this is from Splunk enterprise, but i think this will work for Splunk light as well - Managing licenses To add a new license to the license stack, specify the path to the license file: ./splunk add licenses /opt/splunk/etc/licenses/enterprise/enterprise.lic To list all the licenses in a license stack: ./splunk list licenses ... View more

just curious, may i know, why you would want to refresh the page, if you want the dashboard query should not run ... View more

Please check this - sourcetype=failure | rex field=_raw "<?[fF]ail[eu][dr]?e?[:;,. ](?<failedCode>.*)" | table failedCode _time _raw ... View more

can you please update us your inputs.conf.. Blacklist (ignore) files To define the files you want to exclude from indexing, add the following line to your monitor stanza in the /local/inputs.conf file for the app this input was defined in: blacklist = <your_custom_regex> If you create a blacklist line for each file you want to ignore, Splunk software activates only the last filter. To ignore and not monitor only files with the .txt extension: [monitor:///mnt/logs] blacklist = \.txt$ To ignore and not monitor all files with either the .txt extension OR the .gz extension (note that you use the "|" for this): [monitor:///mnt/logs] blacklist = \.(?:txt|gz)$ To ignore entire directories beneath a monitor input refer to this example: [monitor:///mnt/logs] blacklist = archive|historical|\.bak$ This example tells Splunk software to ignore all files under /mnt/logs/ within the archive or historical directories and all files ending in *.bak. To ignore files whose names contain a specific string, you can do: [monitor:///mnt/logs] blacklist = 2009022[89]file\.txt$ This example ignores the webserver20090228file.txt and webserver20090229file.txt files under /mnt/logs/. ... View more

Splunk version is not the problem here. as you say, bundle rep failures may be a possibility. ... View more

Compatibility matters only at the level of major/minor release level, not at the maintenance level. For example, a 6.3 search head is not compatible with a 6.4 search peer, because the 6.3 search head is at a lower minor release level than the 6.4 search peer. However, a 6.3.1 search head is compatible with a 6.3.3 search peer, despite the lower maintenance release level of the search head. http://docs.splunk.com/Documentation/Splunk/6.4.3/DistSearch/Distsearchsystemrequirements May this be due to a bundle replication issue. or Synchronize system clocks - It is important that you synchronize the system clocks on all machines, virtual or physical, that are running Splunk Enterprise instances participating in distributed search. Specifically, this means your search heads and search peers. In the case of search head pooling or mounted bundles, this also includes the shared storage hardware. Otherwise, various issues can arise, such as bundle replication failures, search failures, or premature expiration of search artifacts. ... View more

https://answers.splunk.com/answers/36763/splunkweb-starts-then-ends-and-the-service-is-stopped.html This situation seems to happen when there was a previous Splunk instance running under C:\ and then an uncomplete uninstall was not performed ( not sure if because of the uninstall program or what ) and in the registry there are still reference of the old Splunk Instance. In particular after performing an uninstall there was this suspicious entry still there: HKEY_LOCAL_MACHINE\SOFTWARE\Python\PythonService You can try: 1) Stop Splunk 2) Make a backup of buckets and configuration files 3) Uninstall Splunk 4) Search the registry with every entry with Splunk and/or Python on it and clean them 5) Perform a full installation 6) restore the configuration files & buckets 7) create an empty file called ftr under %SPLUNK_HOME% 8) Restart Splunk Alternatively you can try to remove only the python key above and perform another upgrade on top of your %SPLUNK_HOME OR - Tried removing the patches, but no good. I fixed it by: Installing all Windows patches Shutting down Splunk services Backing up \var and \etc directories. Uninstalling Splunk Deleting any leftover directories Reinstalling Splunk Shut down Splunk services Renaming \var and \etc directories Copying the backed-up \var and \etc directories back into the Splunk directory Restarting Splunk services. All good now! ... View more

may i know what happens when you run - eventtype=log_sepa | table _time * ... View more

Hi Dinesh, can you please update us what is this "_time" clearly.. is it the device available "from time" ? Laptop1 2016-09-12 12:04:14 Laptop2 2016-09-12 10:00:45 Projector2 2016-09-11 03:13:04 Projector1 2016-09-06 11:17:50 from the 4 available devices, why you want these two devices(laptop1, projector2)? are there any other field values which will differentiate the laptops and projectors? are there any group names for laptops together? can you please give us the real devices names please? ... View more

Hi ipops, tested and this works fine.. thanks to Sundaresh Sir. sourcetype=ivrdata | where IVR_Message="Platform" AND IVR_Value="2" | stats count by _time | accum count | append [|makeresults | eval count=0 | table _time count] | head 2 ... View more

sorry, updated the missing double quotes - rex field=_raw "EXTRA_FIELD_3\s=\s(?\d+[^\n])" | rex field=_raw "GUNCELSAYI\s=\s (?\d+[^\n])" | table EXTRA_FIELD_VALUE, GUNCELSAYI_VALUE ... View more

please check if rex is extracting the fields properly.. then we can find the difference between two and create an alert - your search | rex field=_raw "EXTRA_FIELD_3\s\=\s(?<EXTRA_FIELD_VALUE>\d+[^\n]) | rex field=_raw "GUNCELSAYI\s\=\s (?<GUNCELSAYI_VALUE>\d+[^\n]) | table EXTRA_FIELD_VALUE, GUNCELSAYI_VALUE ... View more

yes, this needs admin privilege or, user must have "can_delete" role. https://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Aboutusersandroles Please be aware - the delete command deletes the indexed data. ... View more

sure, this will list out the lines which are less than 20 characters length. when you said "I want to disgard a row", i thought to use the delete. ... View more

Hi Nidhi, Maybe, like this.. there is a join command in Splunk as well, but that may not be needed for this one, I think. search index=app sourcetype=abc | table host This will search for sourcetype abc on index app, and returns the list of host names. This search below will check on index app, for sourcetype a1b1c1, and only for the host list from first search. index=app sourcetype=a1b1c1 [search index=app sourcetype=abc | table host] | table _raw _time if you update us with your present search or more info on the requirement, we can suggest exactly. ... View more

not related to this question, but, something strange related to "answers.splunk.com"... this post was created only 4 days back, but it says 2k views for this post. the similar posts created on the same day are having only 70 or 80 or 100 views !!! ... View more

i am not sure if you guys have already checked this, but please have a look - http://docs.splunk.com/Documentation/Splunk/6.4.3/Search/Dispatchdirectoryandsearchartifacts it says - Dispatch directory maintenance The dispatch directory reaper iterates over all artifacts every 30 seconds. It deletes artifacts that have expired based on the last time they were accessed and their configured time to live (TTL), or lifetime. ... View more

as its saying, `mongod': No such file or directory, please try - numactl --interleave=all ./mongod or numactl --interleave=all /export/apps/splunk/bin/mongod mongod process taking more CPU -- maybe, its a mongodb related issue. please verify. ... View more

..I am trying to run a search query wherein where in output of one query acts as inupt for the following query While using pipes | , by default, first query output will be passed to second query. for example, index=app search-for-something | table source, sourcetype, _time ..how can i view the second query result in dashboard You can use timechart command, or chart commands, which will create the visualizations http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Timechart Can you provide us more info about the requirement, so that we can suggest you exactly how to proceed? ... View more

you can write a particulear user-name index=_audit action=search user=user-name | stats latest(_time) as LastRun by user | convert ctime(LastRun) or, for all usernames (without splunk-system-user and splunk_alert_scheduler, the saved search user accounts) index=_audit action=search user!=splunk* | stats latest(_time) as LastRun by user | convert ctime(LastRun) ... View more

lets check this - sourcetype=ivrdata | where IVR_Message="Platform" AND IVR_Value="2" | stats count as Count by _time | replace "N/A" WITH "0" IN Count or sourcetype=ivrdata | where IVR_Message="Platform" AND IVR_Value="2" | stats count as Count by _time | replace "N/A" WITH "0" ... View more

Hi, may i know if this search works fine - sourcetype=ivrdata | where IVR_Message="Platform" AND IVR_Value="2" | stats sum(eval(if(isnull(_time),0,1))) as count by _time ... View more