I have created a custom APP called SAP-COPS Now when I click on that app, I see a search bar, Data Summary, and all that, but all the Dashboards which I have created under this app are coming only if I click on the Dashboard link in my app's page. Now I want the dashboards to reflect in the page as soon as I click on my APP. ... View more

Hi attached is the image which shows there is a difference in the Time field and the actual time which comes from the input file getting indexed with column name alertdate. so that means the index time and alertdate are not in sync which is incorrect right . Can you help me here. I am using below configuration. props.conf [zbxAlertReport] SHOULD_LINEMERGE = false INDEXED_EXTRACTIONS = csv FIELD_DELIMITER = , FIELD_NAMES = alerthost,hostname,alertname,alertstatus,alertseverity,alertdate TIMESTAMP_FIELDS = date TIME_FORMAT = %a%b%d%H:%M:%S%Y category = Structured MAX_TIMESTAMP_LOOKAHEAD = 500 transforms.conf [zbxAlertReport] filename = ZbxDailyReport.csv ... View more

1) I have a input file which looks like below: dc10splunksrch01:/opt/splunk/etc/apps/sfapp_all_zbx/lookups # head ZbxDailyReport.csv host,hostname,alertname,alertstatus,alertseverity,alertdate "prodmail2a","prodmail2a","Mail queue greater than 6000 on prodmail2a, current queue: 8051","OK","Information","Fri Sep 25 08:06:59 2015" "prodmail2a","prodmail2a","Mail queue greater than 8000 on prodmail2a, current queue: 8051","Problem","high","Fri Sep 25 08:06:59 2015" "pcwebp01n01.ams2.sf.priv","pcwebp01n01.ams2.sf.priv","pcwebp01n01.ams2.sf.priv /var Space Low (Total=1.94 GB, %Used=70.56 %)","Problem","Information","Fri Sep 25 08:09:32 2015" "pcwebp01n01.ams2.sf.priv","pcwebp01n01.ams2.sf.priv","pcwebp01n01.ams2.sf.priv /var Space Low (Total=1.94 GB, %Used=70.56 %)","OK","average","Thu Sep 24 16:03:44 2015" "scm001.ams2.sf.priv","scm001.ams2.sf.priv","CPU Load > 90%, Idle < 5% - scm001.ams2.sf.priv: Idle=56.49 %, Load=7.32, CPU.count=1","OK","high","Fri Sep 25 07:05:30 2015" 2) I am indexing it using the inputs.conf, props.conf, and transforms.conf like below. dc10splunksrch01:/opt/splunk/etc/apps/sfapp_all_zbx/local # cat inputs.conf [monitor:///opt/splunk/etc/apps/sfapp_all_zbx/lookups/ZbxDailyReport.csv] disabled = false followTail = 0 sourcetype=zbxAlertReport index=dc10_oss dc10splunksrch01:/opt/splunk/etc/apps/sfapp_all_zbx/local # cat transforms.conf [zbxAlertReport] filename = ZbxDailyReport.csv dc10splunksrch01:/opt/splunk/etc/apps/sfapp_all_zbx/local # cat props.conf [zbxAlertReport] TRANSFORMS-index-oss = route-index-oss 3) But its not getting indexed properly. In one line I am getting multiple records in some cases. Please refer to the screen shot. How to get them indexed correctly each line of CSV file as one line in Splunk? 4) How can I cluster same alertnames together irrespective of hostname since the alertname has hostname in it first. I need to get rid of hostname in the alert name and then group the alertname together. Note: hostname doesn't come in a particular place in the alertname. ... View more

When I run the search below, I get correct results without any decimal value in it. `linux-cpu` | search application=sc10_LMS host=* sub_module=* | stats max(pctLoad) AS pctLoad by host sub_module application | eval Health=if(pctLoad < 50,1,0) | eval Warn=if(pctLoad>= 50 AND pctLoad <80,1,0) | eval Crit=if(pctLoad>=80,1,0) | stats sum(Crit) as Critical sum(Warn) as Warning sum(Health) as Healthy dc(host) as Total by sub_module | sort - Critical Warning sub_module Critical Warning Healthy Total sc10_LMS_A 4 4 12 20 But when I put the same search in my dashboard which takes arguments from the drop-down like below, it gives me a result with decimal values only for Critical and Warning. How can I get rid of this decimal value? `linux-cpu` | search application=$application$ host=$host$ sub_module=$submodule$ | stats $function$(pctLoad) AS pctLoad by host sub_module application | eval Health=if(pctLoad < 50,1,0) | eval Warn=if(pctLoad>= 50 AND pctLoad <80,1,0) | eval Crit=if(pctLoad>=80,1,0) | stats sum(Crit) as Critical sum(Warn) as Warning sum(Health) as Healthy dc(host) as Total by sub_module | sort - Critical Warning sub_module Critical Warning Healthy Total sc10_LMS_A 4.00 4.00 12 20 ... View more

Hi, I want to know how SPlunk DB connect works in splunk. Does Splunk come with its own built-in database? Is it oracle/sql/db2 or its own language? So do all the searches/reports get saved in the splunk db? Thanks Surekha ... View more