Hi all. I have been working on a query to alert us to when a date changes for a specific item, the item is represented in my query as GroupId. Dates can change any number of times, and I want to receive an alert whenever they do. I have come up with the following real-time search. I am concerned about it only having the data available from when the search starts. index=daluat PublishedGtpRule GroupId | dedup 100 GroupId sortby -_time | stats first(Date) As CurrentDate list(Date) As PreviousDates dc(Date) As Count by GroupId | where Count>1 I'll try my best to explain what I think would work best. Search for distinct GroupIds over a time period For each GroupId, search for the previous occurrence of it - all time Result if date has changed Preferably I'd like to see what the new and previous dates are too. This way my alerting doesn't have to be real-time. I can simply run it every minute, and look back over the last 2 or 3 minutes and allow the subsearch to go back through all time to find the last occurrence of a GroupId. FYI the number of GroupIds per minute is a low number, 10 at most. ... View more

Hi everyone. I have this query which works really well. It is returning an identifier and list of descriptions, dates and sources. However I'd like to be able to find the range between the min and max dates after the transaction. I then want to only output results where the range is greater than 2 hours for example. I think mvlist is the solution but I can't find any decent examples of its use. index=dalprod Action=PublishedDefaultRule Date Id Source | eval earliestDate = relative_time(now(), "-1d@d") | eval latestDate = relative_time(now(), "@d+7d") | eval Date = strptime(Date, "%d/%m/%Y %H:%M:%S") | where earliestDate < Date AND Date < latestDate | eval Date = strftime(Date ,"%d/%m/%Y %H:%M:%S") | fields Id Date GroupId Description SportId Source | join Id [search index=dalprod Action=DALPublish Source SportId NOT Source=Gambit] | dedup Date GroupId | eventstats count by GroupId | where count>=2 | transaction GroupId | table GroupId Date Source Description SportId Many thanks. Matt ... View more

I have the following search: earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | timechart span=30m count At the moment there are no results. And I get the "No results..." message. But I want to see a 0 for every 30-minute timespan between 1100 and 2200. How do I do this? If there was a single result I get the full table- but if there were results then an alert would not trigger. Thanks, Matt ... View more

Hi, The source type for one of our hosts - HOST A - recently changed to websphere_activity. The source is log file data, we have not specified the source type in inputs.conf. An identical setup - HOST B, same server image, just a different log file name - is giving us the source type as expected. Which is the log file name with extension and path trimmed. Any idea why this might have started happening? Looking back at what changes we have made there is nothing related to source type. Having a look at the documentation it mentions that Splunk will automatically categorise websphere_activity when it sees it. However both our log file contents - both HOST A and HOST B have the same format. So why is this issue not effecting HOST B? Also note that any changes we make to Splunk configurations affect both servers. Thanks for any help. Matt ... View more

Hi Everyone. Perfmon logging used to work for me by placing what should have been in perfmon.conf into inputs.conf. Here is an example inputs.conf to illustrate what I mean. [monitor:///C:\logs\Splunk] disabled = false [perfmon://Processor Information] interval = 10 object = Processor Information counters = % Processor Time; instances = _Total disabled = 0 I've just looked and noticed that once the perfmon logs reach the Splunk indexer they are being attributed with $decideOnStartup for the host. I have noted that for remote monitoring I should be using WMI however the documentation looks incredibly long winded and non-trivial. Why is only the host unobtainable? I hope there can be some answers - works 4.3!!! Matt Additional Info: Sorry I should have made this apparent. I am using an image with a Splunk Forwarder installed on it. Then when I want to build a new server the Forwarder will boot up and start passing on PerfMon logs giving the relevant host. Also If I were to go down the WMI route, this requires for the service to be logged onto a domain account with certain privileges. Since the domain is going to be different on each server, every instance of Splunk on a new build is not going to be able to log in... ... View more

Hello, I hope you can help me refine the following query. So far I am successfully getting the GroupId, Description, Date and count from the initial search and first join statement. The three joins further down are intended to detect when a source is missing and then if not, print out a "Yes" to the user: host=*90* Action=Norm* _myCategory _sourceA OR _sourceB OR _sourceC | dedup Source GroupId | stats count by GroupId | join GroupId [search Action=PublishedGtpRule | fields + GroupId Description Date SportId] | eval pDate=strptime(Date, "%d/%m/%Y %H:%M:%S")-now() | where pDate>0 AND pDate<86400 AND count<3 | join GroupId [search _sourceA | eval SourceAAvailable="Yes" ] | join GroupId [search _sourceB | eval SourceBAvailable="Yes" ] | join GroupId [search _sourceC | eval SourceCAvailable="Yes" ] | fields GroupId Description Date count SourceAAvailable SourceBAvailable SourceCAvailable This query has two problems: Mainly it doesn't work as intended, however I have been trying to piece it together for a while and not quite hitting the mark. It takes a long time to come up with results and frequently causes the web server to stop responding/restart. I am aware this is probably due to the multiple joins each kicking off a search so if there was a neater way to do this that would be highly appreciated. I'm trying to find out in a given category, which results have less than 3 sources. Once these have been found display a description and information to determine which sources are missing. Many thanks to y'all. Matt ... View more

Hello, I feel like I am close to figuring this out. If there was a way to just pump out all the fields you have available after a join I'd like to know. Anyway. I am working on the following query: Action=NormInsert Source | join GroupId [search Action=PublishedGtpRule] | dedup Source GroupId | stats count by GroupId | fields Description count What I am trying to figure out is how to show the results of the stats query, with the Description found from the join?? *************MORE INFO************* Example NormInsert Data: 2013-01-28 14:45:13.5131 Action="NormInsert" Id="1942454" GroupId="47201bcf-2079-401e-855a-4f2ec14c1370" SportId="9aa265c0-1b55-4044-8548-757a8cb247eb" Source="965c6b51-e6be-4e60-aa08-dbb42c076ebe" Example Published Data: 2013-01-28 14:47:32.0531 Action="PublishedGtpRule" Id="" GroupId="226e67be-5e58-4136-984d-d1df1fafe197" SportId="ab3af3be-0827-4311-b271-0ae568a13726" Source="GtpRule" Description="West Virginia v Kansas" Date="29/01/2013 02:00:00" ........ What I am aiming to discover is for each GroupId how many unique Sources have been received. The count of unique sources can be found using the NormInserts. However the Published data is an aggregate of data so individual sources are not available here. So I want to count, and then add descriptive data for a content team to be able to analyse. I do have alternatives: Just use the GroupIds and let them work out what is missing, but is likely to be a tiresome process for them. Add the extra data straight onto the Published log. ... View more