Assuming that Splunk is installed as per the recommended reference architecture and hardware, then based on real-world performance in other customers what are the Splunk benchmarks for the following metrics (assuming 5-10 GB data ingestion per day) - Latency [i.e., how long would it take from the point an event is generated to the time it is available for searching / alerting] - Search query response times [i.e., what would be the typical range of wait times before the search result is available] - Data reliability [i.e., what is typically the percentage of data transmitted from source systems that is successfully indexed] - Data integrity [i,e search results should be uniform , it should not change for the same time range when executed later] Is there any standard numbers given offcially by splunk when their standard infra requirements is followed ? ... View more

Hi, I have a list of cities and countries along with latitude and longitude. Name Latitude Longitude India Blah Blah US Blah Blah Now how do I lookup on them and plot on a map visualization in Splunk? (geostats, iplocation, etc) Thanks in advance ... View more

Hi, I have setup a dbmon-tail to fetch data from a SQL query every 15 minutes. It works as expected for a day until night, and suddenly the next day it stops tailing data. Select * from ArcUnion {{WHERE $rising_column$ > ?}} In the interval I have set as 15m. Can you please tell me what's the issue here? ... View more

Hi All, I want to merge two timecharts in a single panel, I have a file transmission tracker query A - which tracks when the file transmisiion occurs. Query B - tracks the triggered alerts ( negative condition - when the file doesnt come) A: index="fxr" fxr_ftpup_filename="DMM02YBRYBRPACEAVAILCOLLAT_*04*" OR fxr_ftpup_filename="DMM01YBRYBRCOLLATNAV_*05*" OR fxr_ftpup_filename="DMM10YBRDMMPaceRepoedgeInstruments_*_02*" OR fxr_ftpup_filename="DMM04YBRYBRPACEREPOTRD_*04*" OR fxr_ftpup_filename="DMM04YBRYBRPACEOTCTRD_*04*" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) as FileTransmissionTime | rename fxr_ftpup_filename as FileName,fxr_status as Status| replace "DMM01YBRYBRCOLLATNAV_*05*" with "EXPALGONAV-BNYM TO DMM NAV","DMM02YBRYBRPACEAVAILCOLLAT_*04*" with "EXPALGOPOF-BNYM TO DMM Free Inventory","DMM10YBRDMMPaceRepoedgeInstruments_*_02*" with "EVNT- PRICE DEMAND 01:30AM","DMM04YBRYBRPACEREPOTRD_*04*" with "EXPALGOPOR-BNYM TO DMM Repo Transaction","DMM04YBRYBRPACEOTCTRD_*04*" with "EXPALGOOTC-BNYM TO DMM OTC Transaction" in FileName | timechart span=1m count by FileName B: index=_audit action=alert_fired ss_app=search |convert ctime(trigger_time) as Time | timechart count(ss_name) by ss_name How to merge these both and show it in a single timechart. ... View more

Hi All, How to write a cron a expression that runs only at 4:50 AM and 5:05 AM on a day. Note: I want to save it as a single alert, I want to run it from Monday through-Friday. I tried something like below, but it will run @ 4:50 AM and 5:50 AM. 50 4-5 * * * 1-5 I want to run @ 4:50 AM and schedule it for the next 15th minute . Is this possible ? Please let me know. ... View more

How do I lookup for a field which has Or condition. example Source Destination File name act bank indexes_% bank act indices_% OR integer_% OR does not work, should I use pipe character ? ... View more

We have a java SDK program to post the data via UDP to index it in splunk. The connection string (userid,password to connect splunk) right now we have is based on admin role, we don't have any issues in posting data to splunk. But if I create a native user and role and select custom capabilities like edit_tcp,edit_udp,edit_websettings,input_file,output_file,rest_properties_get,rest_properties_set,use it as connection string the SDK fails and throws fata error like below: [Fatal Error] :-1:-1: Premature end of file.[Fatal Error] :-1:-1: Premature end of file. Any thoughts please ? Whether any additional capablity should be added ? How can I avoid cloning a admin role in this case... ... View more

Hi All, All of a sudden, Timestamp parsing doesn't work in splunk when I index a file manually into the system. It ignores the logfile time and takes the current system time. It was working well and I don't know suddenly what caused this problem, It's not even able to recognize the earlier indexed files. It just gives the error "Timestamp parsing failed".. Same case for event breaking too, it doesn't work either... Can you please post a resolution to this ? ... View more