Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

Yup, the second query was what I was looking for. Much appreciated! ... View more

Sorry your issue is not clear? Can you paste code and data as code using the code button i.e. 101010 so that special characters do not escape? Have you tried the suggested query? What is the final output you need? Are all the fields already extracted or you need assistance with the field extraction? Please add more details so that community members can assist. ... View more

Wierd it works with out quotes for you .. but we should keep the value in double quotes to work.. | eval client_ip=192.162.207.160 - The number 192.162.207.160 is invalid. | eval client_ip="192.162.207.160" - works fine ... View more

@bgleich, you should try editing the code section and re-post using code button 101010 so that special characters do not escape. Based on the query posted seems like you are looking at the same data source for Adding Session and Removing Session per day for every User (unique) and then want to get the difference of their count. PS: You seem to have two separate rex running on _raw (please share your anonymized/masked raw data and current regular expression if you want us to assist you with combining the same. Also if you can pull the Status of the log event as Adding or Removing it would help you in writing better query. Remember to post these with code button 101010 on Splunk Answers comment. If your regular expression is working as expected, and you can figure out single rex, Please try the following query, <your_base_search_index_and_sourcetype> host=SMD* source="D:\\Apps\\CM\\Logs\\CM_*" "CM_EMD" ("Adding Session" OR "Removing Session") | rex "<your_regular_expression_to_extract_Server_and_UserName>" | eval Status=case(searchmatch("Adding Session"),"Adding",searchmatch("Removing Session"),"Removing",true(),"Unknown") | dedup date_mday Server UserName Status | eval key=Server."-".date_mday | chart count by key Status | eval difference=Adding-Removing ... View more

Hi @keishamtcs , I added the props.conf file to the indexer as suggested in the answer by @tiagofbmm. Well, he actually suggested the heavy forwarder, but that's all controlled at the corporate level, so they chose to add it to the indexer instead. ... View more

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

Please don't forget to accept the answer and upvote ... View more

My issue was custom event types permissions being 'this app' only, when they were only seen by Search app, but NOT Splunk_SA_CIM app. I had to change them to globally shared, then the search 'tag=authentication' got them in use. ... View more

@bluemarvel, if your intent is to find out what percent of total items added to order did not get purchased your query with transaction command and closed_txn is not giving you results you expect. Transaction command keeps certain number of events in memory for correlating as per the arguments like maxspan and maxpause startswith endswith etc. Even if due to the settings/config transaction command may drop the unmatched events (even though match may actually exist). So stats is a better fit for this situation (and will perform better as well), where you can control what you need to correlate. Try the following search where stats correlates events with same JSESSIONID and the get all the values of action as either "addtocart" or "purchase" (base search filters are used to drop events we are not interested in to make search run faster). index="splunk_answers" sourcetype=access_combined* action IN ("addtocart","purchase") JSESSIONID=* | stats count as EventCount dc(action) as distinctActions values(action) as action by JSESSIONID | stats count(eval(action="addtocart")) as TotalAdded count(eval(action="addtocart" AND action!="purchase")) as AddedNotOrdered | eval FailedPercent=round((AddedNotOrdered/TotalAdded)*100,1) Please try out and confirm. ... View more

Hey abhi04, Replication factor defines how many replicated buckets you want .Suppose you have clustered environment of 3 indexers and if you keep replication factor as 3,then each indexer would have replicated copies of the other indexers. If the indexer fails,the other two indexers will have the replicated copies and those will become searchable.Only the primary copies that were available in the indexer that failed, the other indexers would make only those copies searchable. Search factor is the number of copies that you want to be available in Splunk. Note: If the search factor is high, all the index files are replicated and that can account on your storage. You need to decide replication factor and search factor as per how you want high availability to be set. You can refer this doc for detailed explanation: http://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Basicclusterarchitecture Let me know if this helps!! ... View more

It was a good discussion, but only now did I fully understand your index-time need! ... View more

The reason is that sourcetype override occurs after timestamp recognition and breaking into events. It doesn't work the way you want, which is override Sourcertyoe and only then break into events It is expected behaviour. Each block only goes through the parsing pipeline once ... View more

The thing is, if you have two separate instances and are sending segmented data to Prod or Lab, you don't want to get mixed data in either of the environments. What I would suggest to avoid getting your tcpout queue full is explore this in outputs.conf: dropEventsOnQueueFull = <integer> * If set to a positive number, wait <integer> seconds before throwing out all new events until the output queue has space. * Setting this to -1 or 0 will cause the output queue to block when it gets full, causing further blocking up the processing chain. * If any target group's queue is blocked, no more data will reach any other target group. * Using auto load-balancing is the best way to minimize this condition, because, in that case, multiple receivers must be down (or jammed up) before queue blocking can occur. * Defaults to -1 (do not drop events). * DO NOT SET THIS VALUE TO A POSITIVE INTEGER IF YOU ARE MONITORING FILES! Using this this on the [tcpout:lab] server = lab.net:9997 ... View more

It does, thank you! ... View more

Thanks for this. ... View more

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

Notice that a normal append won't produce that strange behaviour: index=_internal source=*scheduler.log OR source=*metrics.log OR source=*splunkd.log OR source=*license_usage.log OR source=*splunkd_access.log | stats count AS raw_count, dc(processor) AS raw_dc_processor by host | append [ | tstats prestats=t summariesonly=t count, dc(server.processor) FROM datamodel=internal_server BY host | stats values(raw_dc_processor) AS raw_dc_processor, dc(server.processor) AS dm_processor, values(raw_count) AS raw_count, count AS dm_count by host] ... View more

Almost there! I changed stats latest(_time) by stats max(latest),stats min(earliest) and it works 🙂 Thanks a lot. tstats should be flexible though. ... View more

I mean this one did it! Piping to the eval using the single quotes was the key. Thanks again Niketnilay ! ... View more

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

Hi Tiagof, it is not what I was looking for. what I meant was a vertical layout where the filters can be on their own in between panels ... View more

Hello, After adding the stanzas the events are indexed in a new index except some events. Sources such as Perfmon:Network Interface Perfmon:CPU Load Perfmon: Available Memory is still indexed in default,So how to move these source to the new index ... View more