I had this issue when upgrading my python SDK of my app to version 1.3.0 (from 1.2.3). The solution was to add at the beginning of my script the following lines (as it is the case in the new examples): import sys from splunklib.searchcommands import \ dispatch, StreamingCommand, Configuration, Option, validators Hope it might help others 🙂 ... View more

You can use the firebug (http://getfirebug.com/css) extension for the firefox browser to easily find out which css class has to be modified in your application.css that is describen in the proposed link. ... View more

Thank you. ... View more

You can also use Fluentd Enterprise to bifurcate data to separate indexers. You can use message content, message type, hostname, etc. to route the messages between the indexers. https://fluentd.treasuredata.com/splunk-optimize ... View more

thanks Chris. ... View more

You might be out of luck for the _internal index it is not kept for a long time. You can run the following command and check the frozenTimePeriodInSecs (and override it if needed for the future): $SPLUNK_HOME/bin/splunk btool indexes list _internal ... View more

Depending on how you define week you could use the following 2 searches (and maybe use cphairs method to get date_week if you want to base your searches on that): This will give you a list of offenders with the number of weeks where at least 5 violations were detected and the number of weeks your search spans you could add | where count=weeks for offenders that offended every week: |bucket _time span=7d | stats count(User_name) as violations by User_name,_time | where violations>5 | stats count sum(violations) as violations by User_name | addinfo |eval weeks=round(((info_max_time-info_min_time)/86400) / 7,0) | fields user,count,weeks,violations This will produce a chart: |bucket _time span=7d | stats count(User_name) as violations by User_name,_time | where violations>5 | chart sum(violations) over _time by User_name ... View more

Sorry for delay, After bit tweaking in your last query, following worked for me: index=myIndex | eval time=execution_time/1000000.0 | table object_name,time | sort -time | streamstats count by object_name | stats list(eval(if(count<11,execution_time,null()))) as Values by object_name Thanks !! ... View more

Yeah, it helped Chris! I just had to wrap my head around how it would work out. I will convey this to my customer and hopefully, it is what they are looking for. ... View more

Hi I updated the answer. If you deploy the outputs.conf to your forwarder from the search head then thats where you have to make the change. ... View more

Thanks Chris. It worked !!! ... View more

Ok, glad you found a solution to your issue ... View more

Thanks anyway 🙂 ... View more

| dbinspect index=* | rename state as category | stats min(startEpoch) as earliestTime max(endEpoch) as latestTime sum(sizeOnDiskMB) as MB by index category | convert timeformat="%m/%d/%Y" ctime(earliestTime) as earliestTime ctime(latestTime) as latestTime ... View more

Oh, if you want to have ticketing information in Splunk it will depend on the ticketing tool and it's interfaces. If there is an interface that is exposed to the network (REST ... ) you might be able to get the information from a different machine than the ticketing server. ... View more

Was worth the mojo deduction. Thanks again! ... View more

Hi jalfrey, you can apply props stanzas to sources or sourcetypes. The source is the path to a file the sourcetype is used to classify different sources with the same format. It is a good thing to work with sourcetypes. Splunk comes with predefined sourcetypes but you can also create your own if you have home grown applications with special log formats. I posted the example with the [source::xy] stanza because I thought it's the easiest way to start. Here is more Info: http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter ... View more

I am running 4.3. The same search worked the next day, but the results were not quite what I was expecting. ... View more

Yep. This worked. Thanks! ... View more

Hi, you could use a search similar to this (the status field contains the http status code an host would contain the ip for your example): sourcetype="access_combined" | eval status_category=substr(status,0,1)+"xx" | stats count as total count(eval(status_category="4xx")) as bad_status by host | eval Percentage=100*round(bad_status/total,2) | where Percentage>10 Schedule the search to run in realtime over a window of 10 minutes and create one alert per result. If you need help creating the alert let me know. If you need help with the search -> post some example events and let me know if the source ip & status are extracted as fields (if you do not know what a field is yet I'll explain). ... View more

I would recommend checking out the multiplexer in sideview utils. ... View more

See my updated answer above ... View more

AHA! : http://splunk-base.splunk.com/answers/931/how-do-i-prevent-splunk-from-launching-a-separate-cmd-window-on-windows-7-and-others ... View more

I'm thinking the best solution is to just change the CSV format to. date,retailer,upper_tier1,price_tier1,,upper_tier2,price_tier2,upper_tier3,price_tier3 Then use a similar method as you suggested. That will allow me to use temporal lookups without worrying about changes in the number of tiers. If they add additional tiers I will just have to change my searches. Thanks again for the assist. ... View more