this work for me, you may try | inputlookup <lookup_name> | head count=1 | outputlookup <lookup_name> ... View more

The source of truth for the timestamp is in the log itself. What you want to do is set your timezone for your user preference within Splunk so that it shows your preferred time zone when you run your searches. On your search head, click on: Username > Preferences > Time Zone   ... View more

It haven’t any password. Rpm installation just create that group and user. I prefer to create additional non login user w/o password and use it. Just do sudo -u USER bash to use it when needed. ... View more

Anyone found solution to this. There was a typo in my email address while registering and now I am not able to correct it.  ... View more

This is how I took care of a similar issue: 1. I ran a search on the SH:     index=my_index sourcetype=my_sourcetype | delete 2. After confirming that the records have been delete, I went to the HF - stopped Splunk -  /opt/splunk/bin/splunk cmd btprobe -d /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/ --file /my_file_path/filename.fileextension --reset - restarted Splunk and was able to see new data in SH ... View more

hi rakesh_498115, could you try delete splunkd.pif file and start splunk again? its under "$SPLUNK_HOME/var/run/splunk/" export SPLUNK_HOME="/opt/splunk" rm $SPLUNK_HOME/var/run/splunk/splunkd.pid $SPLUNK_HOME/bin/splunk status $SPLUNK_HOME/bin/splunk start another option is check splunk user has right to splunk home. chown -R splunk:splunk /opt/splunk/ And start splunk with "splunk" user. if problem stills exists could you share content of install_nix_forwarder.sh file ? ... View more

Can anyone help on the above requirement please?? ... View more

@payal23 glad you found a solution working for you. Seems like you accepted your own answer instead of mine. You can either accept my answer or up vote the comments that helped 🙂 ... View more

https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Enablethesearchhead ... View more

No john , I am just seeing the error code 2 but not the msg.. If I call the default echo.sh script it's working fine but when I try to call the another script in echo.sh file it's throwing this error. It's works fine in single search head environment but here I am having the issue. Am I missing something ... View more

I don't think there is way through Simple XML. You can do it either through SDK or JavaScript Extensions. ... View more

Hi rakesh, you could set your maxHotSpanSecs = 86400 This ensures, that buckets are in sizes of a day. So after the data is stored for 90 days it gets deleted. Maybe this helps: https://answers.splunk.com/answers/442480/how-to-troubleshoot-why-frozentimeperiodinsecs-is.html ... View more

I believe it would involve two steps, data cloning and metadata override. Before we go further, let me remind you that it would cause double license usage for the file. Assuming you've a data input (inputs.conf) setup to monitor the file with assigned index=indexA and sourcetype=sourcetypeA. Step 1: Data cloning You could configure your forwarder to clone the same data to two different indexers. See below link on corresponding outputs.conf configuration http://docs.splunk.com/Documentation/Forwarder/6.5.0/Forwarder/Configureforwardingwithoutputs.conf#Configure_data_cloning_on_a_universal_forwarder_with_outputs.conf Step 2: Metadata override On Indexer two have following props.conf and transforms.conf props.conf [sourcetypeA] ...other linebreaking/timestamp recognition settings.. TRANSFORMS-override = changeindex,changesourcetype transforms.conf [changesourcetype] FORMAT = sourcetype::sourcetypeB DEST_KEY = MetaData:Sourcetype REGEX = . [changeindex] DEST_KEY =_MetaData:Index REGEX = . FORMAT = indexB ... View more

Did you set your cluster master management port to: 52400 in web.conf? (You didn't show that) Perhaps if you had some snippets from the splunkd.log file from one of the indexers and the cluster master it would help. ... View more

was my answer helpful? if not, please clarify issues you have. ... View more

Hi @Rakesh_498115 - please mark this answer as "accepted" if this solved your problem. And yes - you can specify what you'd like the default value of the token to be. Here is an example: <input type="dropdown" token="sourcetype_tok"> <label>Select a source type</label> <default>splunkd</default> <choice value="splunkd">splunkd</choice> <choice value="splunk_web_access">splunk_web_access</choice> <choice value="splunkd_ui_access">splunkd_ui_access</choice> </input> ... View more

That is a different question then your original. Now that google opens in the window, you have to allow the target to be _blank, and default.xml doesn't allow some attributes. See http://answers.splunk.com/answers/11654/appbar-links-open-in-new-windo on how to put a _blank target on the href. Please accept the answer, as it is correct for your question. ... View more

but i am trying to run the search the one day window and its hanging on the finalize screen....didnt see this behaviour in older versions of splunk. ... View more

@esix[Splunk] What happens when License master is down. Does it count for indexing when it was down? ... View more

Hi if you use html dashboard toi can try kv store element To hide params on url. ... View more

Hello Rakesh, Again I would do the adjustments in the search to get de-duplicated data. However, try below configuration. Please be aware that It's not recommended [my_index] coldPath = $SPLUNK_DB/my_index/colddb homePath = $SPLUNK_DB/my_index/db thawedPath = $SPLUNK_DB/cold/my_index/thaweddb maxHotSpanSecs =3600 --->rolls hot to warm after 1 hr maxWarmDBCount = 0 --> rolls warm to cold (since its 0,it will directly roll to cold) frozenTimePeriodInSecs = 60 -->cold to frozen rotatePeriodInSecs = 60 Please try this in a test environment and check the logs to see if it happens . Refer http://docs.splunk.com/Documentation/Splunk/6.1/Admin/indexesconf for variable explanations ... View more

This is what I would do: On Cluster Master: splunk enable maintenance-mode Then follow the steps below on each indexer to delete data from an index... First come up with a search that finds only the data that you want removed. Run it to test that it works. Then make sure the admin user (or the user that that are using to do the delete) has can_delete role (or add the role). splunk edit user admin -role admin -role can_delete Run the search to delete the data (I want to delete data from the main index for the sourcetype syslog for a specific timeframe): splunk search 'index=main sourcetype=syslog | delete' -earliest_time '-26d@d' -latest_time '-3d@d' Then do the next indexer. Once you have run this on all indexers then from the Cluster Master: splunk rolling-restart cluster-peers splunk show cluster-status splunk disable maintenance-mode ... View more

try the metadata command. You can filter with where like any other search. Just modify the time value in the relative_time section to get the time range you are after. Note that as it's a generating search it must come first in the search bar |metadata type=sources index="myindex"|where recentTime > relative_time(now(), "-24h@h") And of course if you want to use the filenames in a subsequent search <main search> [|metadata type=sources index="myindex"|where recentTime > relative_time(now(), "-24h@h")|fields source] | etc If you are instead asking for a generic range picker then just try <your search> _index_earliest=-24h@h | etc Now go and read these: http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/SearchTimeModifiers http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Metadata http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Where ... View more

You will have more than 1 entry per time period because you are running 2 different searches but these are not "duplicates" because each search's entry will have mutually-exclusive data sets: the one search for "on-time" events and the other for "late-arriving" events. ... View more