If you're running the latest version, some of that info is on the Index Activity dashboard, and you can use that search as a start. Change out the calc for measuring max, min, avg, etc EG: timechart avg(kbps) by series timechart max(kbps) by series kbps by sourcetype: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | timechart avg(kbps) by series eps by sourcetype: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | timechart avg(eps) by series If you wanted host or source, use group="per_source_thruput" or group="per_host_thruput" instead. ah, one more suggestion... If you don't want to chart the results in a timeseries, you can swap out the timechart command with the stats command which may be a better fit for the solution you are looking for: EG: index="_internal" source=*metrics.log group="per_sourcetype_thruput" | stats avg(eps) by series ... View more

I would simply install the older version of Splunk on the new server, copy over the entire Splunk directory to the new server and then perform an in place upgrade. ... View more

Are you gathering cpu utilization through events, scripts, logs or metric store? If you gave an example of the base search, it would help in understanding your metric fields and the how best to use predict in your scenario. You should also look at the x11 command as well. ... View more

This should get you started. index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB | rename h as host ... View more

Hi colinmchugo , I think you have it backwards for time conversion. Splunk uses _time to for ordering time series data. From what you've mentioned so far, the _time is incorrect and the timestamp you are looking to use is in your event data labeled as "Created" So in essence, what you are looking to use for your timestamp is "Created". With the statement you are currently using: Created=strftime(_time, "%d/%m/%Y %I:%M:%S %p") You are populating the Created field with the _time, which is the timestamp that splunk generates when the data is captured. What I believe you need to do here is: eval _time=strptime(Created, "%d/%m/%Y %I:%M:%S %p") Keep in mind however that the time range picker uses _time field that's available in the base search, no the calculated _time afterwards. The workaround is not very optimal as it has to query either all times or sufficiently large time range where you know logs you want to query exist. ... View more

so is the aws app addon installed on the heavy forwarder? also, since this is a custom log, have you configure the sourcetype properly to parse the logs as expected? it would be helpful if you posted the actual log as well as the sourcetype and if you are using props.conf and/or transforms.conf as for the sourcetype, that should be defined on the heavyforwarder as well... ... View more

actually, if you put it in quotes .... index=aws application="agent-softphone*" or index=aws application="agent-softphone-*" I would expect 1661 results ... View more

I think this splunk answer may help: https://answers.splunk.com/answers/179911/how-to-audit-config-change-events-in-splunk-i-cant.html http://docs.splunk.com/Documentation/Splunk/7.0.2/Security/AuditSplunkactivity ... View more

I think this splunk answer may help: https://answers.splunk.com/answers/179911/how-to-audit-config-change-events-in-splunk-i-cant.html ... View more

what happenes if you search for just the terms and not the full string: index=aws "application" "agent-softphone-app" ... View more

Hi, I know that author is in the rest API call.. however, It seems that you may be looking for the information from the app.conf files of the applications themselves? eg: %splunkhome%\etc\apps[appname][default or local folder]\app.conf stanza: [launcher] version = author = description = Which raises the question, are you looking for information for applications deployed to say a search head and already installed? ... View more

Ahhbone last thing. Check example 3 in the splunk mvexpand command doc http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Mvexpand ... View more

Hi edrivera3. I've experienced these types of scenarios before and man. What a doozie. You may want to try to use the mvexpand on those fields if they are already considered multivalue. In some scenarios you may need to make the field a mv field first using the makemv command and then piping out to mvexpand. Try your search| mvexpand connBlock |mvexpand stat_coord. Here a link to a similar mv solution which may help as well: https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html If this doesn't work let me know and id be happy to further assist. Happy splunking! ... View more

Hi shraddhamuduli, you may want to check out how an existing splunk user fixed his own issue with this splunk answers solution. As you can see, he was able to identify several issues with .conf file stanzas by installing the app on a splunk server first and running a reboot. https://answers.splunk.com/answers/311105/splunk-apply-shcluster-bundle-fail.html Hope this help you to potential identify any issues with your deployment... Cheers!! ... View more

Hi there iamjvn. Duane Waddle gave a great overview of Splunk's various ssl options across the entire deployment. You should check it out, as I think it may help in answering your question. https://www.duanewaddle.com/wp-content/uploads/2014/10/Splunk-SSL-Presentation.pdf https://www.duanewaddle.com/splunk-conf-2014/ Cheers! ... View more

I agree with richgalloway in that you should be indexing the data time stamp properly at ingest time by leveraging the props.conf file. But until you correct that it seems that you would want to eval _time = Created date ... View more

Could you please share the cron expression and time range for the scheduled search? ... View more

This is a hard question ion to answer as the parameters you mention should be set to accommodate data size and retention time of your data. Being that data in Splunk index buckets will start to roll from hot to warm to cold and then frozen based on both the size and /or retention time I would suggest that you understand how much data you need to capture and retain as well as how long the data should remain available in the index. You can always increase / decrease the size and retention time as needed. ... View more

Which version of Splunk are you running on? The later versions allow you to independently execute searches in each panel. This can be achieved by editing the dashboard and editing the panel search then choosing to execute the searches at a scheduled frequency. ... View more

I would suggest watching the Splunk app for aws how to videos if you haven’t yet. https://www.bing.com/videos/search?q=splunk+app+for+aws+how+to&view=detail&mid=05BBAD08771687356B0C05BBAD08771687356B0C&FORM=VRRTAP&PC=APPL ... View more

One last note, you can invest data from sql into Splunk via the dbconnect app. Or perhaps write a custom command that connects to the database to pull back information without indexing the data into Splunk. This can be done leveraging python in Splunk. ... View more

You do not have to restart Splunk when you upload a lookup. I’m curious to understand why you are restarting Splunk. ... View more

Also possibly a permissions issue? https://answers.splunk.com/answers/474713/splunk-db-connect-after-creating-a-rising-column-d.html ... View more

Are you using rising columns? ... View more

I would start by leveraging some of the free apps that are already available in splunk, like: EG: Splunk Add on Builder: This app helps you to connect to various source data via Splunk's GUI. Splunk App for AWS Google Apps for Splunk Go to Splunkbase and see if there is an existing app available: https://splunkbase.splunk.com/ If so, install it on a splunk dev instance and see if you can leverage the prebuilt app to meet your needs... You can always navigate to the splunkhome\etc\apps\your installed app folder to see how the app is built an leverage any scripts, inputs, etc already created in the app to help in building your own. As for the courses, I would get the basic understanding of what an API is and how to connect to it to get data back down first. Here's some material on how to get data out of googles API using python. https://developers.google.com/sheets/api/quickstart/python ... View more