Hi- I have the sample logs below and I want the output to be in this format. 1st Columns = BatchJobsName 2nd Col = Date 3rd Col = Start Time 4th Col = End Time 5th Col = Results where: The BatchJobsName column is the "emailJustifications" or the "sendBelga" in the sample logs below; The Date is the date found in "fired at:" in the sample logs below; The Start Time is the time found in "fired (by trigger DEFAULT.emailJustificationsSimpleTrigger) at:"; The End Time is the time found in "Job DEFAULT.emailJustificationsJobLauncher fired at:"; The Result is the "result=" SAMPLE LOGS: 2014-09-05 23:57:24,644 INFO org.quartz.plugins.history.LoggingJobHistoryPlugin Job DEFAULT.emailJustificationsJobLauncher fired at: 05/09/2014 23:59:24 result=OK 2014-09-05 23:57:24,531 INFO org.quartz.plugins.history.LoggingJobHistoryPlugin Job DEFAULT.emailJustificationsJobLauncher fired (by trigger DEFAULT.emailJustificationsSimpleTrigger) at: 23:57:19 09/05/2014 2014-09-05 23:55:00,723 INFO org.quartz.plugins.history.LoggingJobHistoryPlugin Job DEFAULT.sendBelgaJobLauncherUST fired at: 05/09/2014 23:55:00 result=ERROR 2014-09-05 23:55:00,712 INFO org.quartz.plugins.history.LoggingJobHistoryPlugin Job DEFAULT.sendBelgaLauncherUST fired (by trigger DEFAULT.sendBelgaTriggerUST) at: 21:55:00 09/05/2014 ... View more

I have the below data (response time) and I need to filter it from fastest to slowest response time and then get the following: Average Response Time (95%), Average Response Time(99%) and Average Response Time(100% ). What would be the right search query on this? I tried some suggestions here but cant get the right solutions.Please help.Thank you Response_Time 0.625 2.133 2.773 5.191 2.471 2.124 2.066 0.795 1.239 2.958 6.197 2.582 0.779 1.63 2.029 2.653 0.98 2.975 6.814 6.661 0.963 2.064 0.966 1.56 ... View more

Hi- There is an issue in my Splunk regading time and date of each events. Some events have year2017,year2018 in the timestamp.Please help 3/12/18 6:14:00.000 PM LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659host=xxxxxx Options| sourcetype=lptvpn-too_small Options| source=/var/log/lptvpn.log Options| index=prod Options| timeendpos=28 Options| timestartpos=16 Options 6/18/17 5:01:00.000 PM LATEST UPDATE : Jun 18 17:01 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.869host=xxxxx Options| sourcetype=lptvpn-too_small Options| source=/var/log/lptvpn.log Options| index=prod Options| timeendpos=28 Options| timestartpos=16 Options 3/20/17 5:58:00.000 PM LATEST UPDATE : Mar 20 17:58 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.675host=xxxxxx Options| sourcetype=lptvpn-too_small Options| source=/var/log/lptvpn.log Options| index=prod Options| timeendpos=28 Options| timestartpos=16 Options 3/19/17 5:46:00.000 PM LATEST UPDATE : Mar 19 17:46 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.673host=xxxxx Options| sourcetype=lptvpn-too_small Options| source=/var/log/lptvpn.log Options| index=prod Options| timeendpos=28 Options| timestartpos=16 Options 6/17/16 4:13:00.000 PM LATEST UPDATE : Jun 17 16:13 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.867host=xxxxx Options| sourcetype=lptvpn-too_small Options| source=/var/log/lptvpn.log Options| index=prod Options| timeendpos=28 Options| timestartpos=16 Options ... View more

I have the below config setup in inputs.conf to monitor all logs found in /var/log directory ( e.g. messages,mailog,named.log,secure log etc) and I can search them all in Splunk. [monitor:///var/log] disabled = false followTail = 0 host = pxxxxxxxxxxxdev index = dev However when I created a script and passed its logs (myscriptlog.log) into /var/log/,the Splunk cannot search that log although I still use the same search query "source=/var/log/*" and I also try "source=/var/log/myscriptlog.log" but there is 0 event though there is actually myscriptlog.log created in /var/log. Question: Do I need to restart inputs.conf although I did not change anything into it? Is there a Splunk command to search newly created log from the directory that is already being monitored and configured in inputs.conf?Please advise. Thank you ... View more