" OR Name="W32Time" OR Name="W3SVC" OR Name="WAS" OR Name="Wcmsvc" OR Name="Winmgmt" OR Name="WinRM" OR Name="wmiApSrv" OR Name="WMSVC") StartMode="*" State="Stopped" Threshold field as "Name" It works only if any of the service is in stopped state since no event returns if all services are running. Any suggestion on how to create a KPI in such scenario? ... View more

I know the configuration file precedence, my question is if /system/local is first path of a configuration file then Splunk skips to check /system/default for the same conf file? ... View more

We have implemented 3rd party hardware load balancer between heavy forwarder (which is different network - Customer site) and Indexer (at our site) but it caused event delay. Thus we removed the load balancer (taking into account that the splunk not recommends) and it is working fine.However we really require to implement load balancing directly to indexer to avoid single point of failiure(Heavy forwarder at our site).Any recommendations? ... View more

Perfmon:Process is about 347,662 events for 2 host last 10 mins which is taking huge space in index. Any suggestion to fine tune this? ... View more