awesome 🙂 ... View more

Hi @RashmiGowda If @gpradeepkumarreddy's answer solved your question, don't forget to resolve the post by clicking "Accept" directly below his answer and upvote it by clicking the up arrow to the left of the answer. Thanks! Patrick ... View more

The following cron time spec would cover Saturday and Sunday 06:00-16:59: * 6-16 * * 0,6 ... View more

martin_mueller - thank you, The data is in the xml format. it will contain the start time, end time and other user data with success and failure. ... View more

You can configure this when you install the forwarder on the remote machine. There is a setting GUI during the install that allows you to select which event logs to monitor. Settings for monitoring the event logs can be found in on the forwarder in the splunk\etc\apps*\local\inputs.conf files. Some will be turned on, and others will be turned off. You can turn them on or off by changing the "disabled" parameter value to 1 (off) or 0 (on). If you make changes to inputs.conf you will need to restart the splunkd service on the forwarder for the changes to take affect. ... View more

Sorry.. Its working.. I just missed to add sub search thing.. @martin_muller ... View more

try add following at the end of your search. your report search so far | fields - _time | table Date, Time, * ... View more

You can work on it like this - your base search | eval basavalue="2014-03-20 13:43:55.608" | rex field=basavalue "(?<a_1>\d\d\d\d)-(?<a_2>\d\d)" ... View more

So, is it correct to say that the RequestID is unique per transaction but the TransactionID is not? Is the UniqueID you mention something that actually exists in the events or something you need to create on-the-fly? Is there something in either one or both of the log types that always indicates the beginning and end of the transaction? Is it possible for you to share a snippet of each of the log sources? Even if it is scrubbed, it might be easier to troubleshoot with an example of the data at this point. ... View more