Hi everyone We would like to be able to find out if a certain field which occurs several times in a transaction changes its value during that transaction (e.g. the browser language changes during a session) We have a rex that grabs all the values into a mv-field. What we would like to do now is a: mvdistinctcount(mvfield) -> if the result is bigger than 1 we win. We thought that doing this would accomplish the same: ... | eval first_element=mvindex(my_WT_ul,0) | eval same_ul = mvfilter(match(my_WT_ul, first_element)) | eval lang_change=mvcount(my_WT_ul)-mvcount(same_ul) The idea here being if all the values are equal to the first value in the field we will get a list that has the same length as the original otherwise we don't But the mvfilter does not like fields in the match function if we supply a static string we are ok. This is the error message we get: Error in 'eval' command: The arguments to the 'mvfilter' function are invalid. Any ideas? Cheers Chris ... View more

Hi everyone I was wondering about what tools & techniques you use to develop dashboards. We have a Unix based search head and Windows work stations at our company. I sometimes use Eclipse with Target Management RSE (Remote System Explorer) and an integrated XML Editor to edit the xml-Files. Sometimes I just use vim to edit the files on the server directly Then to refresh I call: http(s)://mysplunk:<port>/en-US/debug/refresh?entity=/admin/views There are other URLs that will refresh dashboards or make them visible, but this one does not require the management port which is blocked by the firewall ( until we have enough reasons to request the firewall team to change this) I tell users who do not have access to the server directly to use Chrome as a webbrowser because it allows you to resize the textbox where you edit the xml. Any feedback is appreciated. Chris ... View more

I'm not sure if this is the right way to do what I want, but we are trying to build dashboards for users that look at a live tail of a log at the moment and they will do something (create a ticket, call someone) if a certain pattern (an error/warning) pops up. In the end I would like to have saved searches that will do the pattern spotting, but to show that splunk is actually capable of recognizing those patterns I thought that highlighting keywords in different colors doing a realtime search could help. On top of that it might be easier to define the exact patterns that a savedsearch will have to recognise. Right now there is still a lot of "unconscious knowledge in the air". Such as: If error x and two errors y appear within 30 seconds then action z has to be taken. But when the search is built it turns out that there also needs to be a warning y with keyword b. I'm hopin that eventually all this knwoledge that the people built up over years can be transparently moved to queries working together with those users. Thank you for your feedback. Chris ... View more

We have license violations on a couple of our LWFs allthough I think they are set up with the correct forwarding license. The peak usage on most of them is around 4 MB. Is there a possibility to anaylyze this? Will the LWFs stop forwarding data once a threshold is reached? Thanks for helping me Chris This is the output on the shell from one of the forwarders: admin@lwf /opt/splunk $ cat etc/splunk.license forwarder @splunk.com;RV75Gkp9e37JQYTcBsllG+bUSUqGmAud3KqtF48TIIBny6XkjbQjGMzNg1/ 9TkDh5pgaqgpZ8idLCEYstbBph5q2VBYWfnWJpC42dPcmfzlkQcaR7MhSbMeK6P4EjEvbE4xH6tvdbfq ukQCg7N8rY0x/4YX9bKD/jhq0ETWFm1P74wyt6ZfBSdrT/J1midPvZEWIPN6ivoyYQMVNoYJHZDIyFzZ KprYLmLmbZamBrgYsm6rV+JrmUS0l/ltU0DWhaiLVdcF3iUWthgUlSZebGSSn7Wh+efs3XhD3kerwCGs Nr1dv+P4rmD7rcWhTvWexuh0u2/985QihMnZgwYwUNg== admin@lwf /opt/splunk $ bin/splunk show license Current Daily Usage Amount: 0 Expiration date: 2011-03-08T07:07:37+0100 Expiration State: ok License level: 1 MB Product: Enterprise License violations: 2010-11-11T00:02:42+0100 License violation #12 2010-11-08T00:00:05+0100 License violation #11 2010-11-05T00:00:03+0100 License violation #10 2010-11-02T00:05:00+0100 License violation #9 2010-10-31T00:04:58+0200 License violation #8 2010-10-28T00:04:55+0200 License violation #7 2010-10-25T00:04:54+0200 License violation #6 2010-10-23T00:04:53+0200 License violation #5 2010-10-20T00:04:45+0200 License violation #4 2010-10-17T00:04:41+0200 License violation #3 2010-10-14T00:04:38+0200 License violation #2 2010-06-09T00:02:52+0200 License violation #1 Max Violations: Peak usage: 4 MB Days remaining: 116 day(s) Violation Period: admin@lwf /opt/splunk $ bin/splunk display local-index Local indexing is disabled. ... View more