About harshavrath

somesoni2 · ‎05-14-2014

For visualization you need numeric data for y axis, here the time is string.

harshavrath · ‎05-13-2014

Hi David, According to your link http://docs.splunk.com/Documentation/Splunk/6.0.3/Indexer/Moveanindex#For_Windows_users In Step-4 Copying the Indexes to new path it is given as copy "C:\Program Files\Splunk\var\lib\splunk\." D:\new\path\for\index /s /e /v /o /k But in my Splunk Instance the var\\lib has occupied very less space but my var\\log\\splunk has occupied 1.52GB.

richgalloway · ‎05-02-2014

You showed your query previously. Now we need to see sample events.

dmaislin_splunk · ‎04-23-2014

http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/Outputlookup

dmaislin_splunk · ‎04-22-2014

Then you can schedule the index of the database information like you asked about in your other post, http://answers.splunk.com/answers/132502/automate-indexing, and then run a scheduled search against that to automatically create a lookup table using the Splunk command outputlookup. Then you can configure the local lookup table per the_wolverine's approach below.

harshavrath · ‎04-16-2014

its working thanks, the state.xml file under global was corrupted so i just copied the state.xml from my other db-entries.

linu1988 · ‎04-15-2014

you wont be able to get in normal sql query. you need to do it splunk query. What is the database you are using?

harshavrath · ‎04-14-2014

thanks for the info rje.

jsilverbears · ‎04-01-2016

I am seeing this too. You can use the FROM_UNIXTIME(o.date) to get the UTC readable version of the int. If you want to convert that to your timezone, I am not sure how to do that when just pulling the data in with MySQL since DB Connnect 2, the one I am using will not allow a query with CONVERT_TZ to actually be used and return results (this is true at the time I am typing this an may be corrected later). You can however do that after the fact in the Splunk queries. You probably have already figured this out but I thought it may be helpful for anyone else seeing this.

linu1988 · ‎04-10-2014

yes because ,thats no longer a date field. but a good trick

harshavrath · ‎04-10-2014

Thanks a lot Aelliott.

harshavrath · ‎04-01-2014

its working,thanks.

aelliott · ‎03-27-2014

they don't match what's in the database? If so you may want to have a separate post since we got the query running 🙂

harshavrath · ‎04-14-2014

Simple Select stmt will work under DB-Query.

richgalloway · ‎08-11-2017

You're responding to a three-year-old question that already has an accepted answer. Please post a new question.

wcolgate_splunk · ‎04-29-2014

In order to collect WMI data from the remote machine, the user connecting must have rights on the remote machine. I'm confident that you will need to install splunk as a specific user and then give that user WMI rights on the collection target. In addition, 6.0.x and prior, your specific user will also have to be a member of the local admin group on the machine splunk is installed on.

sroback_splunk · ‎03-18-2014

Hi. You should be able to connect Splunk DB Connect to your Oracle db. Here are the basic steps for setting up DB Connect: Install the DB Connect App. (you already have the app installed, so ignore this step) Install the JDBC drivers for Oracle. For instructions on downloading and installing the JDBC driver, see: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Installdrivers Setup your connection to the database. See:http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Addadatabaseconnection Once you have your database connection established, you can run queries against the database, and setup database inputs and outputs that let you add and index your database data in Splunk. Hope this helps.

strive · ‎04-14-2014

Yes the indexing volume is perDay basis. You can index 400MB today and 400MB tomorrow,

Matthias_BY · ‎03-17-2014

from their you can start then to create reports + alerts. so in case similar error messages or behavior occurs (more/less events, streamstats, stats, eval statements!) you want to get a notification. however - IIS does not crash because there is the default default website of microsoft. IIS crashes because the application or website on it has some issues - so that is the good way why with splunk you're flexible to create such a monitoring instead as no vendor will now your IIS application 😉 br

lpolo · ‎03-14-2014

This might be a start point: http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs#Add_a_scripted_input_via_inputs.conf

Posts	152
Solutions	1
Karma Given	68
Karma Received	3
Member Since	‎02-19-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Space Issues In my C-drive

How to output matching fields

Automate Indexing

lookup doubts

The Java Bridge server is not running

Indexed Data

EPOCH CONVERSION IN ORACLE QUERY

Splunk DBConnect Add Databse Inputs Unable to inde...

Splunk DBConnect Date Error

dbquery Syntax Error

Re: plotting date versus time chart

Re: Space Issues In my C-drive

Re: How to output matching fields

Re: Automate Indexing

Re: lookup doubts

Re: The Java Bridge server is not running

Re: Time format

Re: Indexed Data

Re: DB Connect Convert Epoch to DateTime

Re: EPOCH CONVERSION IN ORACLE QUERY

Re: Splunk DBConnect Add Databse Inputs Unable to ...

Re: Splunk DBConnect Date Error

Re: dbquery Syntax Error

Re: command="dbquery", A database error occurred: ...

Re: JVM Commandline options

Re: Getting Error When trying to read windows eve...

Re: Splunk DB Connect

Re: Daily indexing volume limit exceeded today. Se...

Re: Splunk Server

Re: Database to file