Might sound silly to ask but... Have you enabled the alert you want to see? ... View more

Try this: index=my_index "Handle State structures to abandoned" | eval month=strftime(_time,"%m") | stats values(source) AS source by month | mvexpand source | eval status = "keep" | append [search index=my_index "KERNEL RECYCLING" | eval month=strftime(_time,"%m") | stats values(source) AS source by month | mvexpand source | eval status = "remove" ] | stats values(month) AS month values(status) AS status by source | search status!=remove | mvexpand month | stats count AS sources by month ... View more

splitted by source? ... View more

What do you mean in it's source file? You want to check files that don't contain KERNEL RECYCLING rather than checking individual events? ... View more

boolean operators work for events with different timestamps. in your search use quotes around the string instead of ( ) "Handle State structures to abandoned" NOT "KERNEL RECYCLING" ... View more

can you show an example of the csv file? ... View more

I wrote source=my_file only as an example. You can use whatever fits your search query (e.g. index=my_index, host=my_host, etc ). It doesn't matter if you're doing a real-time search. About the Error OR issue, this will show you all the events (different timestamps) that contains one of the strings or both in the same event. ... View more

if you use OR you can search for both. source=my_file Error OR issue ... View more

the ^ in your regex means you're looking for level=notice at the beginning of the string. In your case you have timestamp. Remove the ^ You can test you regex here: https://regex101.com ... View more

i believe that 256 is the default. (http://docs.splunk.com/Documentation/Splunk/6.2.5/Forwarding/Introducingtheuniversalforwarder) have you tried with other value? ... View more

which browser are you using? ... View more

The change you're making on serverA deploymentclient.conf it will only affect serverA. The repositoryLocation its just says when serverA receives apps from a deployment server put them in this folder ($SPLUNK_HOME/etc/deployment-apps) rather than the default one ($SPLUNK_HOME/etc/apps). For the changes needed to make serverA a client of searchhead i edited my answer. Also check the link i provided as it has a lot of information about deployment server configs. ... View more

You can set that like you would for a tiered deployment server. For the apps you can set serverA as a client of the searchhead to receive all the apps. On the ServerA deploymentclient.conf you put: repositoryLocation = $SPLUNK_HOME/etc/deployment-apps This will force the deployed apps to be place on ServerA deployment-apps rather then apps folder. Then you set serverA as a client of searchhead like you would for any other client. On serverA CLI run: ./splunk set deploy-poll [searchhead_ip]:8089 As for the other clients do you have a app for deployment configs? If so its just a mater of changing that. If not i'm afraid you'll need to change that on every client. More on this: http://wiki.splunk.com/Deploy:DeploymentServer (check last example) ... View more

you need to build the extraction for that. A quick way is to use the extract fields in the event actions. Check these splunk docs: http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/ExtractfieldsinteractivelywithIFX ... View more

The poll will always be initiated by the client, so restarting the client would probably be the solution. To force a deploy you can use: ./splunk reload deploy-server But then again this would only push new configs/apps when the client polls the deployment server. I was wondering why use 1 hour interval? For what I read one deployment server with the default times can handle about 300 clients. Even if you have more than 300 I don't think you need to raise the interval to 1 hour. If you have a huge amount of clients have you considered using multiple deployment server? Or a tiered solution? ... View more

Why not use something like? index=kpis | timechart span=1mon count(Event) ... View more

Just |timechart duration or |table _ time duration and you get a chart with all durations over time ... View more

Might not be the most performant command but, assuming the files have different names and you have that position field you can try: | transaction source startswith="position=begin" endswith="position=finished" This will create a duration field. ... View more

I had a situation where i needed to do something like that. the solution i found, since user roles can define access to certain indexes was to split the data in to more than 1 index. My contained audit data mixed with other data. The other data was available to everyone but the audit data should only be available to a certain group. So i created 2 indexes: my_index my_index_audit So when searching i used: index=my_index* For users that have permissions to look in both indexes this will get them the all the data. For the remaining users this will return only results my_index data. To split the data, just use transforms to forward data one way or another depending on the rules you set. In your case the category. props.conf [your_sourcetype] TRANSFORMS-splitdata=split1,split2 transforms.conf [split1] SOURCE_KEY=field:category REGEX=^ABC DEST_KEY=_MetaData:Index FORMAT=my_index_abc [split2] SOURCE_KEY=field:category REGEX=^DEF DEST_KEY=_MetaData:Index FORMAT=my_index_def There is also another benefit for splinting the data this way: data retention periods. With different indexes you can define different retention periods. In my case audit data needed to be available for 5 years but the other data just for 6 months. This may not be the best solution if you want to manage data visibility for a big number of roles since you'd end up with a big number of indexes, but for a small number of roles its a simple solution that works. ... View more

If it's just a few values you want to add, give this app a shot. It allows you to edit the lookup from splunk web. https://splunkbase.splunk.com/app/1724/ ... View more

Hey Damien That's a possible solution/workaround. The main point, and i sorry for not pointing that out in the OP, is: i'm building an app for snmp monitoring and i'm also trying to build a view where the user can insert new hosts without having to edit files since most of the data/inputs will be the same for all host. There are alot of data i want to use and using your modular input i'm not being able to retrieve multiple OIDs in a single input. So i need to have multiple inputs and that might not be easy to manage if you have with hundreds of devices. ... View more

Ok then just replace then csv or edit and save. You don't need to change de lookup definitions if you keep the same field names. ... View more