I was hoping to find some fancy app-addon that gives me all the basic windows 10 monitoring stats, cpu, disk, network etc.   Looking at https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/MonitorWindowsperformance it gets all the data but I need to do the harder work and build all the dashboards manually. Then looking at https://splunkbase.splunk.com/app/742/ it seems to not have dashboards either just adds a bunch of inputs to also get the data in! I gotta be missing something here - there must be an app with dashboards etc that shows me this data?? ... View more

I'm trying to list out all dates between my time picker and have that as a column in my table. I do both things individually but just not together 🙂 index="myindex" | rex "jobID (?<jobid>\d+)" | rex "dayID (?<dayid>\d+)" | eval daydt=strptime(dayid, "%Y%m%d") | eval daydt=strftime(daydt,"%Y-%m-%d") | transaction jobid dayid endswith="data consumed for jobID" |eval duration=tostring(duration,"duration") | eval status=if(closed_txn=="0","Complete","Incomplete") | appendpipe [ |gentimes start=-1|addinfo|eval date=strftime(mvrange(info_min_time,info_max_time,"1d"),"%F")|mvexpand date ] | sort -date | table date closed_txn daydt _time duration   Can someone tell me whats wrong here? ... View more

I just setup dbConnect 3.4.0 and setup my mysql connection. The logs are throwing this error     2020-09-24 18:37:44.357 +0000 [QuartzScheduler_Worker-14] ERROR org.easybatch.core.job.BatchJob - Unable to write records java.io.IOException: Failed to post to https://127.0.0.1:8088/services/collector/event, HTTP Error 403, HEC response body: {"text":"Invalid token","code":4}, trace: HttpResponseProxy{HTTP/1.1 403 Forbidden [Date: Thu, 24 Sep 2020 18:37:44 GMT, Content-Type: application/json; charset=UTF-8, X-Content-Type-Options: nosniff, Content-Length: 33, Vary: Authorization, Connection: Keep-Alive, X-Frame-Options: SAMEORIGIN, Server: Splunkd] ResponseEntityProxy{[Content-Type: application/json; charset=UTF-8,Content-Length: 33,Chunked: false]}}      I checked the HEC settings and there is a db-connect-http-input with a valid token, that same token also exists in /etc/apps/splunk_app_db_connect/local/inputs.conf Whats the issue here??? ... View more

is it just me or is this new'ish splunk answers community not as 'active' as the old version? ... View more

Can we please bring back message view counts? - looking at the forums no one (hardly) is using the thumbs up icon that just takes up space. Knowing how many views a message gets is far more important IMO ... View more

I'm trying to move from using a transaction command to a streamstats - I get most of the way there but I can't figure out the 'reset' with streamstats to proper group starts and ends together. Here's my current query which isn't finding the right end time since my BY query will match multiple places and the latest(_time) will change to the wrong latest time but yet the actual latest time ...       index="logfiles" appType=reports* "Generating * Status Report" | rex \.(?<reportName>Generate\w*) | eval reportName=replace (reportName,"Generate","") | eval reportName=replace (reportName,"Report","") | streamstats earliest(_time) as stime by reportName appType | join appType,reportName [search index="logfiles" appType=reports* "Report generated successfully" | rex \.(?<reportName>\w+)ReportGenerator | streamstats reset_on_change=true reset_after="("searchmatch(\"Report generated successfully\")")" latest(_time) as etime BY reportName appType] | eval diff=etime-stime | eval hhmmss=tostring(diff, "duration") | convert timeformat=" %a %b %d %I:%M:%S.%3N %p %Z" ctime(stime) as StartTime | table StartTime appType reportName hhmmss |rename hhmmss as RunDuration       ... View more

Is there a way to get detailed logs from the Website Monitoring app that will tell me what IP it was routed to when running its tests?   @LukeMurphey?? ... View more

I have my search that currently returns: name | HH:MM:SS | Val in Seconds Now I can get my single val stat to display the HH:MM:SS but that doesn't help me when it comes to wanting to range/color the values - is there a way to have the colorize use the val in seconds while the actual single val stat uses the HH:MM:SS to display?? ... View more

TailReader - Insufficient permissions - errors in my logs - will splunk attempt to re-read those at some interval? thus far I only see it doing it once a few hours back and not since 😞 I also see several databaseDirectory events in the splunkd log that relates to the index that these logs should of went to so I'm not sure whats going on, perhaps just a delay? 00 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/kinesis/db 06-04-2020 19:43:49.481 +0000 INFO HotBucketRoller - finished moving hot to warm bid=kinesis~20~BC057F8A-75D0-4CDC-9BD0-EA5E0076B4AF idx=kinesis from=hot_v1_20 to=db_1590613020_1589312100_20 size=956243968 caller=size_exceeded _maxHotBucketSize=786432000 (750MB), bucketSize=1015918592 (968MB) 06-04-2020 19:43:49.483 +0000 INFO IndexWriter - Creating hot bucket=hot_v1_21, idx=kinesis, event timestamp=1590429480, reason="suitable bucket not found, number of hot buckets=1, max=3; closest bucket localid=0, earliest=1577836800, latest=1577836800" 06-04-2020 19:43:49.484 +0000 INFO DatabaseDirectoryManager - idx=kinesis Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/kinesis/db', pendingBucketUpdates=0 . Reason='Adding bucket, bid=kinesis~21~BC057F8A-75D0-4CDC-9BD0-EA5E0076B4AF' 06-04-2020 19:43:49.485 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/kinesis/db 06-04-2020 19:44:15.461 +0000 INFO DatabaseDirectoryManager - idx=kinesis Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/kinesis/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).' 06-04-2020 19:44:15.463 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/kinesis/db 06-04-2020 19:44:16.399 +0000 INFO IndexerIf - Asked to add or update bucket manifest values, bid=kinesis~20~BC057F8A-75D0-4CDC-9BD0-EA5E0076B4AF 06-04-2020 19:44:16.454 +0000 INFO DatabaseDirectoryManager - idx=kinesis Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/kinesis/db', pendingBucketUpdates=1 . Reason='Updating manifest: bucketUpdates=1' 06-04-2020 19:44:16.458 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/kinesis/db 06-04-2020 20:22:02.413 +0000 INFO DatabaseDirectoryManager - idx=kinesis Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/kinesis/db', pendingBucketUpdates=0 . Reason='Updating bucket, bid=kinesis~21~BC057F8A-75D0-4CDC-9BD0-EA5E0076B4AF' 06-04-2020 20:22:02.415 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/kinesis/db 06-04-2020 20:22:02.417 +0000 INFO DatabaseDirectoryManager - idx=kinesis Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/kinesis/db', pendingBucketUpdates=0 . Reason='Updating bucket, bid=kinesis~21~BC057F8A-75D0-4CDC-9BD0-EA5E0076B4AF' 06-04-2020 20:22:02.418 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/kinesis/db 06-04-2020 20:22:02.419 +0000 INFO HotBucketRoller - finished moving hot to warm bid=kinesis~21~BC057F8A-75D0-4CDC-9BD0-EA5E0076B4AF idx=kinesis from=hot_v1_21 to=db_1590613020_1589312100_21 size=789688320 caller=size_exceeded _maxHotBucketSize=786432000 (750MB), bucketSize=789729280 (753MB) 06-04-2020 20:22:14.438 +0000 INFO IndexWriter - Creating hot bucket=hot_v1_22, idx=kinesis, event timestamp=1590605700, reason="suitable bucket not found, number of hot buckets=1, max=3; closest bucket localid=0, earliest=1577836800, latest=1577836800" 06-04-2020 20:22:14.439 +0000 INFO DatabaseDirectoryManager - idx=kinesis Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/kinesis/db', pendingBucketUpdates=0 . Reason='Adding bucket, bid=kinesis~22~BC057F8A-75D0-4CDC-9BD0-EA5E0076B4AF' 06-04-2020 20:22:14.440 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/kinesis/db 06-04-2020 20:22:18.375 +0000 INFO IndexerIf - Asked to add or update bucket manifest values, bid=kinesis~21~BC057F8A-75D0-4CDC-9BD0-EA5E0076B4AF 06-04-2020 20:22:18.455 +0000 INFO DatabaseDirectoryManager - idx=kinesis Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/kinesis/db', pendingBucketUpdates=1 . Reason='Updating manifest: bucketUpdates=1' 06-04-2020 20:22:18.457 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/kinesis/db 06-04-2020 20:23:15.459 +0000 INFO DatabaseDirectoryManager - idx=kinesis Writing a bucket manifest in hotWarmPath='/opt/splunk/var/lib/splunk/kinesis/db', pendingBucketUpdates=0 . Reason='Buckets were rebuilt or tsidx-minified (bucket_count=1).' 06-04-2020 20:23:15.460 +0000 INFO DatabaseDirectoryManager - Finished writing bucket manifest in hotWarmPath=/opt/splunk/var/lib/splunk/kinesis/db ... View more

I'm getting this error when testing out importing a metric from CSV data: The metric value= is not valid for source=pdi_kinesis.csv, sourcetype=kinesis_metrics_csv, index=dev_metrics. Metric event data with an invalid metric value cannot be indexed. Ensure the input metric data is not malformed. The only thing I can think of that might cause this is nulls in the data? ie ,, do I need to have a zero in there?? ... View more

0 I'm using the AWS CLI to get some Kinesis metrics - part of that I'm able to specify the output format as one of the below: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html#cli-quick-configuration-format I've tried TEXT as that seems the most reasonable for splunk but I think the line separated data is messing up splunks ingest: METRICDATARESULTS iteratorAgeMilliseconds itagemillis PartialData METRICDATARESULTS readProvisionedThroughputExceeded itagemillis PartialData TIMESTAMPS 2020-04-15T20:21:00+00:00 TIMESTAMPS 2020-04-15T20:20:00+00:00 TIMESTAMPS 2020-04-15T20:19:00+00:00 TIMESTAMPS 2020-04-15T20:18:00+00:00 TIMESTAMPS 2020-04-15T20:17:00+00:00 TIMESTAMPS 2020-04-15T20:16:00+00:00 VALUES 0.0 VALUES 0.0 VALUES 0.0 VALUES 0.0 VALUES 0.0 VALUES 0.0 METRICDATARESULTS writeProvisionedThroughputExceeded itagemillis PartialData TIMESTAMPS 2020-04-15T19:36:00+00:00 TIMESTAMPS 2020-04-15T19:35:00+00:00 TIMESTAMPS 2020-04-15T19:34:00+00:00 TIMESTAMPS 2020-04-15T19:33:00+00:00 VALUES 0.0 VALUES 0.0 VALUES 0.0 VALUES 0.0 VALUES 0.0 VALUES 0.0 Any thoughts on either the AWS or splunk side on how best to handle ingesting this data ? ... View more

I'm using a rex to extract a field called field1 from my search... how do I take all the results of field1 and call out if they match on case or not? ie _time abc_123 _time ABC_123 _time def_123 _time def_123 first example I'd want to say there's a case diff while the second example is fine since the case's match ... View more

If I setup the REST API modular input - it'll properly read the API but I can't figure out how to get it to paginate. In the API response there's a field called next-cursor which its value should be specified in the NEXT API query that the REST modular app makes. I'm thinking, maybe either Response Handler Arguments, OR the Token substitution in Endpoint URL but its not super clear on how to use each of these. ... View more

I have a 'frozenTimePeriodInSecs' conf set - how can I tell whats 'aging' out today, tomorrow etc. How much data in GB ?? https://docs.splunk.com/Documentation/Splunk/8.0.0/Indexer/SetARetirementAndArchivingPolicy ... View more

Does the website monitoring plugin not capture the response? I see there seems to be an md5_content and a SHA of the 'content' but I'm not sure what I should be doing with those. @LukeMurphey What I'm after is the fact that I have a URL setup that hits a GSLB - I want to know where the GSLB routed the request to... ... View more