I wouldn’t expect that to happen, no. The queues should empty prior to splunkd stopping, by way of events making their way through the remaining queues. ... View more

There may be options I’m not aware of. Considering you are asking about something I couldn’t answer you may want to un-accept my answer and see if someone else has a better answer for you. ... View more

It depends on what you would like to monitor. If you are looking to build an app for Android that sends events to Splunk look at Splunk Mint. If you want general monitoring of the device, where it sends its internal logs and/or other metrics I’m not sure anything is available to accomplish that today. ... View more

If you consider this the solution to the question asked, consider converting the comment to an answer and accepting it so that this question appears closed. ... View more

Refer to a previous answers post in regards to testing your script with the same environment that will be used when the script is run for your input. It's likely that your runtime environment looks different when you're running it manually to test and when it's run by Splunk. ... View more

mstats allows the use of the latest function, which seems like it would give you what you’re looking for. ... View more

Your [monitor] stanza needs to point to a file that exists on a filesystem present on the machine running the forwarder. If every forwarder has the same file, your monitor may look like: [monitor://C:\System32\Winevt\logs\man.evtx] disabled = false crcSalt= ignoreOlderThan = 7d index = uim_index If each server has files in different locations, you will likely have to create multiple inputs.conf variants and deploy the valid one for each forwarder. ... View more

Try this: sourcetype="index" | spath typeId | search [| makeresults | eval typeId="value1*" | return typeId] Broken down, | makeresults | eval typeId="value1*" | return typeId results in a field named search with the value typeId="value1*" . When a subsearch returns a field named search this value will be substituted into your search, in this case resulting in a query: sourcetype="index" | spath typeId | search typeId="value1*" ... View more

But filtering and grouping the lines at index time (as @somesoni2's answer aims to do) is the better option. It's also more economical in terms of license usage (by far). ... View more

Assuming the lines were already indexed as a single event, this absurd search seems to filter the lines as you've asked: | rex mode=sed "s/(= [A-Z][a-z].*)/match \1 match/g" | rex mode=sed "s/(.*executed.*)/match \1 match/g" | rex mode=sed "s/(^|([\n\r]+))(?!match).*(?!match)//g" | rex mode=sed "s/(^|([\n\r]+))match (.*) match/\3\n/g" ... View more

Can you note what makes the +++ line that you want included different from those that you don't? I could guess, but it would only be a guess. As for the other lines, this regex appears to match the ones that you want: ^= [A-Z][a-z].*$ . I haven't yet turned that into part of a search command. ... View more

Run anywhere search that shows what you want: | makeresults | eval expiration_original="12/6/2019 21:01" | eval expiration_new=strftime(strptime(expiration_original, "%m/%d/%Y %H:%M"), "%Y-%m-%d") ... View more

This is a bit difficult to validate without sample data, but here's my untested attempt: index=wineventlogs sourcetype="WinEventLog:DFS Replication" (host=host1 OR host2 OR host3) (EventCode=1202 OR EventCode=5002 OR EventCode=5008 OR EventCode=5012 OR EventCode=5014 OR EventCode=5004 OR EventCode=1206) | eval failure_time=if(EventCode=1202 OR EventCode=5002 OR EventCode=5008 OR EventCode=5012 OR EventCode=5014, _time, NULL) | where isnull(failure_time) OR failure_time<relative_time(now(), "-5min") | head 1 | search EventCode=1202 OR EventCode=5002 OR EventCode=5008 OR EventCode=5012 OR EventCode=5014 OR EventCode=5004 | rex "Message=(?<Message>.*)" | table _time,Message,ComputerName,EventCode,Error It takes into consideration @samesonei2's point about only counting "failures" that are at least 5 minutes old. It intends to find all failure and recovery events, remove failures that aren't 5 minutes old, then only show the most recent event, and further filter to only show it if it's a failure. ... View more

I'd suggest moving your search to a base search, which other panels can make use of results from, then have two other panels (always hidden) set/unset. There is probably a better way, but this at least seems to work. <dashboard> <label>Test panel showing</label> <description>Grrr why doesnt this work?</description> <search id="base"> <query>index=abc sourcetype=palo-alert message="*suspend*" | stats count as Count</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <row> <panel depends="$never$"> <single> <title>Test</title> <search base="base"> <query>where Count<=5</query> <done> <condition match="'job.resultCount' == 1"> <unset token="panel_show"></unset> </condition> </done> </search> </single> </panel> <panel depends="$never$"> <single> <title>Test</title> <search base="base"> <query>where Count>5</query> <done> <condition match="'job.resultCount' == 1"> <set token="panel_show">true</set> </condition> </done> </search> </single> </panel> <panel depends="$panel_show$"> <single> <title>Test</title> <search base="base"> <query>eval Message="There have been "+Count+" timeouts" | table Message</query> </search> <option name="drilldown">none</option> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> </dashboard> ... View more

| rex field=text (?<!\w)(?i)(?<a>id)(?!\w) That looks for the term id not surrounded by other word characters. ... View more

There is not. You would need to place this configuration on the first heavy forwarder or indexer that sees the data. ... View more

Every QB not playing for the Browns. ... View more

It doesn't seem likely that the Splunk version would cause (or remedy) the issue you were having with permissions. ... View more

Were you able to get this working in props.conf? ... View more

Were you able to solve the permission issue? ... View more

There is a Levenshtein app for Splunk. It makes use of Levenshtein distance, which sounds like it may suit your needs. ... View more