Hi all. I have been working on a query to alert us to when a date changes for a specific item, the item is represented in my query as GroupId. Dates can change any number of times, and I want to receive an alert whenever they do. I have come up with the following real-time search. I am concerned about it only having the data available from when the search starts. index=daluat PublishedGtpRule GroupId | dedup 100 GroupId sortby -_time | stats first(Date) As CurrentDate list(Date) As PreviousDates dc(Date) As Count by GroupId | where Count>1 I'll try my best to explain what I think would work best. Search for distinct GroupIds over a time period For each GroupId, search for the previous occurrence of it - all time Result if date has changed Preferably I'd like to see what the new and previous dates are too. This way my alerting doesn't have to be real-time. I can simply run it every minute, and look back over the last 2 or 3 minutes and allow the subsearch to go back through all time to find the last occurrence of a GroupId. FYI the number of GroupIds per minute is a low number, 10 at most. ... View more

Hi everyone. I have this query which works really well. It is returning an identifier and list of descriptions, dates and sources. However I'd like to be able to find the range between the min and max dates after the transaction. I then want to only output results where the range is greater than 2 hours for example. I think mvlist is the solution but I can't find any decent examples of its use. index=dalprod Action=PublishedDefaultRule Date Id Source | eval earliestDate = relative_time(now(), "-1d@d") | eval latestDate = relative_time(now(), "@d+7d") | eval Date = strptime(Date, "%d/%m/%Y %H:%M:%S") | where earliestDate < Date AND Date < latestDate | eval Date = strftime(Date ,"%d/%m/%Y %H:%M:%S") | fields Id Date GroupId Description SportId Source | join Id [search index=dalprod Action=DALPublish Source SportId NOT Source=Gambit] | dedup Date GroupId | eventstats count by GroupId | where count>=2 | transaction GroupId | table GroupId Date Source Description SportId Many thanks. Matt ... View more

I have the following search: earliest=@d+11h latest=@d+22h index="daluat" Action="DAL*" | timechart span=30m count At the moment there are no results. And I get the "No results..." message. But I want to see a 0 for every 30-minute timespan between 1100 and 2200. How do I do this? If there was a single result I get the full table- but if there were results then an alert would not trigger. Thanks, Matt ... View more

Hi, The source type for one of our hosts - HOST A - recently changed to websphere_activity. The source is log file data, we have not specified the source type in inputs.conf. An identical setup - HOST B, same server image, just a different log file name - is giving us the source type as expected. Which is the log file name with extension and path trimmed. Any idea why this might have started happening? Looking back at what changes we have made there is nothing related to source type. Having a look at the documentation it mentions that Splunk will automatically categorise websphere_activity when it sees it. However both our log file contents - both HOST A and HOST B have the same format. So why is this issue not effecting HOST B? Also note that any changes we make to Splunk configurations affect both servers. Thanks for any help. Matt ... View more

Hi Everyone. Perfmon logging used to work for me by placing what should have been in perfmon.conf into inputs.conf. Here is an example inputs.conf to illustrate what I mean. [monitor:///C:\logs\Splunk] disabled = false [perfmon://Processor Information] interval = 10 object = Processor Information counters = % Processor Time; instances = _Total disabled = 0 I've just looked and noticed that once the perfmon logs reach the Splunk indexer they are being attributed with $decideOnStartup for the host. I have noted that for remote monitoring I should be using WMI however the documentation looks incredibly long winded and non-trivial. Why is only the host unobtainable? I hope there can be some answers - works 4.3!!! Matt Additional Info: Sorry I should have made this apparent. I am using an image with a Splunk Forwarder installed on it. Then when I want to build a new server the Forwarder will boot up and start passing on PerfMon logs giving the relevant host. Also If I were to go down the WMI route, this requires for the service to be logged onto a domain account with certain privileges. Since the domain is going to be different on each server, every instance of Splunk on a new build is not going to be able to log in... ... View more