If you want your aggregation per day you can specify span=1d in the timechart command. min and max give you the highest and lowest value of duration per day, avg gives you the average duration each day and median will give you the median duration per day. If you provide more information on what you are trying to find out and also provide a bit of example data, I could provide you with a more detailed help. ... View more

if you do not have _time values in your "table" than you probably want something like this: | eval _time=start_time | timechart count avg(duration) max(duration) min(duration) median(duration) Just use whatever statistical function you want, but I added a few common ones. Also end time does not seem to be as relevant to me as start time and duration, so i have not used it in the query. ... View more

I just tried out your solution and it works, if eval-based definition is checked. So thank you. ... View more

Sorry I could not help, but I think you have to create a support case with splunk since this looks like bug. One thing I would like to suggest you could try out. 1. Update your forwarder to 6.1.4 2. Set "SPLUNK_OS_USER = splunk" in splunk-launch.conf (if not already set) See http://docs.splunk.com/Documentation/Splunk/6.1.4/Admin/Splunk-launchconf 3. Create a new /etc/init.d/splunk file by issuing the following command as root: /opt/splunkforwarder/bin/splunk enable boot-start This will recreate a new init config and hopefully the bug is fixed in the new version. ... View more

We had a similar problem on a server with many logfiles, but it was not related to permissions. Have you had a look at your splunk forwarder logs? (index=_internal host=...) First we increased the ulimit for the forwarder, because we had a lot of the following message: "File descriptor cache is full (1024), trimming..." See http://answers.splunk.com/answers/13313/how-to-tune-ulimit-on-my-server.html Second we changed the stanze so splunk would only monitors recent files in the target directory. I recommend this only if you have a setup which rotates files, because otherwise splunk won't monitor. ignoreOlderThan=2d See http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Editinputs.conf#Monitor_syntax_and_examples ... View more

Can you please provide which Version of the Splunk UF you use? ... View more

I can only point you to how to configure scripted inputs, but you would have to write the script (unix or windows) yourself. A scripted input works by splunk executing a script and indizes any output the script generates. How to configure inputs (generally): http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Configureyourinputs How to scripted input via the config files: (section "Scripted Input") http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/inputsconf How to scripted input via the web gui: http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs#Add_a_scripted_input_in_Splunk_Web ... View more

Try to clean out your fishbucket. %SPLUNK_HOME%/bin/splunk stop %SPLUNK_HOME%/bin/splunk clean eventdata -index _fishbucket %SPLUNK_HOME%/bin/splunk start ... View more

First of all, if possible change the log structure to something easier to analyse. But if this is not possible here is something you can try: Are the fields wrapped in either " or ' ? Because than you could us a DELIMS="\" \"" or DELIMS="'" if you can change the format use something like this: field1="value1", field2="value2",... Hope this helps. ... View more

try if one of these works for you: index=tmg | search [|inputlookup KeywordList.csv | fields URI] | lookup KeywordList URI OUTPUT URI_Keyword, URI_KeywordType | table URI_Keyword, URI_KeywordType, URI index=tmg | search [|inputlookup KeywordList.csv | fields URI] | lookup KeywordList URI | table URI_Keyword, URI_KeywordType, URI index=tmg | lookup KeywordList URI | table URI_Keyword, URI_KeywordType, URI Sorry I wrote a longer answer, but lost everything because of my browser, so this short answer is all you get from me at the moment. ... View more

I have the same problem when I use automatic lookups. If that is not the case it may be that you are searching in Fast or Smart Mode and the user_id field is not available in the first search run. Your second query is differently handled by splunk because first a search is done on all data to find data with sourcetype "apache.web.access" and than a new search on the result data is startet, while the first query only runs one search against the data (which is more performant). So try to change your search mode I hope it helps. (It did not in my case with the automatic lookup). ... View more

I think you need the wildcard for recursive monitoring in your config: [monitor:///var/log/...] disabled = false index = main Please refer to http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/Inputsconf section "Note concerning wildcards and monitor" ... View more

I would no longer suggest to use my version of the script, because Splunk already updated their script in their current app. ... View more

Thank you for your contribution, but I would no longer suggest to use my version of the script, because Splunk already updated their script in their current app. ... View more

Seems like it, but according to the following chart it should be included in Splunk Free: http://www.splunk.com/view/SP-CAAAE8W ... View more

We ran into the same problem and extended the previous solutions. Now we do not even use a loop at all. We have to note thought, that the script now depends on tail being installed. . `dirname $0`/common.sh SEEK_FILE=$SPLUNK_HOME/var/run/splunk/unix_audit_seekfile AUDIT_FILE=/var/log/audit/audit.log if [ "x$KERNEL" = "xLinux" ] ; then assertInvokerIsSuperuser assertHaveCommand service assertHaveCommandGivenPath /sbin/ausearch if [ -n "`service auditd status`" -a "$?" -eq 0 ] ; then if [ -a $SEEK_FILE ] ; then SEEK=`head -1 $SEEK_FILE` else SEEK=0 echo "0" > $SEEK_FILE fi FILE_LINES=`wc -l $AUDIT_FILE | cut -d " " -f 1` if [ $FILE_LINES -lt $SEEK ] ; then # audit file has wrapped SEEK=0 fi wc -l $AUDIT_FILE | cut -d " " -f 1 > $SEEK_FILE exec 3<&0 exec 0<"$AUDIT_FILE" tail -n +$(($SEEK+1)) | tee $TEE_DEST | /sbin/ausearch -i 2>/dev/null | grep -v '^----' exec 0<&3 fi elif [ "x$KERNEL" = "xSunOS" ] ; then : elif [ "x$KERNEL" = "xDarwin" ] ; then : elif [ "x$KERNEL" = "xFreeBSD" ] ; then : fi ... View more

When issued to a remote server the "splunk display app" does require authentication in our system. And as far as I know, the deploymentserver is able push out apps to the forwarder. but maybe he can just tell the forwarder it has to connect back to the deploymentserver and get its apps. ... View more

If the IP addresses are in a specific range you could use the CIDR notation like this: source="dbmon-tail://netmanias/splunk_ads_click" NOT 61.247.204.0/24 ... View more

Well thats quite a different usecase, thanI would have guessed from your initial question. I updated my answer to extract the field_name ("summary") and the field_value ("Mostly Cloudy") seperatly. But maybe you also want to take a look at handling multiline events. ... View more