Hi, I have an indexer which is also being used as a search head. It was Splunk version 6.0 and all the data was showing in the dashboard, but when I upgraded it to 6.3.2 , no data is showing up. Even If I forward any new input from the forwarder, it is not showing up in the "Indexer". Please help me out to fix this issue !! ... View more

Instead of deploying the whole app, I want to deploy only one configuration under XXXX application. If I use ./splunk reload deploy-server , it will deploy the whole XXXX application, I only want to deploy inputs.conf file of XXXX application. ... View more

Hi, I have a dashboard and I can see that there are lots of data and at the bottom of the panel there are showing up 6 lines like : 1,2,3,4,5,6 <next>. When I click the 6, then 6th page is showing up, but when I am clicking "next" after 6, it is showing up for 7th page and so on...... but 1 is going off, 2 is going off from the left side and I can see <prev>. My requirement is : Is there any way so even If I click on the 7th page OR 8th page and so on, I can still see and click on any other page number as 1,2,3,4,5,6,7,... ? None of the line numbers should go away. Please help !! ... View more

Hi, I have a Cassandra database which is only accessible though REST API (through authentication). I want to fetch the data from Cassandra database (NO SQL database) through SPLUNK. I am using Splunk DB Connect on the search head and using it, but it seems that that database is only accessible through API calls. Could you please show some kind of solution to fetch the data from Cassandra DB through API in Splunk? Cheers, Abhay === UPDATE === See comments for help with the REST API Modular Input Configuration. ... View more

Hi, I have a Universal Forwarder installed on the License Master server to send the License_usage.log to the central indexer cluster ( total is 5 ). but when I am writing the search in the Central Cluster, I found some gaps for some dates: My search is as below : index=XXX sourcetype=license_usage.log type= RolloverSummary earliest=-30d latest=@d| eval gb=b/1024/1024/1024 | timechart span=1d useother=f limit=20 sum(gb) AS volume_gb by pool |rename _time as Date| eval Date=strftime(Date,"%Y-%m-%d") Please let me know how do I find the Root Cause for this issue. ... View more

Hi, When I am giving the below search for 15th Aug 2015 : index=_internal sourcetype=splunkd| reverse I am getting the below output 8/15/15 1:14:00.381 AM 08-14-2015 12:44:00.381 -0700 INFO Metrics - group=pipeline, name=indexerpipe, processor=signing, cpu_seconds=0.000000, executes=176, cumulative_hits=1381281 But as per the event timestamp 08-14-2015 12:44:00.381 , the event got generated on 14th Aug 2015, then why it is coming on 15th Aug 2015? Please help me to get this mystery solved? ... View more

Hi, I am searching for source, sourcetype and indexname for a kind of events in the logs. from "_internal" index I am getting "data_source" and "data_sourcetype" but not the "indexname" where exactly this "data_source" resides. that's why I am trying to use "map" command to get the "indexname" from the "metrics_log" ( We are matching "data_source" from the "_internal" with the "Series" from the "metrics_log" ) but the problem is I am geting only the information of "indexname" not the data_source and data_sourcetype becuase in my "map" command I have used index="_internal" ..... data_source .... | map search="search index=* sourcetype=metrics_log series=$data_source$" I am not getting any field of "_internal" index in the output like "data_source" and "data_sourcetype" , but only getting "indexname" field from "metrics_log" I want to get all the fields from _internal index as well as "metrics_log" sourcetype for all the matching "source file" . Please help !! Cheers, ... View more

Hi, I have a lot of events where "indextime" is > than "eventime". It means something went wrong and it might be one of the below reasons: Forwarder was down ( Because of which event time is not equal to index time , hence indextime > eventime ) Backlogs Timestamp is not in the correct format Please help me out in finding out how to get the exact reason of the difference between indextime and the eventime from the above three listed reasons or if there is any. Basically, how to identify what is the reason of getting the difference between "indextime" and "eventtime" Please help me with some good examples. Urgently needed. your help would b highly appreciated !! Cheers, ... View more

Hi, I have an understanding that _time --> is the event time (the time which is present in the event means the time when the event was generated) and "_indextime" --> is the index time (the time when the events have been indexed). Now, if my event time and indexed time is not same for some reason (let's say, if my forwarder is down for an hour, then the event time and the index time will have a 1 hour diff), can I consider those events as a bad events whose index-time and event time is not same? And also, why it is necessary to always sync event time and index-time? What is the benefit of syncing these two times, and when we click on the time using "Timepicker", which time does it consider? Please help !! ... View more