I figured it out. The solution is to add a section and stanza in the inputs.conf file on UF-end. [WinEventLogs: Kaspersky Event Logs] disabled = 0 start_from = oldest Then, restart the SplunkForwarder Service. ... View more

A few more questions/comments to help pinpoint where things are going wrong: Is it a local user or domain user? Does the service start fine when you manually try it after a reboot? Set it to autostart(delayed) instead of just autostart and see if it works then. Try is to set it temporarily to use the local SYSTEM login and see if that works. Note that if you set it to autostart(delayed) it can take several minutes to actually start, so don't be in a hurry. after You can start by reading splunkd.log files on your forwarders, it's can be found at $SPLUNK_HOME$/var/log/splunk folder. This log use be very helpful. I figured it out. The solution is to add a section and stanza in the inputs.conf file on UF-end. [WinEventLogs: Kaspersky Event Logs] disabled = 0 start_from = oldest Then, restart the SplunkForwarder Service. ... View more

see what Mr aljohnson_splunk do, just renam like: ... | stats earliest(Name) as original_name by ID ... View more

first see this link : http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/WhatSplunkCanMonitor to inputs.conf configurations in splunk to monitor logs from network devices in particular ... View more

to Add Data in splunk or to inputs.conf configurations in splunk to monitor logs from network devices in particular, see this ex: /opt/splunk/bin/splunk add monitor /path/to/app/logs/ -index your_index_name -sourcetype %app% Where /path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk, and %app% is the name you want to associate with that type of data This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/ -- here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Inputsconf ... View more

I have already experience this problem on Windows 8 with 64bit Splunk6.2.0 and I have download another version of splunk (Splunk6.2.2 -64bit) and working properly. so this is why I propose you download another version of splunk as Splunk-6.2.2-... or splunk-6.2.3-264376-x64-release.msi go this link to download: http://www.splunk.com/en_us/download/splunk-enterprise.html tek this: splunk-6.2.3-264376-x64-release.msi ... View more

see this two link it can help you: 1-) http://answers.splunk.com/answers/4309/ 2-) http://answers.splunk.com/answers/50082/ to Add Data in splunk or to inputs.conf configurations in splunk to monitor logs from network devices in particular, see this link: http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/WhatSplunkCanMonitor see this ex: /opt/splunk/bin/splunk add monitor /path/to/app/logs/ -index your_index_name -sourcetype %app% Where /path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk, and %app% is the name you want to associate with that type of data This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/ -- here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Inputsconf ... View more

try like : tag=authentication user!=NULL | chart count(eval(tag="success")) as "count tag succes", count(eval(tag!="success")) as "count tag faillures" by user limit=8 useother="f" usenull="f" ... View more

i happy for you. ... View more

Hello I think you are looking for this: earliest=-1d@d+1h latest=-1d@d+2h try like : Sourcetype=bcoat_proxysg “key value pair that indicates filesharing activity” earliest=-24h latest=now|table _time “bluecoat host IP by field extraction name” “status code” “URL_String field extraction” “Categories Field Extraction” ... View more

i don't solve ... View more

in limits.conf file, try like this : [restapi] # maximum result rows to be returned by /events or /results getters from REST API maxresultrows = 60000 Increase that value to the desired maximum number of events, This configuration option should affect the number of results exported for a table. ... View more

try with fields command to remove this fields before use it, like this: index=dataA OR index=dataB | ...|fields -source_name_fields, host, ip, .... ... View more

hello Mr shellnight covert your answer in text comment. to do it covert your answer in comment. and to search where the count is higher than 50 for cpu utlization try this: your search producing |table *| where count >50 ... View more

you said that: "The data i have is just 2 fields . Machine name and its problem" i call Machine name field ----->>> Machine_name and problem field ----->>> machine_problem then try like: your search producing | stats list(eval(machine_problem!="cpu utlization 15%")) as list_of_machine_problem by Machine_name ... View more

see this link: http://answers.splunk.com/answers/223066/how-to-search-and-mark-the-locations-on-google-map.html#answer-221936 ... View more

see this link: http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/DeployaWindowsdfmanually ... View more

try like this: ...| eventstats count as total| bucket _time span=1000ms | stats count by "EntsBWElapTime" |eval Percent=(count/total)*100 +"%" or ...| eventstats count as total | timechart span=1000ms count by EntsBWElapTime |eval Percent=(count/total)*100 +"%" ... View more

if "Bandwidth" is an field, try like : index=storage_arrays sourcetype=qos dev_name=$device$ qos_class=$class$ | eval qos_unit=if(qos_metric == Bandwidth, qos_bandwidth, qos_thruput) | chart avg(qos_unit) as "QoS" avg(qos_metric_value) as Limit over _time by qos_class | eval _span=4 or if "Bandwidth" is an string , the you querry is verry OK . ... View more

try like this: |rest /services/alerts/fired_alerts or |rest /servicesNS/admin/search/alerts/fired_alerts/- ... View more

in your inputs.conf, try this: [monitor://your_path_gzip_stored_on_windows_server/.../*.log.gz] sourcetype=your_sourcetype_name index=your_index_name ... View more