hi, I want to know how perfmon.cof is working.Since i want to use that for monitoring CPU utilization.I want to know is that feasible to use perfmon for this. This is my perfmon.conf and i have run this query in search index="os" but it didnt return any result.So please tell me wether any other configration i need to do to make this work.Since i could not find anything in doc. perfmon.cof [PERFMON:LocalPhysicalDisk] interval = 0 object = PhysicalDisk counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time instances = * disabled = 0 index = PerfMon [PERFMON:LocalMainMemory] interval = 5 object = Memory counters = Committed Bytes; Available Bytes; % Committed Bytes In Use disabled = 0 index = os [PERFMON:USBChanges] interval = 10 object = USB counters = Usb Control Data Bytes/Sec instances = * disabled = 0 Thanks, ... View more

Hi, I want to get information about CPU utilization by splunk server.Is there any query for this or i need to write any external script for this.So that splunk can index that file and show it in dashboard.Please guide me. Thanks, ... View more

Hi, Iam using external python script to write resultset to a csv file.Splunk reading columns in alphabetical order.In my case i want to see a particular filed as first column in table.How i can make it. eg MyResult.csv s,b,k,a,h this is the order of fields how my script writing resultset to the csv file Splunk Reading like this order(alphabetical order): a,b,h,k,s I want splunk to read the same order how my script writing data ie(s,b,k,a,h ).Please guide me how to do this. ... View more

Hi, I want to get the value which user clicks from drilldown.But iam not able to get that value iam getting the first value of the row which user clicked drilldown * False 1 <![CDATA[ |search source="C:\newlogs....." |rex field=_raw "(? \w+Exception)" |dedup Exception|table Exception,id ]]> 100 True true row click1 <![CDATA[ |search source="C:\newlogs......" $exception$ |stats count ]]> stringreplace $click1.value2$ indexed <module name="JobProgressIndicator"></module> <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">Detail on $click1.value2$</param> </module> <module name="SimpleResultsTable"> <param name="count">100</param> <param name="displayMenu">True</param> <param name="displayRowNumbers">true</param> <param name="drilldown">row</param> <param name="drilldownPrefix">click2</param> </module> </module> I have used "click.value2" for getting value from drilldown which user clicked but its still returning the value of first coulmn of first row. Please help ... View more

hi, I want to pass value form driilldown to another view but its not working .Drill down redirecting to another view but in that view iam not able to get that value iam getting null value in that view. What could be the issue .Please help this is what i have tried My table looks like this: value id _time abc 1 ... hij 2 lll 3 000 4 1st view <module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="True"> <param name="search"><![CDATA[|search source="C:\\.\\..." |rex field=_raw "Id\s(?<Value>.*)\:\s"|table value,_time]]></param> <module name="Paginator"> <param name="entityName">events</param> <param name="maxPages">10</param> <param name="count">5</param> <module name="ResultsHeader"> <param name="entityName">scanned</param> <param name="entityLabel">Events</param> <module name="SimpleResultsTable"> <param name="count">100</param> <param name="displayMenu">True</param> <param name="drilldown">row</param> <param name="drilldownPrefix">click</param> <module name="ConvertToIntention"> <param name="settingToConvert">errors_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="errors"> <param name="value">$click.value$</param> </param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">Sample_View</param> </module> </module> </module> </module> </module> </module> Sample_View <view autoCancelInterval="90" template="dashboard.html"> <label>kl Dashboard</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="HiddenSearch" layoutPanel="panel_row1_col1"> <param name="search"> <![CDATA[|search source="C:\\...." $click.value$| stats count as "Count" ]]> </param> <module name="SingleValue"> <param name="field">Count</param> <param name="afterLabel"> error</param> </module> </module> </view> iam trying to get the value which is coming under value and have written a serch on that in another view. ... View more

hi, Logs is the foldername which I am having two types of files which having same format of data.Since splunk not breaking lines on date I am using line breaking and its not working since its working fine in priview b4 indexing here is my props.cofig and input.cofig this is the content of file iam working on. 18 Apr........... <xml........> <.......> 18 Apr.......... ......... ........... Input.confg [monitor://C:\newlogs\Logs\kllogs] disabled = false followTail = 0 crcSalt = <SOURCE> Props [source::C:\\newlogs\\Logs\\*\\Server.log.*] sourcetype=server [server] SHOULD_LINEMERGE=true BREAK_ONLY_BEFORE_DATE=false BREAK_ONLY_BEFORE=\d\d\s\w+\s MAX_EVENTS=200000 [source::C:\\newlogs\\Logs\\*\\Database.log.*] sourcetype=data [data] SHOULD_LINEMERGE=true BREAK_ONLY_BEFORE_DATE=false BREAK_ONLY_BEFORE=\d\d\s\w+\s MAX_EVENTS=200000 I have set soucetype as automatic while indexing files.Iam not able to find out what is the issue.Please help.. ... View more

hi, A1.abc-ab.1000.11111 A1.ab.1000.11111 This is the format of data what iam trying to extract using regex.Since both the datas are values of same instance i want to exctract these both values using 1 regex so as to compare it with other values ... | rex field=_raw "(?<value>(\w\d\.\w+\-\w+\.\d{4}\-\d{8})|(\w\d\.\w+\.\d{4}\.d{7}))"| table value this is what i have tried but it is fetching only the data matching with the first bracket ie A1.abc-ab.1000.11111 .Please help ... View more

Hi, I want to run search queries depend on user input,ie what user selecting from dropdown. eg:if user choose 1 from dropdown run a search 2 from dropdown run another search is this possible iam looking sumthing like this if(1) run 1st search if(2) run 2nd search please help. ... View more