I am searching Cisco calling records via the Splunk Cisco CDR app, examining the calling and called party numbers and their counts. I need to create a search that returns raw results only where a given calling party number shows up X or more times; I want to eliminate any results where its calling party number does not show up above that threshold. I unfortunately have had great difficulty in generating such a search and being able to export the raw events to CSV. In order to generate a table of counts by calling party number (only part of what I need) I use this: `cdr_events` earliest=-4h latest=now | stats min(_time) as _time values(callId) as callId values(callingPartyNumber) as callingPartyNumber by globalCallID_callId globalCallID_callManagerId globalCallId_ClusterID | search | stats dc(callId) as CallCount by callingPartyNumber | where CallCount > 500 Unfortunately I do not have confidence that search's raw results (the "Events" tab on the search screen) only correspond to the events identified by the "where" clause. Moreover if I try to export results to CSV only the table of stats is returned. The search is already scheduled to email out the table of stats. In a perfect world, though, I would have that table of stats emailed and the raw results - filtered in the manner I described above - included in the email as an attachment. At this point, however, I would gladly take just the raw log lines for all instances where the count of callingPartyNumber exceeds value X that I designate. ... View more

If an input is specified identically in the inputs.conf file of multiple apps running on a Universal forwarder, will the same data be gathered multiple times (and thus generate extra license usage) or just once? I'm looking at indexed data volume in our Splunk environment for a particular sourcetype within the Splunk App for Microsoft Exchange (winhostmon). In looking at .conf files on one of our Exchange servers' Universal Forwarder, I see that the inputs.conf file within the "TA-Exchange-2010-CAS" app, the "TA-Exchange-2010-HUB" app, and the TA-Windows-2008R2-Exchange-IIS" app all have inputs for "winhostmon" defined precisely the same. None are disabled. Does that mean this data is being gathered and indexed once per application specifying this input? Or is the forwarder smart enough to only gather it once? ... View more

We have a distributed environment of one search head, one indexer and one deployment server + license master. I'm working on resolving CPU utilization issues right now related to too many scheduled searches running during the day and towards that end, I'm trying to prune extraneous applications. I've noticed that I have a number of applications installed on my Indexer as well as my Search Head and I'm concerned that they are causing scheduled searches to be executed extraneously. On which of those servers do I need to install each application? Both Search Head and Indexer or only the Search Head? ... View more

I've successfully installed the Splunk App for F5 Networks and Splunk App for F5 Access apps into our Splunk 5.0.5 installation. I configured a non-default index for logs to go into named "f5" and configured the input set up for the app to direct data into that new index. That input is configured for source type of "syslog". At this time we only have data coming in from AFM as we haven't completed configuring other modules. I've confirmed logs are appearing in that index and they're of the proper source type ("F5:AFM:Syslog"). However the app refuses to return any results for any of its dashboards regardless of search settings. I believe the issue is that we're using a different index for the data. When inspecting all of the app's queries I see that they're all prepended with the text "search" which I think is directing Splunk to look in the wrong index. Here's an example of one: search sourcetype="F5:AFM:Syslog" | stats count by action src_ip dest_ip dest_port bigip_mgmt_ip hostname src_port _time If I remove the text "search" from the above query and insert "index=f5" at the beginning the search returns results without issue. Oddly leaving the "search" text while also specifying the index does not produce results. I've tried the following to correct this: A custom eventtypes.conf with stanzas for each F5 sourcetype and a "search = index=f5" line under each a custom indexes.conf with the line "defaultdatabase=f5" a custom inputs.conf with the line "index = f5" editing savedsearches.conf to add "index=f5" to all the "search" items under each search entry that don't already define an index Evidence seems to indicate that the problem is that the app is searching the wrong index. How in the world do I go about directing it to search the "f5" index I've created? ... View more