Hi- I have the sample logs below and I want the output to be in this format. 1st Columns = BatchJobsName 2nd Col = Date 3rd Col = Start Time 4th Col = End Time 5th Col = Results where: The BatchJobsName column is the "emailJustifications" or the "sendBelga" in the sample logs below; The Date is the date found in "fired at:" in the sample logs below; The Start Time is the time found in "fired (by trigger DEFAULT.emailJustificationsSimpleTrigger) at:"; The End Time is the time found in "Job DEFAULT.emailJustificationsJobLauncher fired at:"; The Result is the "result=" SAMPLE LOGS: 2014-09-05 23:57:24,644 INFO org.quartz.plugins.history.LoggingJobHistoryPlugin Job DEFAULT.emailJustificationsJobLauncher fired at: 05/09/2014 23:59:24 result=OK 2014-09-05 23:57:24,531 INFO org.quartz.plugins.history.LoggingJobHistoryPlugin Job DEFAULT.emailJustificationsJobLauncher fired (by trigger DEFAULT.emailJustificationsSimpleTrigger) at: 23:57:19 09/05/2014 2014-09-05 23:55:00,723 INFO org.quartz.plugins.history.LoggingJobHistoryPlugin Job DEFAULT.sendBelgaJobLauncherUST fired at: 05/09/2014 23:55:00 result=ERROR 2014-09-05 23:55:00,712 INFO org.quartz.plugins.history.LoggingJobHistoryPlugin Job DEFAULT.sendBelgaLauncherUST fired (by trigger DEFAULT.sendBelgaTriggerUST) at: 21:55:00 09/05/2014 ... View more

I have the below data (response time) and I need to filter it from fastest to slowest response time and then get the following: Average Response Time (95%), Average Response Time(99%) and Average Response Time(100% ). What would be the right search query on this? I tried some suggestions here but cant get the right solutions.Please help.Thank you Response_Time 0.625 2.133 2.773 5.191 2.471 2.124 2.066 0.795 1.239 2.958 6.197 2.582 0.779 1.63 2.029 2.653 0.98 2.975 6.814 6.661 0.963 2.064 0.966 1.56 ... View more

Hi- There is an issue in my Splunk regading time and date of each events. Some events have year2017,year2018 in the timestamp.Please help 3/12/18 6:14:00.000 PM LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659host=xxxxxx Options| sourcetype=lptvpn-too_small Options| source=/var/log/lptvpn.log Options| index=prod Options| timeendpos=28 Options| timestartpos=16 Options 6/18/17 5:01:00.000 PM LATEST UPDATE : Jun 18 17:01 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.869host=xxxxx Options| sourcetype=lptvpn-too_small Options| source=/var/log/lptvpn.log Options| index=prod Options| timeendpos=28 Options| timestartpos=16 Options 3/20/17 5:58:00.000 PM LATEST UPDATE : Mar 20 17:58 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.675host=xxxxxx Options| sourcetype=lptvpn-too_small Options| source=/var/log/lptvpn.log Options| index=prod Options| timeendpos=28 Options| timestartpos=16 Options 3/19/17 5:46:00.000 PM LATEST UPDATE : Mar 19 17:46 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.673host=xxxxx Options| sourcetype=lptvpn-too_small Options| source=/var/log/lptvpn.log Options| index=prod Options| timeendpos=28 Options| timestartpos=16 Options 6/17/16 4:13:00.000 PM LATEST UPDATE : Jun 17 16:13 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.867host=xxxxx Options| sourcetype=lptvpn-too_small Options| source=/var/log/lptvpn.log Options| index=prod Options| timeendpos=28 Options| timestartpos=16 Options ... View more

I have the below config setup in inputs.conf to monitor all logs found in /var/log directory ( e.g. messages,mailog,named.log,secure log etc) and I can search them all in Splunk. [monitor:///var/log] disabled = false followTail = 0 host = pxxxxxxxxxxxdev index = dev However when I created a script and passed its logs (myscriptlog.log) into /var/log/,the Splunk cannot search that log although I still use the same search query "source=/var/log/*" and I also try "source=/var/log/myscriptlog.log" but there is 0 event though there is actually myscriptlog.log created in /var/log. Question: Do I need to restart inputs.conf although I did not change anything into it? Is there a Splunk command to search newly created log from the directory that is already being monitored and configured in inputs.conf?Please advise. Thank you ... View more

Hi- I have this search query: "source="/prod/splunkforwarder/bin/scripts/jrexpiry.sh" npw.gov.se" and my time frame is from April 1- April 30. The result it gets is 5,540 events. What I want is to just limit the results to 10 events per day in 1 month that is, on April 1st,it should only give 10 events, in Apr 2nd 10 events,in Apr 3rd 10 events and so on. How can I do this?Please advise. Cheers! Isaias ... View more

Hi- I modified the input.conf file to monitor all logs in /var/log. ( I restarted splunk after editing inputs.conf) [monitor:///var/log] disabled = false followTail = 0 host = xxxxyyyzzz index = dev I made a script that will create a logfile(lptvpn.log) into /var/log directory . The exact content of the logfile should be this root@xxxxyyyzzz:/var/log# cat lptvpn.log LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659 But when I searched it in the Splunk using this search query "lptvpn.log" I am getting this logs: INFO LicenseUsage - type=Usage s="/var/log/lptvpn.log" st="lptvpn-too_small" h=xxxxyyyzzz o="" i="7091808B-9D8A-431D-80EC-D5BEF63F14F3" pool="auto_generated_pool_enterprise" b=72 poolsz=2147483648 Question: How will I search or view the exact log of lptvpn.log? (i.e. "LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659") Do I need to modify the input.conf?Thanks in advance ... View more