Hi All, We have 2 different sourcetype master and child need to join/append the source type on identity column master.id and child.mastertable_id. Please let us how can we display the result in search query using table format. sourcetype=master : id(pk)|filename|status 123|test1.txt|S 124|test2.txt|F 125|test3.txt|S 126|test4.txt|F sourcetype=child : id|mastertable_id(FK)|msg 221|124|connectivity issue 223|126|user aborted Final result should look like: id|filename|status|childid|msg 123|test1.txt|S|NA|NA 124|test2.txt|F|221|connectivity issue 125|test3.txt|S|NA|NA 126|test4.txt|F|223|126|user aborted Thanks ... View more

Hi, When a blank space is introduced in values, the search results are not yielding complete values. Please see details below. Event in Splunk looks like: id=43777924d6-fda8-4c2b-9884-2f85c6f84b4e queryType=join accountName=Test Acc anchor= applicationName=Test Application siteName=PUSH to Test Site My current search and result using the table command: index=db-general source="dbmon-tail://Logging*" | table accountName,applicationName,siteName Actual Search Result in Table format does not have complete values for accountName, applicationName, siteName: accountName applicationName siteName↕ Test Test PUSH Expected result should be as shown below: accountName applicationName siteName Test Acc Test Application PUSH to Test Site Any help in this regard is much appreciated. Thanks. ... View more

-------------------------------------------------------------- | R u n C o n t r o l D i s p l a y | -------------------------------------------------------------- 1. --------------------------------------------------------------- 2. | X X X X X X X X M U L T I - E N G I N E | 3. | Run Control Display Begin | 4. --------------------------------------------------------------- 5. Job Instance ID: XXXXXXXX Total Number of Engines Summarized: 22 6. --------------------------------------------------------------- 7. 8. Description Count 9. Total NO OF Input 14202 10. status 16 0 11. --------------------------------------------------------------- 12. | X X X X X X X X M U L T I - E N G I N E | 13. | Run Control Display End | 14. --------------------------------------------------------------- -------------------------------------------------------------- ... View more

Hi Team, I need to mask multiple phrase in XML file. where in the complete XML file is in one single line. Please confirm will below setup will do the job transforms.conf [memberid-anonymizer] DEST_KEY = _raw FORMAT = $1memberID>XXXXX$2 REGEX = (?m)^(.*)memberID>\w+(\w{4}[\<"].*)$ SOURCE_KEY = _raw [firstname-anonymizer] DEST_KEY = _raw FORMAT = $1memberFirstName>XXXXXXXXX$2 REGEX = (?m)^(.*)memberFirstName>\w+(\w{0}[\<"].*)$ SOURCE_KEY = _raw [lastname-anonymizer] DEST_KEY = _raw FORMAT = $1memberLastName>XXXXXXXXX$2 REGEX = (?m)^(.*)memberLastName>\w+(\w{0}[\<"].*)$ SOURCE_KEY = _raw props.conf [testsandbox] TRANSFORMS-anonymize = memberid-anonymizer, firstname-anonymizer, lastname-anonymizer Sample Event: 2014-04-11 53:14:37,751 INFO [WebContainer : 24] (UrgentCareController.java:) - InterPortletObjects from pp <com.sample.test.MytestObjects> <memberID>1234567</memberID> <memberlifeID>1294032</memberlifeID> <memberFirstName>Mugunthan</memberFirstName> <memberLastName>Gopala</memberLastName> </com.sample.test.MytestObjects> Thanks Mugunthan ... View more

Hi Team, Am testing index archiving and disk space allocation with below settings in indexes.conf file. Problem here is I don’t see any data moving into cold bucket, from warm bucket but its directly archived & forzen. Please let me know is there any issue with the configuration. indexes.conf [mytest] homePath = $SPLUNK_DB\mytest\db coldPath = $SPLUNK_DB\mytest\colddb thawedPath = $SPLUNK_DB\mytest\thaweddb tstatsHomePath = volume:_splunk_summaries\mytest\datamodel_summary # The maximum size in MB for a hot DB to reach before a roll to warm is triggered. maxDataSize = 1 # The maximum size of an index (in MB). This parameter only applies to hot, warm, and cold buckets. It does not apply to thawed buckets. maxTotalDataSizeMB = 7 # Specifies the maximum size of homePath (which contains hot and warm buckets). homePath.maxDataSizeMB = 2 # If this size is exceeded, Splunk will freeze buckets with the oldest value of latest time (for a given bucket) # until coldPath is below the maximum size. coldPath.maxDataSizeMB = 5 # Controls the service period (in seconds): how often splunkd performs certain housekeeping tasks. rotatePeriodInSecs = 60 # path to frozen archive coldToFrozenDir = C:\Users\Downloads\SplunkForzen # Number of seconds after which indexed data rolls to frozen. 4 hours frozenTimePeriodInSecs = 14400 Thanks Mugunthan ... View more

Hi, We would like to know more about lower (lower95) and upper (upper95) prediction and how the count for lower(predict(count)) upper(predict(count)) is derived. Thanks Mugunthan ... View more