Thanks. I am able to get that in milliseconds but I want to convert the response time to Percent as well for reporting and compare it with earlier week, How to achieve that? ... View more

Hey, I'm having similar issues. They previously worked when sentb but since the upgrade having a few kinks. MY config is pretty much the same . Here is a sample of the log: 02-25-2015 10:34:29.283 -0500 INFO TailingProcessor - Archive file='/splunkapp/home/jam_it_apps_support_intec/Server_Uploads/INTL/DWF_20150225_073228_0_4_1.CSV.gz' upd ated less than 10000ms ago, will not read it until it stops changing.' 02-25-2015 10:34:39.287 -0500 INFO TailingProcessor - Archive file='/splunkapp/home/jam_it_apps_support_intec/Server_Uploads/INTL/DWF_20150225_073228_0_4_1.CSV.gz' has stopped changing, will read it now. A similar path with the same configurations files were gobbled up perfectly. ... View more

cheers! thanks ... View more

wow just wow!! it works!! thank you so much! ... View more

updated some regex... ... View more

@martin_mueller The client name (/xyz/splunk/bin/splunk restart splunkweb) mentioned the answer is edited. ... View more

i already figured out this one. The splunk gets the timestamp on input of the eventlogs itself. The timestamp show 2018-03-12 because the input of the logs includes Mar 12 18:14.It seems that the timestamps read the time 18:14 (6:14PM) as year 2018. ... View more

oh is see..same question was asked before.you may try this: http://answers.splunk.com/answers/1275/renaming-_time-field-causes-an-unwanted-result ... View more

you're welcome please mark this as answered - thx ... View more

Try adding "| streamstats count by date_mday | where count <= 10" to your search. For example: source="/prod/splunkforwarder/bin/scripts/jrexpiry.sh" npw.gov.se | streamstats count by date_mday | where count <= 10 ... View more

the_wolverine has the best answer. This assigns a specific color for a specific value. For anyone with the same problem as me that if you have for example "low", "medium", "high" values and you want to color them in green, yellow, red then this will assign the correct color every time! All other answers will color medium as green if there are no low value for example! 😃 ... View more

http://docs.splunk.com/Documentation/Splunk/latest/Security/Addandeditroles#Add_or_edit_a_role is the documentation on how to edit a role. Do you create an index named dev ? Here is the documentation for creating an index - you have to do that before you can send data to it... http://docs.splunk.com/Documentation/Splunk/6.0.2/Indexer/Setupmultipleindexes#Create_and_edit_indexes ... View more

To manage multiple severs of the same type, you should use a deployment server. In the serverclass.conf of the deployment server, which typically resides on the indexer you should specify restartSplunkd = true | false as true. This will force the forwarders to restart after the update to the input. ... View more

As @linu1988 said - what happened to the field? Also, TNSping is not a string and you can't do > for strings anyway, so your where command will not work. Try this, carefully: OEM Event Listener response to a TNS ping is | rex "TNS ping is (?<TNSping>\d+) msecs" | where TNSping > 5000 ... View more

I don't know which fields you have at your disposal, but for instance if the URL is extracted to the field url and the user is in the field user : ... url=yoururl | stats count by user ... View more

Thanks Iguinn. ... View more

Hello, This happens due to splunks email id recognition system. It's not able to match. Follow the below post it will work http://answers.splunk.com/answers/124873/alert-email-address-doesnt-allow-our-domain ... View more

They are the positional parameters as passed to the script. You will refer to them within the script as $0..$8. What you do with them within the script is up to you. It sounds like you are a shell scripting novice, in which case you would do better to go do some basic research on shell scripting. A quick search for "simple shell scripting" "linux" returns a flood of results, but you could do worse than start with http://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html http://www.tech-faq.com/unix-shell-scripting-tutorials.html ... View more

i did all the workarounds you stated but it did not work..thanks anyway. ... View more