I would simply install the older version of Splunk on the new server, copy over the entire Splunk directory to the new server and then perform an in place upgrade. ... View more

Are you gathering cpu utilization through events, scripts, logs or metric store? If you gave an example of the base search, it would help in understanding your metric fields and the how best to use predict in your scenario. You should also look at the x11 command as well. ... View more

This should get you started. index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB | rename h as host ... View more

Hi colinmchugo , I think you have it backwards for time conversion. Splunk uses _time to for ordering time series data. From what you've mentioned so far, the _time is incorrect and the timestamp you are looking to use is in your event data labeled as "Created" So in essence, what you are looking to use for your timestamp is "Created". With the statement you are currently using: Created=strftime(_time, "%d/%m/%Y %I:%M:%S %p") You are populating the Created field with the _time, which is the timestamp that splunk generates when the data is captured. What I believe you need to do here is: eval _time=strptime(Created, "%d/%m/%Y %I:%M:%S %p") Keep in mind however that the time range picker uses _time field that's available in the base search, no the calculated _time afterwards. The workaround is not very optimal as it has to query either all times or sufficiently large time range where you know logs you want to query exist. ... View more

so is the aws app addon installed on the heavy forwarder? also, since this is a custom log, have you configure the sourcetype properly to parse the logs as expected? it would be helpful if you posted the actual log as well as the sourcetype and if you are using props.conf and/or transforms.conf as for the sourcetype, that should be defined on the heavyforwarder as well... ... View more

actually, if you put it in quotes .... index=aws application="agent-softphone*" or index=aws application="agent-softphone-*" I would expect 1661 results ... View more

I think this splunk answer may help: https://answers.splunk.com/answers/179911/how-to-audit-config-change-events-in-splunk-i-cant.html http://docs.splunk.com/Documentation/Splunk/7.0.2/Security/AuditSplunkactivity ... View more

I think this splunk answer may help: https://answers.splunk.com/answers/179911/how-to-audit-config-change-events-in-splunk-i-cant.html ... View more

what happenes if you search for just the terms and not the full string: index=aws "application" "agent-softphone-app" ... View more

Hi, I know that author is in the rest API call.. however, It seems that you may be looking for the information from the app.conf files of the applications themselves? eg: %splunkhome%\etc\apps[appname][default or local folder]\app.conf stanza: [launcher] version = author = description = Which raises the question, are you looking for information for applications deployed to say a search head and already installed? ... View more

Ahhbone last thing. Check example 3 in the splunk mvexpand command doc http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Mvexpand ... View more

Hi edrivera3. I've experienced these types of scenarios before and man. What a doozie. You may want to try to use the mvexpand on those fields if they are already considered multivalue. In some scenarios you may need to make the field a mv field first using the makemv command and then piping out to mvexpand. Try your search| mvexpand connBlock |mvexpand stat_coord. Here a link to a similar mv solution which may help as well: https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html If this doesn't work let me know and id be happy to further assist. Happy splunking! ... View more

Hi shraddhamuduli, you may want to check out how an existing splunk user fixed his own issue with this splunk answers solution. As you can see, he was able to identify several issues with .conf file stanzas by installing the app on a splunk server first and running a reboot. https://answers.splunk.com/answers/311105/splunk-apply-shcluster-bundle-fail.html Hope this help you to potential identify any issues with your deployment... Cheers!! ... View more

Hi there iamjvn. Duane Waddle gave a great overview of Splunk's various ssl options across the entire deployment. You should check it out, as I think it may help in answering your question. https://www.duanewaddle.com/wp-content/uploads/2014/10/Splunk-SSL-Presentation.pdf https://www.duanewaddle.com/splunk-conf-2014/ Cheers! ... View more

I agree with richgalloway in that you should be indexing the data time stamp properly at ingest time by leveraging the props.conf file. But until you correct that it seems that you would want to eval _time = Created date ... View more

Could you please share the cron expression and time range for the scheduled search? ... View more

This is a hard question ion to answer as the parameters you mention should be set to accommodate data size and retention time of your data. Being that data in Splunk index buckets will start to roll from hot to warm to cold and then frozen based on both the size and /or retention time I would suggest that you understand how much data you need to capture and retain as well as how long the data should remain available in the index. You can always increase / decrease the size and retention time as needed. ... View more

Which version of Splunk are you running on? The later versions allow you to independently execute searches in each panel. This can be achieved by editing the dashboard and editing the panel search then choosing to execute the searches at a scheduled frequency. ... View more

I would suggest watching the Splunk app for aws how to videos if you haven’t yet. https://www.bing.com/videos/search?q=splunk+app+for+aws+how+to&view=detail&mid=05BBAD08771687356B0C05BBAD08771687356B0C&FORM=VRRTAP&PC=APPL ... View more

One last note, you can invest data from sql into Splunk via the dbconnect app. Or perhaps write a custom command that connects to the database to pull back information without indexing the data into Splunk. This can be done leveraging python in Splunk. ... View more

You do not have to restart Splunk when you upload a lookup. I’m curious to understand why you are restarting Splunk. ... View more

Also possibly a permissions issue? https://answers.splunk.com/answers/474713/splunk-db-connect-after-creating-a-rising-column-d.html ... View more

Are you using rising columns? ... View more

index=* | stats count AS count| eval count = count + 2 ... View more